jam-cloud/spec/requests/users_api_spec.rb

require 'spec_helper'

describe "User API", :type => :api do

  include Rack::Test::Methods

  subject { page }

  describe "profile" do
    let(:user) { FactoryGirl.create(:user) }
    let(:fan) { FactoryGirl.create(:fan) }
    let(:band) { FactoryGirl.create(:band) }

    before(:each) do
      UserMailer.deliveries.clear
    end

    def login(email, password, http_code, success)
      # login as fan
      post '/api/auth_session.json', { :email => email, :password => password }.to_json, "CONTENT_TYPE" => 'application/json'
      last_response.status.should == http_code
      JSON.parse(last_response.body).should == { "success" => success }
    end

    ########################## FOLLOWINGS / FOLLOWERS #########################
    def create_user_following(authenticated_user, source_user, target_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      post "/api/users/#{source_user.id}/followings.json", { :user_id => target_user.id }.to_json, "CONTENT_TYPE" => 'application/json'
      return last_response
    end

    def get_user_followings(authenticated_user, source_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/users/#{source_user.id}/followings.json"
      return last_response
    end

    def get_user_followers(authenticated_user, source_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/users/#{source_user.id}/followers.json"
      return last_response
    end

    def delete_user_following(authenticated_user, source_user, target_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      delete "/api/users/#{source_user.id}/followings/#{target_user.id}.json"
      return last_response
    end

    def create_band_following(authenticated_user, source_user, target_band)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      post "/api/users/#{source_user.id}/followings.json", { :band_id => target_band.id }.to_json, "CONTENT_TYPE" => 'application/json'
      return last_response
    end

    def get_band_followings(authenticated_user, source_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/users/#{source_user.id}/band_followings.json"
      return last_response
    end

    def get_band_followers(authenticated_user, source_band)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/bands/#{source_band.id}/followers.json"
      return last_response
    end

    ########################## RECORDINGS #########################
    def create_user_recording(authenticated_user, source_user, description, public)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      post "/api/users/#{source_user.id}/recordings.json", { :description => description, :public => public }.to_json, "CONTENT_TYPE" => 'application/json'
      return last_response
    end

    def update_user_recording(authenticated_user, source_user, recording_id, description, public)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      post "/api/users/#{source_user.id}/recordings/#{recording_id}.json", { :description => description, :public => public }.to_json, "CONTENT_TYPE" => 'application/json'
      return last_response
    end

    def get_user_recordings(authenticated_user, source_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/users/#{source_user.id}/recordings.json"
      return last_response
    end

    def get_user_recording(authenticated_user, source_user, recording_id)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/users/#{source_user.id}/recordings/#{recording_id}.json"
      return last_response
    end

    def delete_user_recording(authenticated_user, source_user, recording_id)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      delete "/api/users/#{source_user.id}/recordings/#{recording_id}.json"
      return last_response
    end

    ########################## FAVORITES #########################
    def create_favorite(authenticated_user, source_user, recording_id)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      post "/api/users/#{source_user.id}/favorites.json", { :recording_id => recording_id }.to_json, "CONTENT_TYPE" => 'application/json'
      return last_response
    end

    def get_favorites(authenticated_user, source_user)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      get "/api/users/#{source_user.id}/favorites.json"
      return last_response
    end

    def delete_favorite(authenticated_user, source_user, recording_id)
      login(authenticated_user.email, authenticated_user.password, 200, true)
      delete "/api/users/#{source_user.id}/favorites/#{recording_id}.json"
    end

    context "when accessing as unauthenticated user" do

      it "should allow successful login" do
        # can't access most apis; not logged in yet!'
        get '/api/users.json',  "CONTENT_TYPE" => 'application/json'
        last_response.status.should == 403

        # login
        login(user.email, user.password, 200, true)

        # can now login
        get '/api/users.json',  "CONTENT_TYPE" => 'application/json'
        last_response.status.should == 200

        # log back out
        delete '/api/auth_session.json',  "CONTENT_TYPE" => 'application/json'

        # can't access most apis; not logged in yet!'
        get '/api/users.json',  "CONTENT_TYPE" => 'application/json'
        last_response.status.should == 403

      end

      it "should deny bad login" do
        # login
        login("nothing", "mur", 404, false)

