test: cover anonymous read API paths

apps/meteor/tests/end-to-end/api/methods.ts

@@ -5,7 +5,7 @@ import { expect } from 'chai';
 import { after, before, describe, it } from 'mocha';
 
 import { retry } from './helpers/retry';
-import { api, credentials, getCredentials, methodCall, request } from '../../data/api-data';
+import { api, credentials, getCredentials, methodCall, methodCallAnon, request } from '../../data/api-data';
 import { sendMessage, sendSimpleMessage } from '../../data/chat.helper';
 import { CI_MAX_ROOMS_PER_GUEST as maxRoomsPerGuest } from '../../data/constants';
 import { closeOmnichannelRoom, createAgent, createLivechatRoom, createVisitor, makeAgentAvailable } from '../../data/livechat/rooms';
@@ -857,7 +857,75 @@ describe('Meteor.methods', () => {
 				.end(done);
 		});
 
-		after(() => deleteRoom({ type: 'p', roomId: rid }));
+		let publicRid: IRoom['_id'];
+		let publicMessageId: IMessage['_id'];
+
+		before('create public channel with a message', async () => {
+			publicRid = (await createRoom({ type: 'c', name: `methods-test-public-${Date.now()}` })).body.channel._id;
+			publicMessageId = (await sendMessage({ message: { rid: publicRid, msg: 'public message' } })).body.message._id;
+		});
+
+		after(() => Promise.all([deleteRoom({ type: 'p', roomId: rid }), deleteRoom({ type: 'c', roomId: publicRid })]));
+
+		describe('anonymous read', () => {
+			before(() => updateSetting('Accounts_AllowAnonymousRead', true));
+			after(() => updateSetting('Accounts_AllowAnonymousRead', false));
+
+			it('should return public channel messages to an anonymous caller when anonymous read is enabled', async () => {
+				const res = await request
+					.post(methodCallAnon('loadHistory'))
+					.send({
+						message: JSON.stringify({
+							id: 'id',
+							msg: 'method',
+							method: 'loadHistory',
+							params: [publicRid],
+						}),
+					})
+					.expect('Content-Type', 'application/json')
+					.expect(200);
+
+				const data = JSON.parse(res.body.message);
+				expect(data.result).to.have.a.property('messages').that.is.an('array');
+				expect(data.result.messages.map((m: IMessage) => m._id)).to.include(publicMessageId);
+			});
+
+			it('should not return private group messages to an anonymous caller even when anonymous read is enabled', async () => {
+				const res = await request
+					.post(methodCallAnon('loadHistory'))
+					.send({
+						message: JSON.stringify({
+							id: 'id',
+							msg: 'method',
+							method: 'loadHistory',
+							params: [rid],
+						}),
+					})
+					.expect('Content-Type', 'application/json')
+					.expect(200);
+
+				const data = JSON.parse(res.body.message);
+				expect(data.result).to.equal(false);
+			});
+		});
+
+		it('should fail for an anonymous caller when anonymous read is disabled', async () => {
+			const res = await request
+				.post(methodCallAnon('loadHistory'))
+				.send({
+					message: JSON.stringify({
+						id: 'id',
+						msg: 'method',
+						method: 'loadHistory',
+						params: [publicRid],
+					}),
+				})
+				.expect('Content-Type', 'application/json')
+				.expect(400);
+
+			const data = JSON.parse(res.body.message);
+			expect(data.error).to.have.property('error', 'error-invalid-user');
+		});
 
 		it('should fail if not logged in', async () => {
 			const res = await request
@@ -2539,7 +2607,7 @@ describe('Meteor.methods', () => {
 				}),
 			};
 
-			const res = await request.post('/api/v1/method.callAnon/getRoomByTypeAndName').set('Content-Type', 'application/json').send(payload);
+			const res = await request.post(methodCallAnon('getRoomByTypeAndName')).send(payload);
 
 			expect(res.body).to.have.property('message');
 			const parsedMessage = JSON.parse(res.body.message);
@@ -2668,17 +2736,14 @@ describe('Meteor.methods', () => {
 		it('should return the room object for a Public Channel if anonymous read is enabled', async () => {
 			await updateSetting('Accounts_AllowAnonymousRead', true);
 
-			const res = await request
-				.post(methodCall('getRoomByTypeAndName'))
-				.set(credentials)
-				.send({
-					message: JSON.stringify({
-						method: 'getRoomByTypeAndName',
-						params: ['c', room._id],
-						id: 'id',
-						msg: 'method',
-					}),
-				});
+			const res = await request.post(methodCallAnon('getRoomByTypeAndName')).send({
+				message: JSON.stringify({
+					method: 'getRoomByTypeAndName',
+					params: ['c', room._id],
+					id: 'id',
+					msg: 'method',
+				}),
+			});
 
 			expect(res.body.success).to.equal(true);
 			const parsedResponse = JSON.parse(res.body.message);