Fix #4637 - Re-add missing doorkeeper_authorize for /api/v1/verify_credentials (#4650)

This commit is contained in:
Eugen Rochko 2017-08-21 00:41:08 +02:00 committed by GitHub
parent 110227ac5e
commit 74e5078795
2 changed files with 61 additions and 38 deletions

View File

@ -1,6 +1,7 @@
# frozen_string_literal: true # frozen_string_literal: true
class Api::V1::Accounts::CredentialsController < Api::BaseController class Api::V1::Accounts::CredentialsController < Api::BaseController
before_action -> { doorkeeper_authorize! :read }, except: [:update]
before_action -> { doorkeeper_authorize! :write }, only: [:update] before_action -> { doorkeeper_authorize! :write }, only: [:update]
before_action :require_user! before_action :require_user!

View File

@ -4,8 +4,9 @@ describe Api::V1::Accounts::CredentialsController do
render_views render_views
let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) } let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write') } let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read write') }
context 'with an oauth token' do
before do before do
allow(controller).to receive(:doorkeeper_token) { token } allow(controller).to receive(:doorkeeper_token) { token }
end end
@ -59,3 +60,24 @@ describe Api::V1::Accounts::CredentialsController do
end end
end end
end end
context 'without an oauth token' do
before do
allow(controller).to receive(:doorkeeper_token) { nil }
end
describe 'GET #show' do
it 'returns http unauthorized' do
get :show
expect(response).to have_http_status(:unauthorized)
end
end
describe 'PATCH #update' do
it 'returns http unauthorized' do
patch :update, params: { note: 'Foo' }
expect(response).to have_http_status(:unauthorized)
end
end
end
end