        # can't access most apis; not logged in yet!'
        get '/api/users.json',  "CONTENT_TYPE" => 'application/json'
        last_response.status.should == 403
      end
    end

    context "when accessing as authenticated user" do
      # log in a valid user
      it "should allow user updates" do

        # login as fan
        login(fan.email, fan.password, 200, true)

        # update the user's first name and musician flag
        post "/api/users/#{fan.id}.json", { :first_name => "Brian", :musician => true }.to_json, "CONTENT_TYPE" => 'application/json'
        last_response.status.should == 200

        # login as fan (credentials are not saved between API calls)
        login(fan.email, fan.password, 200, true)

        # get the user's details
        get "/api/users/#{fan.id}.json", "CONTENT_TYPE" => 'application/json'
        last_response.status.should == 200
        updated_user = JSON.parse(last_response.body)
        updated_user["musician"].should == true
        updated_user["first_name"].should == "Brian"
      end

      it "should allow user to follow user" do
        # create user following
        last_response = create_user_following(user, user, fan)
        last_response.status.should == 201

        # get followings
        last_response = get_user_followings(user, user)
        last_response.status.should == 200
        followings = JSON.parse(last_response.body)
        followings.size.should == 1
        followings[0]["user_id"].should == fan.id

        # get followers for other side of above following (fan)
        last_response = get_user_followers(fan, fan)
        last_response.status.should == 200
        followers = JSON.parse(last_response.body)
        followers.size.should == 1
        followers[0]["user_id"].should == user.id
      end

      it "should allow user to follow band" do
        # create band following
        last_response = create_band_following(user, user, band)
        last_response.status.should == 201

        # get band followings
        last_response = get_band_followings(user, user)
        last_response.status.should == 200
        followings = JSON.parse(last_response.body)
        followings.size.should == 1
        followings[0]["band_id"].should == band.id

        # get followers for band
        last_response = get_band_followers(user, band)
        last_response.status.should == 200
        followers = JSON.parse(last_response.body)
        followers.size.should == 1
        followers[0]["user_id"].should == user.id
      end

      it "should not allow user to create following for another user" do
        dummy_user = FactoryGirl.create(:user)
        last_response = create_user_following(user, dummy_user, fan)
        last_response.status.should == 403
      end

      it "should allow user to delete following" do
        last_response = create_user_following(user, user, fan)
        last_response.status.should == 201

        # get followings
        last_response = get_user_followings(user, user)
        last_response.status.should == 200
        followings = JSON.parse(last_response.body)
        followings.size.should == 1
        followings[0]["user_id"].should == fan.id

        # delete following
        last_response = delete_user_following(user, user, fan)
        last_response.status.should == 204

        # get followings
        last_response = get_user_followings(user, user)
        last_response.status.should == 200
        followings = JSON.parse(last_response.body)
        followings.size.should == 0
      end

      it "should not allow user to delete following of another user" do
        # create user following
        last_response = create_user_following(user, user, fan)
        last_response.status.should == 201

        # get followings
        last_response = get_user_followings(user, user)
        last_response.status.should == 200
        followings = JSON.parse(last_response.body)
        followings.size.should == 1
        followings[0]["user_id"].should == fan.id

        # attempt to delete following of another user
        last_response = delete_user_following(fan, user, fan)
        last_response.status.should == 403

        # get followings
        last_response = get_user_followings(user, user)
        last_response.status.should == 200
        followings = JSON.parse(last_response.body)
        followings.size.should == 1
      end

      it "should allow musician to create recordings" do
        # create public recording
        public_description = "My Public Recording"
        last_response = create_user_recording(user, user, public_description, true)
        last_response.status.should == 201
        recording = JSON.parse(last_response.body)
        recording["description"].should == public_description
        recording["public"].should == true

        # create private recording
        private_description = "My Private Recording"
        last_response = create_user_recording(user, user, private_description, false)
        last_response.status.should == 201
        private_recording = JSON.parse(last_response.body)
        private_recording["description"].should == private_description
        private_recording["public"].should == false

        # update the second recording's description and public flag
        last_response = update_user_recording(user, user, private_recording["id"], "My Recording 3", true)
        last_response.status.should == 200
        recording = JSON.parse(last_response.body)
        recording["description"].should == "My Recording 3"
        recording["public"].should == true

