Add a test demonstrating requests sent as two users

Author: sgrif

src/tests/helpers/app.rs

@@ -1,5 +1,5 @@
 use super::request::RequestBuilder;
-use cargo_registry::models::{ApiToken, NewUser, User};
+use cargo_registry::models::{ApiToken, Email, NewUser, User};
 use cargo_registry::util::CargoResult;
 use conduit::Method;
 use conduit_middleware::MiddlewareBuilder;
@@ -9,12 +9,17 @@ use std::sync::Arc;
 pub struct App {
     app: Arc<cargo_registry::App>,
     middleware: MiddlewareBuilder,
+    _bomb: crate::record::Bomb,
 }
 
 impl App {
     pub fn new() -> Self {
-        let (app, middleware) = crate::simple_app(None);
-        Self { app, middleware }
+        let (bomb, app, middleware) = crate::app();
+        Self {
+            app,
+            middleware,
+            _bomb: bomb,
+        }
     }
 
     /// Obtain the database connection and pass it to the closure
@@ -33,12 +38,18 @@ impl App {
 
     /// Create a new user in the database with the given id
     pub fn create_user(&self, username: &str) -> CargoResult<User> {
+        use cargo_registry::schema::emails;
+
         self.db(|conn| {
             let new_user = NewUser {
                 email: Some("[email protected]"),
                 ..crate::new_user(username)
             };
-            Ok(new_user.create_or_update(conn)?)
+            let user = new_user.create_or_update(conn)?;
+            diesel::update(Email::belonging_to(&user))
+                .set(emails::verified.eq(true))
+                .execute(conn)?;
+            Ok(user)
         })
     }
 
@@ -58,6 +69,11 @@ impl App {
         RequestBuilder::new(&self.middleware, Method::Get, path)
     }
 
+    /// Create an HTTP `PUT` request
+    pub fn put(&self, path: &str) -> RequestBuilder<'_> {
+        RequestBuilder::new(&self.middleware, Method::Put, path)
+    }
+
     /// Create an HTTP `DELETE` request
     pub fn delete(&self, path: &str) -> RequestBuilder<'_> {
         RequestBuilder::new(&self.middleware, Method::Delete, path)

src/tests/helpers/request.rs

@@ -1,6 +1,6 @@
 use super::response::{Response, ResponseError};
-use cargo_registry::models::ApiToken;
-use conduit::{Handler, Method};
+use cargo_registry::models::{ApiToken, User};
+use conduit::{Handler, Method, Request};
 use conduit_middleware::MiddlewareBuilder;
 use conduit_test::MockRequest;
 
@@ -18,6 +18,16 @@ impl<'a> RequestBuilder<'a> {
         .with_header("User-Agent", "conduit-test")
     }
 
+    /// Sends the request signed in as the given user
+    pub fn as_user(mut self, user: &User) -> Self {
+        use cargo_registry::middleware::current_user::AuthenticationSource;
+        self.request.mut_extensions().insert(user.clone());
+        self.request
+            .mut_extensions()
+            .insert(AuthenticationSource::SessionCookie);
+        self
+    }
+
     /// Uses the given token for authentication
     pub fn with_token(self, token: &ApiToken) -> Self {
         self.with_header("Authorization", &token.token)
@@ -28,6 +38,11 @@ impl<'a> RequestBuilder<'a> {
         self
     }
 
+    pub fn with_body<T: Into<Vec<u8>>>(mut self, body: T) -> Self {
+        self.request.with_body(&body.into());
+        self
+    }
+
     /// Send the request
     ///
     /// Returns an error if any of the middlewares returned an error, or if

src/tests/helpers/response.rs

@@ -33,6 +33,13 @@ impl Response {
     pub fn text(&self) -> &str {
         &self.body
     }
+
+    pub fn json<'a, T>(&'a self) -> CargoResult<T>
+    where
+        T: serde::Deserialize<'a>,
+    {
+        serde_json::from_str(self.text()).map_err(Into::into)
+    }
 }
 
 pub enum ResponseError {
@@ -52,8 +59,8 @@ impl fmt::Debug for ResponseError {
         use ResponseError::*;
         match self {
             MiddlewareError(e) => write!(f, "MiddlewareError({:?})", e),
-            BadRequest(_) => write!(f, "BadRequest(_)"),
-            ServerError(_) => write!(f, "ServerError(_)"),
+            BadRequest(e) => write!(f, "BadRequest({:?})", e.text()),
+            ServerError(e) => write!(f, "ServerError({:?})", e.text()),
         }
     }
 }

