mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-13 02:20:42 +09:00
Jeremy Daer
5c5c82b27a
Rooms::DirectsController relaxes ensure_can_administer to true, because every participant in a direct room may administer it. set_room was inherited unscoped, though, so that relaxation applied to any room the caller was merely a member of: DELETE /rooms/directs/<id> destroyed open and closed rooms and all their messages. The same unscoped lookup let a direct room be loaded by the opens and closeds controllers, where force_room_type promoted it. Promoting a DM to open grants every user on the account membership and republishes the whole conversation, including the other participant's messages; converting it to closed lets the initiator revise who is in it and lock the other participant out. Each controller now narrows room_scope to the types it may act on. Opens and closeds keep reach into each other, since converting between them is a feature. Neither can reach a direct room, and directs can only reach directs. Room also refuses to change type away from Rooms::Direct, so the invariant holds for any future caller of becomes! rather than only these two controllers.
63 lines
1.5 KiB
Ruby
63 lines
1.5 KiB
Ruby
require "test_helper"
|
|
|
|
class Rooms::DirectsControllerTest < ActionDispatch::IntegrationTest
|
|
setup do
|
|
sign_in :david
|
|
end
|
|
|
|
test "create" do
|
|
post rooms_directs_url, params: { user_ids: [ users(:jz).id ] }
|
|
|
|
room = Room.last
|
|
assert_redirected_to room_url(room)
|
|
assert room.users.include?(users(:david))
|
|
assert room.users.include?(users(:jz))
|
|
end
|
|
|
|
test "create only once per user set" do
|
|
assert_difference -> { Room.all.count }, +1 do
|
|
post rooms_directs_url, params: { user_ids: [ users(:jz).id ] }
|
|
post rooms_directs_url, params: { user_ids: [ users(:jz).id ] }
|
|
end
|
|
end
|
|
|
|
test "destroy only allowed for all room users" do
|
|
sign_in :kevin
|
|
|
|
assert_difference -> { Room.count }, -1 do
|
|
delete rooms_direct_url(rooms(:david_and_kevin))
|
|
assert_redirected_to root_url
|
|
end
|
|
end
|
|
|
|
test "destroy can't reach a closed room the member didn't create" do
|
|
sign_in :kevin
|
|
|
|
assert_no_difference -> { Room.count } do
|
|
delete rooms_direct_url(rooms(:designers))
|
|
end
|
|
|
|
assert rooms(:designers).reload.persisted?
|
|
end
|
|
|
|
test "destroy can't reach an open room the member didn't create" do
|
|
sign_in :kevin
|
|
|
|
assert_no_difference -> { Room.count } do
|
|
delete rooms_direct_url(rooms(:hq))
|
|
end
|
|
|
|
assert rooms(:hq).reload.persisted?
|
|
end
|
|
|
|
test "destroy can't reach a room the member isn't in at all" do
|
|
sign_in :jz
|
|
|
|
assert_no_difference -> { Room.count } do
|
|
delete rooms_direct_url(rooms(:david_and_kevin))
|
|
end
|
|
|
|
assert rooms(:david_and_kevin).reload.persisted?
|
|
end
|
|
end
|