Staff user page for generating an access token.

Adds a link from /my to a page for generating an access token which is
then stored in the user's extra field.

1 files changed, 93 insertions, 0 deletions

diff --git a/t/app/controller/auth_profile.t b/t/app/controller/auth_profile.t
index 519086ff5..74edccfe6 100644
--- a/t/app/controller/auth_profile.t
+++ b/t/app/controller/auth_profile.t
@@ -260,3 +260,96 @@ subtest "Test change phone to existing account" => sub {
         is $_->user->email, $test_email;
     }
 };
+
+subtest "Test superuser can access generate token page" => sub {
+    my $user = FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
+    ok $user->update({ is_superuser => 0 }), 'user not superuser';
+
+    $mech->log_out_ok;
+    $mech->get_ok('/auth');
+    $mech->submit_form_ok({
+        with_fields => {
+            username => $test_email,
+            password_sign_in => $test_password,
+        },
+    });
+
+    $mech->content_lacks('Generate token');
+
+    $mech->get('/auth/generate_token');
+    is $mech->res->code, 403, "access denied";
+
+    ok $user->update({ is_superuser => 1 }), 'user is superuser';
+
+    $mech->get_ok('/my');
+    $mech->content_contains('Generate token');
+    $mech->get_ok('/auth/generate_token');
+};
+
+subtest "Test staff user can access generate token page" => sub {
+    my $user = FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
+    ok $user->update({ is_superuser => 0 }), 'user not superuser';
+
+    $mech->log_out_ok;
+    $mech->get_ok('/auth');
+    $mech->submit_form_ok({
+        with_fields => {
+            username => $test_email,
+            password_sign_in => $test_password,
+        },
+    });
+
+    $mech->content_lacks('Generate token');
+
+    my $body = $mech->create_body_ok(2237, 'Oxfordshire');
+
+    $mech->get('/auth/generate_token');
+    is $mech->res->code, 403, "access denied";
+
+    ok $user->update({ from_body => $body }), 'user is staff user';
+
+    $mech->get_ok('/my');
+    $mech->content_contains('Generate token');
+    $mech->get_ok('/auth/generate_token');
+};
+
+subtest "Test generate token page" => sub {
+    my $user = FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
+    ok $user->update({ is_superuser => 1 }), 'user set to superuser';
+
+    $mech->log_out_ok;
+
+    $mech->get_ok('/auth');
+    $mech->submit_form_ok({
+        with_fields => {
+            username => $test_email,
+            password_sign_in => $test_password,
+        },
+    });
+
+    ok !$user->get_extra_metadata('access_token');
+
+    $mech->get_ok('/my');
+    $mech->follow_link_ok({url => '/auth/generate_token'});
+    $mech->content_lacks('Token:');
+    $mech->submit_form_ok(
+        { with_fields => { generate_token => 'Generate token' } },
+        "submit generate token form"
+    );
+    $mech->content_contains( 'Your token has been generated', "token generated" );
+
+    $user->discard_changes();
+    my $token = $user->get_extra_metadata('access_token');
+    ok $token, 'access token set';
+
+    $mech->content_contains($token, 'access token displayed');
+
+    $mech->get_ok('/auth/generate_token');
+    $mech->content_contains('Current token:');
+    $mech->content_contains($token, 'access token displayed');
+    $mech->content_contains('If you generate a new token');
+
+    $mech->log_out_ok;
+    $mech->add_header('Authorization', "Bearer $token");
+    $mech->logged_in_ok;
+}