diff --git a/app/controllers/messages/boosts/by_bots_controller.rb b/app/controllers/messages/boosts/by_bots_controller.rb index 10ee80a..798020a 100644 --- a/app/controllers/messages/boosts/by_bots_controller.rb +++ b/app/controllers/messages/boosts/by_bots_controller.rb @@ -1,9 +1,9 @@ class Messages::Boosts::ByBotsController < Messages::BoostsController include RawRequestBody - allow_bot_access only: :create + allow_bot_access only: %i[ create destroy ] - before_action :ensure_content_present + before_action :ensure_content_present, only: :create def create @boost = @message.boosts.create!(boost_params) @@ -21,6 +21,12 @@ class Messages::Boosts::ByBotsController < Messages::BoostsController head :not_found unless @message end + def set_boost + super + rescue ActiveRecord::RecordNotFound + head :not_found + end + def ensure_content_present if raw_request_body.blank? head :unprocessable_content diff --git a/app/controllers/messages/boosts_controller.rb b/app/controllers/messages/boosts_controller.rb index 5cd8d5c..adbd5ef 100644 --- a/app/controllers/messages/boosts_controller.rb +++ b/app/controllers/messages/boosts_controller.rb @@ -1,5 +1,6 @@ class Messages::BoostsController < ApplicationController before_action :set_message + before_action :set_boost, only: :destroy def index end @@ -15,7 +16,6 @@ class Messages::BoostsController < ApplicationController end def destroy - @boost = Current.user.boosts.find(params[:id]) @boost.destroy! broadcast_remove @@ -26,6 +26,10 @@ class Messages::BoostsController < ApplicationController @message = Current.user.reachable_messages.find(params[:message_id]) end + def set_boost + @boost = @message.boosts.find_by!(id: params[:id], booster: Current.user) + end + def boost_params params.require(:boost).permit(:content) end diff --git a/config/routes.rb b/config/routes.rb index da01b4f..cb9dd1a 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -65,7 +65,7 @@ Rails.application.routes.draw do nested do scope path: ":bot_key", as: :bot, defaults: { format: :json } do resources :messages, controller: "messages/by_bots", only: %i[ index create update destroy ] do - resources :boosts, controller: "messages/boosts/by_bots", only: :create + resources :boosts, controller: "messages/boosts/by_bots", only: %i[ create destroy ] end end end diff --git a/test/controllers/messages/boosts/by_bots_controller_test.rb b/test/controllers/messages/boosts/by_bots_controller_test.rb index a2487e5..c7a6d26 100644 --- a/test/controllers/messages/boosts/by_bots_controller_test.rb +++ b/test/controllers/messages/boosts/by_bots_controller_test.rb @@ -79,4 +79,34 @@ class Messages::Boosts::ByBotsControllerTest < ActionDispatch::IntegrationTest end assert_response :redirect end + + test "destroy removes the bot's own boost" do + assert_difference -> { Boost.count }, -1 do + delete room_bot_message_boost_url(@room, @bot.bot_key, @message, boosts(:fourth_by_bender)) + end + + assert_response :no_content + end + + test "destroy broadcasts the removal" do + assert_turbo_stream_broadcasts [ @message.room, :messages ], count: 1 do + delete room_bot_message_boost_url(@room, @bot.bot_key, @message, boosts(:fourth_by_bender)) + end + end + + test "destroy can't touch a boost the bot did not make" do + assert_no_difference -> { Boost.count } do + delete room_bot_message_boost_url(@room, @bot.bot_key, messages(:thirteenth), boosts(:thirteenth)) + end + + assert_response :not_found + end + + test "destroy requires a valid bot key" do + assert_no_difference -> { Boost.count } do + delete room_bot_message_boost_url(@room, "invalid-bot-key", @message, boosts(:fourth_by_bender)) + end + + assert_response :redirect + end end diff --git a/test/fixtures/boosts.yml b/test/fixtures/boosts.yml index 9c2349c..48e42c2 100644 --- a/test/fixtures/boosts.yml +++ b/test/fixtures/boosts.yml @@ -6,3 +6,7 @@ thirteenth: message: thirteenth booster: jason content: 💯 +fourth_by_bender: + message: fourth + booster: bender + content: 👀