Merge remote-tracking branch 'origin/release/0.19'0.19

9 files changed, 570 insertions, 362 deletions

diff --git a/spec/controllers/admin_request_controller_spec.rb b/spec/controllers/admin_request_controller_spec.rb
index 63b219c88..7c5253f49 100644
--- a/spec/controllers/admin_request_controller_spec.rb
+++ b/spec/controllers/admin_request_controller_spec.rb
@@ -60,6 +60,12 @@ describe AdminRequestController, "when administering requests" do
             get :fully_destroy, { :id => info_request }
         end
 
+        it 'uses a different flash message to avoid trying to fetch a non existent user record' do
+            info_request = info_requests(:external_request)
+            post :fully_destroy, { :id => info_request.id }
+            request.flash[:notice].should include('external')
+        end
+
     end
 
 end
diff --git a/spec/controllers/api_controller_spec.rb b/spec/controllers/api_controller_spec.rb
index 6b02bd5b4..323ef4cd4 100644
--- a/spec/controllers/api_controller_spec.rb
+++ b/spec/controllers/api_controller_spec.rb
@@ -4,382 +4,538 @@ require File.expand_path(File.dirname(__FILE__) + '/../spec_helper')
 describe ApiController, "when using the API" do
 
     describe 'checking API keys' do
-      before do
-        @number_of_requests = InfoRequest.count
-        @request_data = {
-            "title" => "Tell me about your chickens",
-            "body" => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n",
-
-            "external_url" => "http://www.example.gov.uk/foi/chickens_23",
-            "external_user_name" => "Bob Smith",
-        }
-      end
-
-      it 'should check that an API key is given as a param' do
-        expect {
-            post :create_request, :request_json => @request_data.to_json
-        }.to raise_error ApplicationController::PermissionDenied
-        InfoRequest.count.should == @number_of_requests
-      end
-
-      it "should check the API key" do
-          expect {
-              post :create_request,
-                   :k => "This is not really an API key",
-                   :request_json => @request_data.to_json
-          }.to raise_error ApplicationController::PermissionDenied
-          InfoRequest.count.should == @number_of_requests
-      end
+        before do
+            @number_of_requests = InfoRequest.count
+            @request_data = {
+                'title' => 'Tell me about your chickens',
+                'body' => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n",
+                'external_url' => 'http://www.example.gov.uk/foi/chickens_23',
+                'external_user_name' => 'Bob Smith'
+            }
+        end
+
+        it 'should check that an API key is given as a param' do
+            expect {
+                post :create_request, :request_json => @request_data.to_json
+            }.to raise_error ApplicationController::PermissionDenied
+            InfoRequest.count.should == @number_of_requests
+        end
+
+        it 'should check the API key' do
+            expect {
+                post :create_request,
+                     :k => 'This is not really an API key',
+                     :request_json => @request_data.to_json
+            }.to raise_error ApplicationController::PermissionDenied
+            InfoRequest.count.should == @number_of_requests
+        end
+    end
+
+    def _create_request
+        post :create_request,
+             :k => public_bodies(:geraldine_public_body).api_key,
+             :request_json => {
+                 'title' => 'Tell me about your chickens',
+                 'body' => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n",
+                 'external_url' => 'http://www.example.gov.uk/foi/chickens_23',
+                 'external_user_name' => 'Bob Smith'
+             }.to_json
+        response.content_type.should == 'application/json'
+        ActiveSupport::JSON.decode(response.body)['id']
     end
 
