aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--app/controllers/application_controller.rb2
-rw-r--r--app/controllers/referentials_controller.rb8
-rw-r--r--app/models/organisation.rb2
-rw-r--r--spec/controllers/line_referentials_controller_spec.rb4
-rw-r--r--spec/controllers/lines_controller_spec.rb8
-rw-r--r--spec/controllers/referentials_controller_spec.rb36
-rw-r--r--spec/controllers/stop_area_referentials_controller_spec.rb4
-rw-r--r--spec/controllers/stop_areas_controller_spec.rb8
-rw-r--r--spec/models/referential_spec.rb25
-rw-r--r--spec/views/referentials/show.html.erb_spec.rb1
10 files changed, 76 insertions, 22 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 45b7f55f6..c4961123d 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -28,7 +28,7 @@ class ApplicationController < ActionController::Base
protected
def user_not_authorized
- redirect_to forbidden_path
+ render 'errors/forbidden', status: 403
end
def current_organisation
diff --git a/app/controllers/referentials_controller.rb b/app/controllers/referentials_controller.rb
index 5267c15d8..6e3694547 100644
--- a/app/controllers/referentials_controller.rb
+++ b/app/controllers/referentials_controller.rb
@@ -7,6 +7,8 @@ class ReferentialsController < ChouetteController
respond_to :json, :only => :show
respond_to :js, :only => :show
+ before_action :check_cloning_source_is_accessible, only: %i(new create)
+
def new
new! do
build_referential
@@ -175,6 +177,12 @@ class ReferentialsController < ChouetteController
)
end
+ def check_cloning_source_is_accessible
+ return unless params[:from]
+ source = Referential.find params[:from]
+ return user_not_authorized unless current_user.organisation.workgroups.include?(source.workbench.workgroup)
+ end
+
def load_workbench
@workbench ||= Workbench.find(params[:workbench_id]) if params[:workbench_id]
@workbench ||= resource&.workbench if params[:id]
diff --git a/app/models/organisation.rb b/app/models/organisation.rb
index e8fb4e060..745bc0d22 100644
--- a/app/models/organisation.rb
+++ b/app/models/organisation.rb
@@ -13,6 +13,8 @@ class Organisation < ActiveRecord::Base
has_many :line_referentials, through: :line_referential_memberships
has_many :workbenches
+ has_many :workgroups, through: :workbenches
+
has_many :calendars
has_many :api_keys, class_name: 'Api::V1::ApiKey'
diff --git a/spec/controllers/line_referentials_controller_spec.rb b/spec/controllers/line_referentials_controller_spec.rb
index 17ffb670d..8e8d48fda 100644
--- a/spec/controllers/line_referentials_controller_spec.rb
+++ b/spec/controllers/line_referentials_controller_spec.rb
@@ -6,8 +6,8 @@ RSpec.describe LineReferentialsController, :type => :controller do
describe 'PUT sync' do
let(:request){ put :sync, id: line_referential.id }
- it 'should redirect to 403' do
- expect(request).to redirect_to "/403"
+ it 'should respond with 403' do
+ expect(request).to have_http_status 403
end
with_permission "line_referentials.synchronize" do
diff --git a/spec/controllers/lines_controller_spec.rb b/spec/controllers/lines_controller_spec.rb
index 65fe88b96..96f49bb36 100644
--- a/spec/controllers/lines_controller_spec.rb
+++ b/spec/controllers/lines_controller_spec.rb
@@ -7,8 +7,8 @@ RSpec.describe LinesController, :type => :controller do
describe 'PUT deactivate' do
let(:request){ put :deactivate, id: line.id, line_referential_id: line_referential.id }
- it 'should redirect to 403' do
- expect(request).to redirect_to "/403"
+ it 'should respond with 403' do
+ expect(request).to have_http_status 403
end
with_permission "lines.change_status" do
@@ -24,8 +24,8 @@ RSpec.describe LinesController, :type => :controller do
before(:each){
line.deactivate!