        # retrieve the recording details again to ensure the change took effect
        last_response = get_user_recording(user, user, recording["id"])
        last_response.status.should == 200
        recording = JSON.parse(last_response.body)
        recording["description"].should == "My Recording 3"
        recording["public"].should == true
      end

      it "should not allow fan to create recordings" do
        last_response = create_user_recording(fan, fan, "Fan Recording", true)
        last_response.status.should == 403
      end

      it "should allow creator to see public and private recordings in list" do
        # create public recording
        public_description = "My Public Recording"
        last_response = create_user_recording(user, user, public_description, true)
        last_response.status.should == 201

         # create private recording
        private_description = "My Private Recording"
        last_response = create_user_recording(user, user, private_description, false)
        last_response.status.should == 201

        # get all recordings as creator
        last_response = get_user_recordings(user, user)
        recordings = JSON.parse(last_response.body)
        recordings.size.should == 2
      end

      it "should allow creator to see private recording details" do
        # create private recording
        private_description = "My Private Recording"
        last_response = create_user_recording(user, user, private_description, false)
        last_response.status.should == 201
        private_recording = JSON.parse(last_response.body)
        private_recording["description"].should == private_description
        private_recording["public"].should == false

        # attempt to get the private recording as non-creator
        last_response = get_user_recording(user, user, private_recording["id"])
        last_response.status.should == 200
      end

      it "should not allow non-creator to see private recordings in list" do
        # create public recording
        public_description = "My Public Recording"
        last_response = create_user_recording(user, user, public_description, true)
        last_response.status.should == 201

         # create private recording
        private_description = "My Private Recording"
        last_response = create_user_recording(user, user, private_description, false)
        last_response.status.should == 201

        # get all recordings as non-creator
        last_response = get_user_recordings(fan, user)
        last_response.status.should == 200

        recordings = JSON.parse(last_response.body)
        recordings.size.should == 1
        recordings[0]["description"].should == public_description
        recordings[0]["public"].should == true
      end

      it "should not allow non-creator to see private recording details" do
        # create private recording
        private_description = "My Private Recording"
        last_response = create_user_recording(user, user, private_description, false)
        last_response.status.should == 201
        private_recording = JSON.parse(last_response.body)
        private_recording["description"].should == private_description
        private_recording["public"].should == false

        # attempt to get the private recording as non-creator
        last_response = get_user_recording(fan, user, private_recording["id"])
        last_response.status.should == 403
      end

      it "should allow user to create favorites" do
        # create recording first
        last_response = create_user_recording(user, user, "My Recording", true)
        last_response.status.should == 201
        recording = JSON.parse(last_response.body)

        # add favorite
        last_response = create_favorite(fan, fan, recording["id"])
        last_response.status.should == 201

        # get favorites
        last_response = get_favorites(fan, fan)
        last_response.status.should == 200
        favorites = JSON.parse(last_response.body)
        favorites.size.should == 1
        favorites[0]["recording_id"].should == recording["id"]
        favorites[0]["description"].should == "My Recording"
        favorites[0]["public"].should == true
      end

      it "should not allow user to create favorite for another user" do
        # create recording first
        last_response = create_user_recording(user, user, "My Recording", true)
        last_response.status.should == 201
        recording = JSON.parse(last_response.body)

        # attempt to add favorite for another user
        last_response = create_favorite(fan, user, recording["id"])
        last_response.status.should == 403    
      end

      it "should allow user to delete favorites" do
        # create recording first
        last_response = create_user_recording(user, user, "My Recording", true)
        last_response.status.should == 201
        recording = JSON.parse(last_response.body)

        # delete favorite
        last_response = delete_favorite(user, user, recording["id"])
        last_response.status.should == 204

        # get favorites
        last_response = get_favorites(user, user)
        last_response.status.should == 200
        favorites = JSON.parse(last_response.body)
        favorites.size.should == 0
      end

      it "should not allow user to delete another user's favorites" do
        # create recording first
        last_response = create_user_recording(user, user, "My Recording", true)
        last_response.status.should == 201
        recording = JSON.parse(last_response.body)

        # attempt to delete favorite as non-creator
        last_response = delete_favorite(fan, user, recording["id"])
        last_response.status.should == 403
      end

      it "should allow user to send friend request" do
      end

      it "should allow user to accept friend request" do
      end

      it "should allow user to deny friend request" do
      end
    end
  end
end