-    it "should create a new request from a POST" do
-        number_of_requests = InfoRequest.count(
+    # POST /api/v2/request.json
+    describe 'creating a request' do
+        it 'should create a new request from a POST' do
+            number_of_requests = InfoRequest.count(
             :conditions => [
-                    "public_body_id = ?",
-                    public_bodies(:geraldine_public_body).id
+                "public_body_id = ?",
+                public_bodies(:geraldine_public_body).id
             ]
-        )
-
-        request_data = {
-            "title" => "Tell me about your chickens",
-            "body" => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n",
+            )
+
+            request_data = {
+                'title' => 'Tell me about your chickens',
+                'body' => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n",
+                'external_url' => 'http://www.example.gov.uk/foi/chickens_23',
+                'external_user_name' => 'Bob Smith',
+            }
+
+            post :create_request,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :request_json => request_data.to_json
+            response.should be_success
+
+            response.content_type.should == 'application/json'
+            response_body = ActiveSupport::JSON.decode(response.body)
+            response_body['errors'].should be_nil
+            response_body['url'].should =~ /^http/
+
+            InfoRequest.count(:conditions => [
+                'public_body_id = ?',
+                public_bodies(:geraldine_public_body).id]
+            ).should == number_of_requests + 1
+
+            new_request = InfoRequest.find(response_body['id'])
+            new_request.user_id.should be_nil
+            new_request.external_user_name.should == request_data['external_user_name']
+            new_request.external_url.should == request_data['external_url']
+
+            new_request.title.should == request_data['title']
+            new_request.last_event_forming_initial_request.outgoing_message.body.should == request_data['body'].strip
+
+            new_request.public_body_id.should == public_bodies(:geraldine_public_body).id
+            new_request.info_request_events.size.should == 1
+            new_request.info_request_events[0].event_type.should == 'sent'
+            new_request.info_request_events[0].calculated_state.should == 'waiting_response'
+        end
+    end
 
-            "external_url" => "http://www.example.gov.uk/foi/chickens_23",
-            "external_user_name" => "Bob Smith",
-        }
+    # POST /api/v2/request/:id/add_correspondence.json
+    describe 'adding correspondence to a request' do
+        it 'should add a response to a request' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+
+            # Initially it has no incoming messages
+            IncomingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 0
+
+            # Now add one
+            sent_at = '2012-05-28T12:35:39+01:00'
+            response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'response',
+                     'sent_at' => sent_at,
+                     'body' => response_body
+                 }.to_json
+
+            # And make sure it worked
+            response.should be_success
+            incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id])
+            incoming_messages.count.should == 1
+            incoming_message = incoming_messages[0]
+
+            incoming_message.sent_at.should == Time.iso8601(sent_at)
+            incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body)
+        end
 
-        post :create_request, :k => public_bodies(:geraldine_public_body).api_key, :request_json => request_data.to_json
-        response.should be_success
+        it 'should add a followup to a request' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+
+            # Initially it has one outgoing message
+            OutgoingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 1
+
+            # Add another, as a followup
+            sent_at = '2012-05-29T12:35:39+01:00'
+            followup_body = "Pls answer ASAP.\nkthxbye\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'request',
+                     'sent_at' => sent_at,
+                     'body' => followup_body
+                 }.to_json
+
+            # Make sure it worked
+            response.should be_success
+            followup_messages = OutgoingMessage.all(
+                :conditions => ["info_request_id = ? and message_type = 'followup'", request_id]
+            )
+            followup_messages.size.should == 1
+            followup_message = followup_messages[0]
+
+            followup_message.last_sent_at.should == Time.iso8601(sent_at)
+            followup_message.body.should == followup_body.strip
+        end
 
-        response.content_type.should == "application/json"
+        it 'should update the status if a valid state is supplied' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+
+            # Initially it has no incoming messages
+            IncomingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 0
+
+            # Now add one
+            sent_at = '2012-05-28T12:35:39+01:00'
+            response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :state => 'successful',
+                 :correspondence_json => {
+                     'direction' => 'response',
+                     'sent_at' => sent_at,
+                     'body' => response_body,
+                 }.to_json
+
+            # And make sure it worked
+            response.should be_success
+            incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id])
+            incoming_messages.count.should == 1
+            request = InfoRequest.find_by_id(request_id)
+            request.described_state.should == 'successful'
+        end
 
