added tests for ownership over actions to chip copies

BlueAccords · Apr 21, 2018 · d914ad9 · d914ad9
1 parent 33c97b6
commit d914ad9
Show file tree

Hide file tree

Showing 4 changed files with 83 additions and 24 deletions.
diff --git a/dump.rdb b/dump.rdb
diff --git a/server/controllers/folder.js b/server/controllers/folder.js
@@ -61,7 +61,7 @@ module.exports = {
   },
   createChipCopy: async function(req, res) {
     const id = req.params.id;
-    const chipCopyParams = req.body;
+    let chipCopyParams = req.body;
     // IDEA: add better schema validation for updating values
     chipCopyParams.folder_id = id; // override passed in folder id as needed
     const newChipCopy = await ChipCopy.query().insert(chipCopyParams);
@@ -71,7 +71,8 @@ module.exports = {
   updateChipCopy: async function(req, res) {
     const folderId = req.params.id;
     const copyId = req.params.copyId;
-    const chipCopyParams = req.body;
+    let chipCopyParams = req.body;
+    chipCopyParams.folder_id = folderId; // override folderid so users can't update chip copies of other folders
     const folder = await Folder.query().findById(folderId)
       .throwIfNotFound(); // throws error if not found and passes to error handler
 

diff --git a/server/index.js b/server/index.js
@@ -26,7 +26,7 @@ const PORT = 3000;
 Model.knex(knex)
 
 // server logger
-if (process.env.NODE_ENV == 'development' || process.env.NODE_ENV == 'test') {
+if (process.env.NODE_ENV == 'development' || process.env.NODE_ENV == 'production') {
   app.use(logger('dev'));
 }
 

diff --git a/server/test/routes.folder.test.js b/server/test/routes.folder.test.js
@@ -164,45 +164,103 @@ describe('# routes : folder', () => {
     });
   });
 
-  describe.skip('## Folder : Child Copies routes', () => {
-    describe(' /api/folder/:id/chips/:chipId', () => {
+  describe('## Folder : Child Copies routes', () => {
+    describe('/api/folder/:id/chips/', () => {
       it('should create a new chip copy', (done) => {
         testHelper.login(agent, chai).then(() => {
           knex('folder').select('*').first().then((singleFolder) => {
-            // TODO
             agent
-            .put(`/api/folder/${singleFolder.id}`)
+            .post(`/api/folder/${singleFolder.id}/chips`)
             .send({
-              description: 'updated folder description',
+              code: 'Z',
+              folder_id: 1,
+              chip_id: 1
             })
             .end((err, res) => {
-              should.not.exist(err);
               res.status.should.equal(200);
               res.type.should.equal('application/json');
               res.body.message.should.eql('success');
               res.body.data.should.include.keys(
-                'id', 'title', 'description'
+                'code', 'folder_id', 'chip_id'
               );
-              res.body.data.description.should.equal('updated folder description');
+              res.body.data.folder_id.should.equal(singleFolder.id);
               done();
             });
           });
         });
       });
-
-      it('should throw an error if folder id does not exist', (done) => {
-        const invalidFolderId = 99999;
+    });
+    describe('/api/folder/:id/chips/:chipId WITH user as owner of folder', () => {
+      const existingChipCopyId = 1;
+      it('should update an existing chip copy', (done) => {
         testHelper.login(agent, chai).then(() => {
-          agent
-          .put(`/api/folder/${invalidFolderId}`)
-          .send({
-            description: 'updated folder description',
-          })
-          .end((err, res) => {
-            should.not.exist(err);
-            res.status.should.equal(404);
-            res.type.should.equal('application/json');
-            done();
+          knex('folder').select('*').where('author_id', 1).first().then((singleFolder) => {
+            agent
+            .put(`/api/folder/${singleFolder.id}/chips/${existingChipCopyId}`)
+            .send({
+              code: 'V',
+              folder_id: 1,
+            })
+            .end((err, res) => {
+              res.status.should.equal(200);
+              res.type.should.equal('application/json');
+              res.body.message.should.eql('success');
+              res.body.data.should.include.keys(
+                'code', 'folder_id', 'chip_id'
+              );
+              res.body.data.folder_id.should.equal(singleFolder.id);
+              res.body.data.id.should.equal(existingChipCopyId);
+              res.body.data.code.should.equal('V');
+              done();
+            });
+          });
+        });
+      });
+      it('should delete an existing chip copy', (done) => {
+        testHelper.login(agent, chai).then(() => {
+          knex('folder').select('*').where('author_id', 1).first().then((singleFolder) => {
+            agent
+            .delete(`/api/folder/${singleFolder.id}/chips/${existingChipCopyId}`)
+            .end((err, res) => {
+              res.status.should.equal(200);
+              res.type.should.equal('application/json');
+              res.body.message.should.eql('success');
+              done();
+            });
+          });
+        });
+      });
+    });
+
+    describe('/api/folder/:id/chips/:chipId WITHOUT user as owner of folder', () => {
+      const existingChipCopyId = 1;
+      it('should NOT update an existing chip copy', (done) => {
+        testHelper.login(agent, chai).then(() => {
+          knex('folder').select('*').where('author_id', 2).first().then((singleFolder) => {
+            agent
+            .put(`/api/folder/${singleFolder.id}/chips/${existingChipCopyId}`)
+            .send({
+              code: 'V',
+              folder_id: 1,
+            })
+            .end((err, res) => {
+              res.status.should.equal(403);
+              res.type.should.equal('application/json');
+              done();
+            });
+          });
+        });
+      });
+      it('should NOT delete an existing chip copy', (done) => {
+        testHelper.login(agent, chai).then(() => {
+          knex('folder').select('*').where('author_id', 2).first().then((singleFolder) => {
+            agent
+            .delete(`/api/folder/${singleFolder.id}/chips/${existingChipCopyId}`)
+            .end((err, res) => {
+              res.status.should.equal(403);
+              res.type.should.equal('application/json');
+              done();
+            });
           });
         });
       });