src/tests/http-data/krate_only_owners_can_yank

@@ -0,0 +1,73 @@
+[
+  {
+    "request": {
+      "uri": "http://alexcrichton-test.s3.amazonaws.com/crates/foo_not/foo_not-1.0.0.crate",
+      "method": "PUT",
+      "headers": [
+        [
+          "host",
+          "alexcrichton-test.s3.amazonaws.com"
+        ],
+        [
+          "date",
+          "Fri, 15 Sep 2017 07:53:06 -0700"
+        ],
+        [
+          "accept",
+          "*/*"
+        ],
+        [
+          "user-agent",
+          "reqwest/0.9.1"
+        ],
+        [
+          "authorization",
+          "AWS AKIAICL5IWUZYWWKA7JA:xCp3sUdUdmScjI6ct58zFv6BoGQ="
+        ],
+        [
+          "content-length",
+          "35"
+        ],
+        [
+          "accept-encoding",
+          "gzip"
+        ],
+        [
+          "content-type",
+          "application/x-tar"
+        ]
+      ],
+      "body": "H4sIAAAAAAAA/+3AAQEAAACCIP+vbkhQwKsBLq+17wAEAAA="
+    },
+    "response": {
+      "status": 200,
+      "headers": [
+        [
+          "ETag",
+          "\"f9016ad360cebb4fe2e6e96e5949f022\""
+        ],
+        [
+          "x-amz-id-2",
+          "FCKNKZUo5EeUNwVyhZ9P7ehfXoctqePzXx2RSE1VxoSX9rdfskkyAJUNHAF2AQojRon00LfTLPY="
+        ],
+        [
+          "x-amz-request-id",
+          "3233F8227A852593"
+        ],
+        [
+          "Server",
+          "AmazonS3"
+        ],
+        [
+          "content-length",
+          "0"
+        ],
+        [
+          "date",
+          "Fri, 15 Sep 2017 14:53:07 GMT"
+        ]
+      ],
+      "body": ""
+    }
+  }
+]

src/tests/krate.rs

@@ -1,3 +1,4 @@
+use crate::prelude::*;
 use crate::{
     builders::{CrateBuilder, DependencyBuilder, PublishBuilder, VersionBuilder},
     new_category, new_dependency, new_user, CrateMeta, CrateResponse, GoodCrate, OkBool,
@@ -75,6 +76,16 @@ impl crate::util::MockTokenUser {
     }
 }
 
+fn yank_request<'a>(app: &'a App, krate_name: &str, version: &str) -> RequestBuilder<'a> {
+    let url = format!("/api/v1/crates/{}/{}/yank", krate_name, version);
+    app.delete(&url)
+}
+
+fn publish_request<'a>(app: &'a App, publish_builder: PublishBuilder) -> RequestBuilder<'a> {
+    app.put("/api/v1/crates/new")
+        .with_body(publish_builder.body())
+}
+
 #[test]
 fn index() {
     let (app, anon) = TestApp::init().empty();
@@ -1403,19 +1414,31 @@ fn yank() {
 }
 
 #[test]
-fn yank_not_owner() {
-    let (app, _, _, token) = TestApp::init().with_token();
-    let another_user = app.db_new_user("bar");
-    let another_user = another_user.as_model();
-    app.db(|conn| {
-        CrateBuilder::new("foo_not", another_user.id).expect_build(conn);
-    });
+fn only_owners_can_yank() -> CargoResult<()> {
+    let app = App::new();
+    let owner = app.create_user("owner")?;
+
+    let crate_to_publish = PublishBuilder::new("foo_not");
+    publish_request(&app, crate_to_publish)
+        .as_user(&owner)
+        .send()?;
 
-    let json = token.yank("foo_not", "1.0.0").bad_with_status(200);
+    let user_yank_result = yank_request(&app, "foo_not", "1.0.0")
+        .as_user(&app.create_user("new_user")?)
+        .send()? // FIXME: We should return 403 here not 200
+        .json::<ErrorDetails>()?;
     assert_eq!(
-        json.errors[0].detail,
-        "crate `foo_not` does not have a version `1.0.0`"
+        user_yank_result.errors[0].detail,
+        "must already be an owner to yank or unyank",
     );
+
+    let owner_yank_result = yank_request(&app, "foo_not", "1.0.0")
+        .as_user(&owner)
+        .send()?
+        .json::<OkBool>()?;
+    assert!(owner_yank_result.ok);
+
+    Ok(())
 }
 
 #[test]

src/tests/prelude.rs

@@ -1,3 +1,5 @@
 pub use crate::helpers::app::*;
+pub use crate::helpers::request::RequestBuilder;
 pub use crate::helpers::response::ResultExt as _;
+pub use crate::util::Bad as ErrorDetails;
 pub use cargo_registry::util::CargoResult;

src/tests/util.rs

@@ -332,7 +332,7 @@ pub struct Error {
     pub detail: String,
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Debug)]
 pub struct Bad {
     pub errors: Vec<Error>,
 }