-        response_body = ActiveSupport::JSON.decode(response.body)
-        response_body["errors"].should be_nil
-        response_body["url"].should =~ /^http/
+        it 'should raise a JSON 500 error if an invalid state is supplied' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+
+            # Initially it has no incoming messages
+            IncomingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 0
+
+            # Now add one
+            sent_at = '2012-05-28T12:35:39+01:00'
+            response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :state => 'random_string',
+                 :correspondence_json => {
+                     'direction' => 'response',
+                     'sent_at' => sent_at,
+                     'body' => response_body,
+                 }.to_json
+
+            # And make sure it worked
+            response.status.should == 500
+            ActiveSupport::JSON.decode(response.body)['errors'].should == [
+                "'random_string' is not a valid request state"]
+
+            incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id])
+            incoming_messages.count.should == 0
+            request = InfoRequest.find_by_id(request_id)
+            request.described_state.should == 'waiting_response'
+        end
 
-        InfoRequest.count(:conditions => [
-            "public_body_id = ?",
-            public_bodies(:geraldine_public_body).id]
-        ).should == number_of_requests + 1
+        it 'should not allow internal requests to be updated' do
+            n_incoming_messages = IncomingMessage.count
+            n_outgoing_messages = OutgoingMessage.count
+
+            request_id = info_requests(:naughty_chicken_request).id
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'request',
+                     'sent_at' => Time.now.iso8601,
+                     'body' => 'xxx'
+                 }.to_json
+
+            response.status.should == 403
+            ActiveSupport::JSON.decode(response.body)['errors'].should == [
+                "Request #{request_id} cannot be updated using the API"]
+
+            IncomingMessage.count.should == n_incoming_messages
+            OutgoingMessage.count.should == n_outgoing_messages
+        end
 
-        new_request = InfoRequest.find(response_body["id"])
-        new_request.user_id.should be_nil
-        new_request.external_user_name.should == request_data["external_user_name"]
-        new_request.external_url.should == request_data["external_url"]
+        it 'should not allow other people\'s requests to be updated' do
+            request_id = _create_request
+            n_incoming_messages = IncomingMessage.count
+            n_outgoing_messages = OutgoingMessage.count
+
+            post :add_correspondence,
+                 :k => public_bodies(:humpadink_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'request',
+                     'sent_at' => Time.now.iso8601,
+                     'body' => 'xxx'
+                 }.to_json
+
+            response.status.should == 403
+            ActiveSupport::JSON.decode(response.body)['errors'].should == [
+                "You do not own request #{request_id}"]
+
+            IncomingMessage.count.should == n_incoming_messages
+            OutgoingMessage.count.should == n_outgoing_messages
+        end
 
-        new_request.title.should == request_data["title"]
-        new_request.last_event_forming_initial_request.outgoing_message.body.should == request_data["body"].strip
+        it 'should return a JSON 404 error for non-existent requests' do
+            request_id = '123459876'
+            InfoRequest.stub(:find_by_id).with(request_id).and_return(nil)
+            sent_at = '2012-05-28T12:35:39+01:00'
+            response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'response',
+                     'sent_at' => sent_at,
+                     'body' => response_body
+                 }.to_json
+            response.status.should == 404
+            ActiveSupport::JSON.decode(response.body)['errors'].should == ['Could not find request 123459876']
+        end
 
-        new_request.public_body_id.should == public_bodies(:geraldine_public_body).id
-        new_request.info_request_events.size.should == 1
-        new_request.info_request_events[0].event_type.should == 'sent'
-        new_request.info_request_events[0].calculated_state.should == 'waiting_response'
-    end
+        it 'should return a JSON 403 error if we try to add correspondence to a request we don\'t own' do
+            request_id = info_requests(:naughty_chicken_request).id
+            sent_at = '2012-05-28T12:35:39+01:00'
+            response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'response',
+                     'sent_at' => sent_at,
+                     'body' => response_body
+                 }.to_json
+            response.status.should == 403
+            ActiveSupport::JSON.decode(response.body)['errors'].should == ["Request #{request_id} cannot be updated using the API"]
+        end
 