}
- it 'should redirect to 403' do
- expect(request).to redirect_to "/403"
+ it 'should respond with 403' do
+ expect(request).to have_http_status 403
end
with_permission "lines.change_status" do
diff --git a/spec/controllers/referentials_controller_spec.rb b/spec/controllers/referentials_controller_spec.rb
index 5e0b1e505..ff450c905 100644
--- a/spec/controllers/referentials_controller_spec.rb
+++ b/spec/controllers/referentials_controller_spec.rb
@@ -6,6 +6,42 @@ describe ReferentialsController, :type => :controller do
let(:organisation) { create :organisation }
let(:other_referential) { create :referential, organisation: organisation }
+ describe "GET new" do
+ let(:request){ get :new, workbench_id: referential.workbench_id }
+ before{ request }
+
+ it 'returns http success' do
+ expect(response).to have_http_status(200)
+ end
+
+ context "when cloning another referential" do
+ let(:source){ referential }
+ let(:request){ get :new, workbench_id: referential.workbench_id, from: source.id }
+
+ it 'returns http success' do
+ expect(response).to have_http_status(200)
+ end
+
+ context "when the referential is in another organisation but accessible by the user" do
+ let(:source){ create(:workbench_referential) }
+ before do
+ source.workbench.update_attribute :workgroup_id, referential.workbench.workgroup_id
+ end
+
+ it 'returns http forbidden' do
+ expect(response).to have_http_status(403)
+ end
+ end
+
+ context "when the referential is not accessible by the user" do
+ let(:source){ create(:workbench_referential) }
+ it 'returns http forbidden' do
+ expect(response).to have_http_status(403)
+ end
+ end
+ end
+ end
+
describe 'PUT archive' do
context "user's organisation matches referential's organisation" do
it 'returns http success' do
diff --git a/spec/controllers/stop_area_referentials_controller_spec.rb b/spec/controllers/stop_area_referentials_controller_spec.rb
index 384323334..737ef631f 100644
--- a/spec/controllers/stop_area_referentials_controller_spec.rb
+++ b/spec/controllers/stop_area_referentials_controller_spec.rb
@@ -6,7 +6,9 @@ RSpec.describe StopAreaReferentialsController, :type => :controller do
describe 'PUT sync' do
let(:request){ put :sync, id: stop_area_referential.id }
- it { expect(request).to redirect_to "/403" }
+ it 'should respond with 403' do
+ expect(request).to have_http_status 403
+ end
with_permission "stop_area_referentials.synchronize" do
it 'returns HTTP success' do
diff --git a/spec/controllers/stop_areas_controller_spec.rb b/spec/controllers/stop_areas_controller_spec.rb
index 23bca3c36..f39ac5776 100644
--- a/spec/controllers/stop_areas_controller_spec.rb
+++ b/spec/controllers/stop_areas_controller_spec.rb
@@ -7,8 +7,8 @@ RSpec.describe StopAreasController, :type => :controller do
describe 'PUT deactivate' do
let(:request){ put :deactivate, id: stop_area.id, stop_area_referential_id: stop_area_referential.id }
- it 'should redirect to 403' do
- expect(request).to redirect_to "/403"
+ it 'should respond with 403' do
+ expect(request).to have_http_status 403
end
with_permission "stop_areas.change_status" do
@@ -24,8 +24,8 @@ RSpec.describe StopAreasController, :type => :controller do
before(:each){
stop_area.deactivate!
}
- it 'should redirect to 403' do
- expect(request).to redirect_to "/403"
+ it 'should respond with 403' do
+ expect(request).to have_http_status 403
end
with_permission "stop_areas.change_status" do
diff --git a/spec/models/referential_spec.rb b/spec/models/referential_spec.rb
index 025ad80f9..1d9b3d78a 100644
--- a/spec/models/referential_spec.rb
+++ b/spec/models/referential_spec.rb
@@ -58,16 +58,21 @@ describe Referential, :type => :model do
Referential.new_from(ref, [])
end
- # let(:saved_clone) do
- # clone.tap do |clone|
- # clone.organisation = ref.organisation
- # clone.metadatas.each do |metadata|
- # metadata.line_ids = ref.lines.where(id: clone.line_ids, objectid: JSON.parse(ref.organisation.sso_attributes["functional_scope"]).collect(&:id)
- # metadata.periodes = metadata.periodes.map { |period| Range.new(period.end+1, period.end+10) }
- # end
- # clone.save!
- # end
- # end
+ let!(:workbench){ create :workbench }
+
+ let(:saved_clone) do
+ clone.tap do |clone|
+ clone.organisation = workbench.organisation
+ clone.workbench = workbench
+ clone.metadatas = [create(:referential_metadata, referential: clone)]
+ clone.save!
+ end
+ end
+
+ it 'should create a Referential' do
+ ref
+ expect { saved_clone }.to change{Referential.count}.by(1)
+ end
xit 'should create a ReferentialCloning' do
expect { saved_clone }.to change{ReferentialCloning.count}.by(1)
diff --git a/spec/views/referentials/show.html.erb_spec.rb b/spec/views/referentials/show.html.erb_spec.rb
index a7f37d180..82328cb8e 100644
--- a/spec/views/referentials/show.html.erb_spec.rb
+++ b/spec/views/referentials/show.html.erb_spec.rb
@@ -11,6 +11,7 @@ describe "referentials/show", type: :view do
let(:organisation){ referential.try(:organisation) }
let(:permissions){ [] }
let(:current_organisation) { organisation }
+ let(:organisation) { referential.organisation }
let(:readonly){ false }
before :each do
generated by cgit v1.2.3 (git 2.25.1) at 2025-11-01 16:01:19 +0000