1+ # !/usr/bin/env perl
2+ # Test that a new blog submitted by a logged in user cannot be edited by another user.
3+ use Mojo::Base ' -signatures' ;
4+ use BlogDB::Web::Test;
5+
6+ my $t = Test::Mojo::BlogDB-> new(' BlogDB::Web' );
7+
8+ # Post a new blog as a logged in user, ensure that it exists, make sure that the submitter id matches.
9+ $t -> create_user-> post_ok( ' /blog/new' ,
10+ form => {
11+ url => ' https://modfoss.com/' ,
12+ })-> code_block( sub {
13+ my ( $t ) = @_ ;
14+ $t -> _ss($t -> app-> db-> resultset(' PendingBlog' )-> find( { url => ' https://modfoss.com/' }));
15+ ok $t -> _sg, " Created blog entry." ;
16+ is $t -> _sg-> submitter_id, $t -> stash-> {person }-> id, ' Owned by the current user.' ;
17+ is $t -> _sg-> edit_token, undef , ' No edit token for a user-submitted blog.' ;
18+ });
19+
20+ my $blog_id = $t -> _sg-> id;
21+
22+ # New Session.
23+ $t = Test::Mojo::BlogDB-> new(' BlogDB::Web' );
24+
25+ $t -> create_user-> post_ok( " /blog/new/$blog_id " , form => {
26+ title => ' modFoss' ,
27+ url => ' https://modfoss.com/' ,
28+ rss_url => ' https://modfoss.com/feed' ,
29+ tagline => ' Articles on technical matters.' ,
30+ about => ' A technical blog.'
31+ })-> code_block( sub {
32+ my ( $t ) = @_ ;
33+ $t -> _ss($t -> app-> db-> resultset(' PendingBlog' )-> find( { url => ' https://modfoss.com/' }));
34+ ok $t -> _sg, " Found blog entry" ;
35+ is $t -> _sg-> title, undef , ' Title still the same' ;
36+ is $t -> _sg-> url, ' https://modfoss.com/' , ' URL the same.' ;
37+ is $t -> _sg-> rss_url , undef , ' RSS URL still the same.' ;
38+ is $t -> _sg-> tagline , undef , ' Tagline still the same.' ;
39+ is $t -> _sg-> about , undef , ' About still the same.' ;
40+ })-> stash_has( { errors => [ ' Not Authorized.' ] } );
41+
42+ done_testing;
0 commit comments