-    def _create_request
-        post :create_request,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :request_json => {
-                "title" => "Tell me about your chickens",
-                "body" => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n",
-
-                "external_url" => "http://www.example.gov.uk/foi/chickens_23",
-                "external_user_name" => "Bob Smith",
-            }.to_json
-        response.content_type.should == "application/json"
-        return ActiveSupport::JSON.decode(response.body)["id"]
-    end
+        it 'should not allow files to be attached to a followup' do
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => info_requests(:external_request).id,
+                 :correspondence_json => {
+                     'direction' => 'request',
+                     'sent_at' => Time.now.iso8601,
+                     'body' => 'Are you joking, or are you serious?'
+                 }.to_json,
+                 :attachments => [
+                     fixture_file_upload('/files/tfl.pdf')
+                 ]
+
+            # Make sure it worked
+            response.status.should == 500
+            errors = ActiveSupport::JSON.decode(response.body)['errors']
+            errors.should == ["You cannot attach files to messages in the 'request' direction"]
+        end
 
-    it "should add a response to a request" do
-        # First we need an external request
-        request_id = info_requests(:external_request).id
-
-        # Initially it has no incoming messages
-        IncomingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 0
-
-        # Now add one
-        sent_at = "2012-05-28T12:35:39+01:00"
-        response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                "direction" => "response",
-                "sent_at" => sent_at,
-                "body" => response_body
-            }.to_json
-
-        # And make sure it worked
-        response.should be_success
-        incoming_messages = IncomingMessage.all(:conditions => ["info_request_id = ?", request_id])
-        incoming_messages.count.should == 1
-        incoming_message = incoming_messages[0]
-
-        incoming_message.sent_at.should == Time.iso8601(sent_at)
-        incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body)
+        it 'should allow files to be attached to a response' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+
+            # Initially it has no incoming messages
+            IncomingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 0
+
+            # Now add one
+            sent_at = '2012-05-28T12:35:39+01:00'
+            response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
+            post :add_correspondence,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :correspondence_json => {
+                     'direction' => 'response',
+                     'sent_at' => sent_at,
+                     'body' => response_body
+                 }.to_json,
+                 :attachments => [
+                     fixture_file_upload('/files/tfl.pdf')
+                 ]
+
+            # And make sure it worked
+            response.should be_success
+            incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id])
+            incoming_messages.count.should == 1
+            incoming_message = incoming_messages[0]
+
+            incoming_message.sent_at.should == Time.iso8601(sent_at)
+            incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body)
+
+            # Get the attachment
+            attachments = incoming_message.get_attachments_for_display
+            attachments.size.should == 1
+            attachment = attachments[0]
+            attachment.filename.should == 'tfl.pdf'
+            attachment.body.should == load_file_fixture('tfl.pdf')
+        end
     end
 
-    it "should add a followup to a request" do
-        # First we need an external request
-        request_id = info_requests(:external_request).id
-
-        # Initially it has one outgoing message
-        OutgoingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 1
-
-        # Add another, as a followup
-        sent_at = "2012-05-29T12:35:39+01:00"
-        followup_body = "Pls answer ASAP.\nkthxbye\n"
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                "direction" => "request",
-                "sent_at" => sent_at,
-                "body" => followup_body
-            }.to_json
-
-        # Make sure it worked
-        response.should be_success
-        followup_messages = OutgoingMessage.all(
-            :conditions => ["info_request_id = ? and message_type = 'followup'", request_id]
-        )
-        followup_messages.size.should == 1
-        followup_message = followup_messages[0]
-
-        followup_message.last_sent_at.should == Time.iso8601(sent_at)
-        followup_message.body.should == followup_body.strip
-    end
+    # POST /api/v2/request/:id/update.json
+    describe 'updating a request\'s status' do
+        it 'should update the status' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+            request = InfoRequest.find_by_id(request_id)
+
+            # Its status should be the default for a new request
+            request.described_state.should == 'waiting_response'
+
+            # Now accept an update
+            post :update_state,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :state => 'partially_successful'
+
+            # It should have updated the status
+            request = InfoRequest.find_by_id(request_id)
+            request.described_state.should == 'partially_successful'
+
+            # It should have recorded the status_update event
+            last_event = request.info_request_events.last
+            last_event.event_type.should == 'status_update'
+            last_event.described_state.should == 'partially_successful'
+            last_event.params_yaml.should =~ /script: Geraldine Quango on behalf of requester via API/
+        end
 
-    it "should not allow internal requests to be updated" do
-        n_incoming_messages = IncomingMessage.count
-        n_outgoing_messages = OutgoingMessage.count
-
-        request_id = info_requests(:naughty_chicken_request).id
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                "direction" => "request",
-                "sent_at" => Time.now.iso8601,
-                "body" => "xxx"
-            }.to_json
-
-        response.status.should == 500
-        ActiveSupport::JSON.decode(response.body)["errors"].should == [
-          "Request #{request_id} cannot be updated using the API"]
-
-        IncomingMessage.count.should == n_incoming_messages
-        OutgoingMessage.count.should == n_outgoing_messages
-    end
+        it 'should return a JSON 500 error if an invalid state is sent' do
+            # First we need an external request
+            request_id = info_requests(:external_request).id
+            request = InfoRequest.find_by_id(request_id)
 
-    it "should not allow other people's requests to be updated" do
-        request_id = _create_request
-        n_incoming_messages = IncomingMessage.count
-        n_outgoing_messages = OutgoingMessage.count
-
-        post :add_correspondence,
-            :k => public_bodies(:humpadink_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                "direction" => "request",
-                "sent_at" => Time.now.iso8601,
-                "body" => "xxx"
-            }.to_json
-
-        response.status.should == 500
-        ActiveSupport::JSON.decode(response.body)["errors"].should == [
-          "You do not own request #{request_id}"]
-
-        IncomingMessage.count.should == n_incoming_messages
-        OutgoingMessage.count.should == n_outgoing_messages
-    end
+            # Its status should be the default for a new request
+            request.described_state.should == 'waiting_response'
 
-    it "should not allow files to be attached to a followup" do
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => info_requests(:external_request).id,
-            :correspondence_json => {
-                    "direction" => "request",
-                    "sent_at" => Time.now.iso8601,
-                    "body" => "Are you joking, or are you serious?"
-                }.to_json,
-            :attachments => [
-                fixture_file_upload("/files/tfl.pdf")
-            ]
+            # Now post an invalid update
+            post :update_state,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :state => 'random_string'
 
+            # Check that the error has been raised...
+            response.status.should == 500
+            ActiveSupport::JSON.decode(response.body)['errors'].should == ["'random_string' is not a valid request state"]
 
-        # Make sure it worked
-        response.status.should == 500
-        errors = ActiveSupport::JSON.decode(response.body)["errors"]
-        errors.should == ["You cannot attach files to messages in the 'request' direction"]
-    end
+            # ..and that the status hasn't been updated
+            request = InfoRequest.find_by_id(request_id)
+            request.described_state.should == 'waiting_response'
+        end
 
-    it "should allow files to be attached to a response" do
-        # First we need an external request
-        request_id = info_requests(:external_request).id
-
-        # Initially it has no incoming messages
-        IncomingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 0
-
-        # Now add one
-        sent_at = "2012-05-28T12:35:39+01:00"
-        response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                    "direction" => "response",
-                    "sent_at" => sent_at,
-                    "body" => response_body
-                }.to_json,
-            :attachments => [
-                fixture_file_upload("/files/tfl.pdf")
-            ]
+        it 'should return a JSON 404 error for non-existent requests' do
+            request_id = '123459876'
+            InfoRequest.stub(:find_by_id).with(request_id).and_return(nil)
 
-        # And make sure it worked
-        response.should be_success
-        incoming_messages = IncomingMessage.all(:conditions => ["info_request_id = ?", request_id])
-        incoming_messages.count.should == 1
-        incoming_message = incoming_messages[0]
-
-        incoming_message.sent_at.should == Time.iso8601(sent_at)
-        incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body)
-
-        # Get the attachment
-        attachments = incoming_message.get_attachments_for_display
-        attachments.size.should == 1
-        attachment = attachments[0]
-        attachment.filename.should == "tfl.pdf"
-        attachment.body.should == load_file_fixture("tfl.pdf")
-    end
+            post :update_state,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :state => "successful"
 
-    it "should show information about a request" do
-        info_request = info_requests(:naughty_chicken_request)
-        get :show_request,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => info_request.id
-
-        response.should be_success
-        assigns[:request].id.should == info_request.id
-
-        r = ActiveSupport::JSON.decode(response.body)
-        r["title"].should == info_request.title
-        # Let’s not test all the fields here, because it would
-        # essentially just be a matter of copying the code that
-        # assigns them and changing assignment to an equality
-        # check, which does not really test anything at all.
-    end
+            response.status.should == 404
+            ActiveSupport::JSON.decode(response.body)['errors'].should == ['Could not find request 123459876']
+        end
 
-    it 'should show information about an external request' do
-        info_request = info_requests(:external_request)
-        get :show_request,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => info_request.id
+        it 'should return a JSON 403 error if we try to add correspondence to a request we don\'t own' do
+            request_id = info_requests(:naughty_chicken_request).id
 
-        response.should be_success
-        assigns[:request].id.should == info_request.id
-        r = ActiveSupport::JSON.decode(response.body)
-        r["title"].should == info_request.title
-    end
+            post :update_state,
+                 :k => public_bodies(:geraldine_public_body).api_key,
+                 :id => request_id,
+                 :state => 'successful'
 
-    it "should show an Atom feed of new request events" do
-        get :body_request_events,
-            :id => public_bodies(:geraldine_public_body).id,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :feed_type => "atom"
-
-        response.should be_success
-        response.should render_template("api/request_events")
-        assigns[:events].size.should > 0
-        assigns[:events].each do |event|
-            event.info_request.public_body.should == public_bodies(:geraldine_public_body)
-            event.outgoing_message.should_not be_nil
-            event.event_type.should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)}
+            response.status.should == 403
+            ActiveSupport::JSON.decode(response.body)['errors'].should == ["Request #{request_id} cannot be updated using the API"]
         end
     end
 
-    it "should show a JSON feed of new request events" do
-        get :body_request_events,
-            :id => public_bodies(:geraldine_public_body).id,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :feed_type => "json"
-
-        response.should be_success
-        assigns[:events].size.should > 0
-        assigns[:events].each do |event|
-            event.info_request.public_body.should == public_bodies(:geraldine_public_body)
-            event.outgoing_message.should_not be_nil
-            event.event_type.should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)}
+    # GET /api/v2/request/:id.json
+    describe 'showing request info' do
+        it 'should show information about a request' do
+            info_request = info_requests(:naughty_chicken_request)
+
+            get :show_request,
+                :k => public_bodies(:geraldine_public_body).api_key,
+                :id => info_request.id
+
+            response.should be_success
+            assigns[:request].id.should == info_request.id
+
+            r = ActiveSupport::JSON.decode(response.body)
+            r['title'].should == info_request.title
+            # Let’s not test all the fields here, because it would
+            # essentially just be a matter of copying the code that
+            # assigns them and changing assignment to an equality
+            # check, which does not really test anything at all.
         end
 
-        assigns[:event_data].size.should == assigns[:events].size
-        assigns[:event_data].each do |event_record|
-            event_record[:event_type].should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)}
+        it 'should show information about an external request' do
+            info_request = info_requests(:external_request)
+            get :show_request,
+                :k => public_bodies(:geraldine_public_body).api_key,
+                :id => info_request.id
+
+            response.should be_success
+            assigns[:request].id.should == info_request.id
+            r = ActiveSupport::JSON.decode(response.body)
+            r['title'].should == info_request.title
         end
     end
 
-    it "should honour the since_event_id parameter" do
-        get :body_request_events,
-            :id => public_bodies(:geraldine_public_body).id,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :feed_type => "json"
-        response.should be_success
-        first_event = assigns[:event_data][0]
-        second_event_id = assigns[:event_data][1][:event_id]
-
-        get :body_request_events,
-            :id => public_bodies(:geraldine_public_body).id,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :feed_type => "json",
-            :since_event_id => second_event_id
-        response.should be_success
-        assigns[:event_data].should == [first_event]
-    end
+    # GET /api/v2/body/:id/request_events.:feed_type
+    describe 'showing public body info' do
+        it 'should show an Atom feed of new request events' do
+            get :body_request_events,
+                :id => public_bodies(:geraldine_public_body).id,
+                :k => public_bodies(:geraldine_public_body).api_key,
+                :feed_type => 'atom'
+
+            response.should be_success
+            response.should render_template('api/request_events')
+            assigns[:events].size.should > 0
+            assigns[:events].each do |event|
+                event.info_request.public_body.should == public_bodies(:geraldine_public_body)
+                event.outgoing_message.should_not be_nil
+                event.event_type.should satisfy { |x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x) }
+            end
+        end
 
-    it "should honour the since_date parameter for the Atom feed" do
-        get :body_request_events,
-            :id => public_bodies(:humpadink_public_body).id,
-            :k => public_bodies(:humpadink_public_body).api_key,
-            :since_date => "2010-01-01",
-            :feed_type => "atom"
-
-        response.should be_success
-        response.should render_template("api/request_events")
-        assigns[:events].size.should > 0
-        assigns[:events].each do |event|
-            event.created_at.should >= Date.new(2010, 1, 1)
+        it 'should show a JSON feed of new request events' do
+            get :body_request_events,
+                :id => public_bodies(:geraldine_public_body).id,
+                :k => public_bodies(:geraldine_public_body).api_key,
+                :feed_type => 'json'
+
+            response.should be_success
+            assigns[:events].size.should > 0
+            assigns[:events].each do |event|
+                event.info_request.public_body.should == public_bodies(:geraldine_public_body)
+                event.outgoing_message.should_not be_nil
+                event.event_type.should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)}
+            end
+
+            assigns[:event_data].size.should == assigns[:events].size
+            assigns[:event_data].each do |event_record|
+                event_record[:event_type].should satisfy { |x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x) }
+            end
         end
-    end
 
-    it "should return a JSON 404 error for non-existent requests" do
-        request_id = 123459876 # Let's hope this doesn't exist!
-        sent_at = "2012-05-28T12:35:39+01:00"
-        response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                "direction" => "response",
-                "sent_at" => sent_at,
-                "body" => response_body
-            }.to_json
-        response.status.should == 404
-        ActiveSupport::JSON.decode(response.body)["errors"].should == ["Could not find request 123459876"]
-    end
+        it 'should honour the since_event_id parameter' do
+            get :body_request_events,
+               :id => public_bodies(:geraldine_public_body).id,
+               :k => public_bodies(:geraldine_public_body).api_key,
+               :feed_type => 'json'
+
+            response.should be_success
+            first_event = assigns[:event_data][0]
+            second_event_id = assigns[:event_data][1][:event_id]
+
+            get :body_request_events,
+                :id => public_bodies(:geraldine_public_body).id,
+                :k => public_bodies(:geraldine_public_body).api_key,
+                :feed_type => 'json',
+                :since_event_id => second_event_id
+            response.should be_success
+            assigns[:event_data].should == [first_event]
+        end
 
-    it "should return a JSON 500 error if we try to add correspondence to a request we don't own" do
-        request_id = info_requests(:naughty_chicken_request).id
-        sent_at = "2012-05-28T12:35:39+01:00"
-        response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n"
-        post :add_correspondence,
-            :k => public_bodies(:geraldine_public_body).api_key,
-            :id => request_id,
-            :correspondence_json => {
-                "direction" => "response",
-                "sent_at" => sent_at,
-                "body" => response_body
-            }.to_json
-        response.status.should == 500
-        ActiveSupport::JSON.decode(response.body)["errors"].should == ["Request #{request_id} cannot be updated using the API"]
+        it 'should honour the since_date parameter' do
+            get :body_request_events,
+                :id => public_bodies(:humpadink_public_body).id,
+                :k => public_bodies(:humpadink_public_body).api_key,
+                :since_date => '2010-01-01',
+                :feed_type => 'atom'
+
+            response.should be_success
+            response.should render_template('api/request_events')
+            assigns[:events].size.should > 0
+            assigns[:events].each do |event|
+                event.created_at.should >= Date.new(2010, 1, 1)
+            end
+
+            get :body_request_events,
+                :id => public_bodies(:humpadink_public_body).id,
+                :k => public_bodies(:humpadink_public_body).api_key,
+                :since_date => '2010-01-01',
+                :feed_type => 'json'
+            assigns[:events].each do |event|
+                event.created_at.should >= Date.new(2010, 1, 1)
+            end
+        end
     end
 end
diff --git a/spec/controllers/comment_controller_spec.rb b/spec/controllers/comment_controller_spec.rb
index 5e250f689..480c85ad7 100644
--- a/spec/controllers/comment_controller_spec.rb
+++ b/spec/controllers/comment_controller_spec.rb
@@ -26,7 +26,7 @@ describe CommentController, "when commenting on a request" do
         post :new, params
         post_redirect = PostRedirect.get_last_post_redirect
         response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token)
-        # post_redirect.post_params.should == params # XXX get this working. there's a : vs '' problem amongst others
+        # post_redirect.post_params.should == params # TODO: get this working. there's a : vs '' problem amongst others
     end
 
     it "should create the comment, and redirect to request page when input is good and somebody is logged in" do
diff --git a/spec/controllers/general_controller_spec.rb b/spec/controllers/general_controller_spec.rb
index 7590a5b42..c0a9d57d3 100644
--- a/spec/controllers/general_controller_spec.rb
+++ b/spec/controllers/general_controller_spec.rb
@@ -188,7 +188,7 @@ describe GeneralController, 'when using xapian search' do
 
     it 'should highlight words for a user-only request' do
       get :search, :combined => "bob/users"
-      assigns[:highlight_words].should == ['bob']
+      assigns[:highlight_words].should == [/\b(bob)\w*\b/iu,  /\b(bob)\b/iu]
     end
 
     it 'should show spelling corrections for a user-only request' do
diff --git a/spec/controllers/public_body_change_requests_controller_spec.rb b/spec/controllers/public_body_change_requests_controller_spec.rb
index 7b878b893..8fe7befeb 100644
--- a/spec/controllers/public_body_change_requests_controller_spec.rb
+++ b/spec/controllers/public_body_change_requests_controller_spec.rb
@@ -22,7 +22,8 @@ describe PublicBodyChangeRequestsController, "creating a change request" do
                                      :public_body_name => 'New Body',
                                      :public_body_email => 'new_body@example.com',
                                      :notes => 'Please',
-                                     :source => 'http://www.example.com'}
+                                     :source => 'http://www.example.com',
+                                     :comment => '' }
         end
 
         it "should send an email to the site contact address" do
@@ -51,6 +52,18 @@ describe PublicBodyChangeRequestsController, "creating a change request" do
             response.should redirect_to frontpage_url
         end
 
+        it 'has rudimentary spam protection' do
+            spam_request_params = @change_request_params.merge({ :comment => 'I AM A SPAMBOT' })
+
+            post :create, { :public_body_change_request => spam_request_params }
+
+            response.should redirect_to(frontpage_path)
+
+            deliveries = ActionMailer::Base.deliveries
+            deliveries.size.should == 0
+            deliveries.clear
+        end
+
     end
 
     context 'when handling a request for an update to an existing authority' do
@@ -64,7 +77,8 @@ describe PublicBodyChangeRequestsController, "creating a change request" do
                                      :public_body_id => @public_body.id,
                                      :public_body_email => 'new_body@example.com',
                                      :notes => 'Please',
-                                     :source => 'http://www.example.com'}
+                                     :source => 'http://www.example.com',
+                                     :comment => '' }
         end
 
         it 'should send an email to the site contact address' do
diff --git a/spec/controllers/public_body_controller_spec.rb b/spec/controllers/public_body_controller_spec.rb
index 63989baaa..f64975580 100644
--- a/spec/controllers/public_body_controller_spec.rb
+++ b/spec/controllers/public_body_controller_spec.rb
@@ -184,6 +184,11 @@ describe PublicBodyController, "when listing bodies" do
         assigns[:public_bodies].should == [ public_bodies(:geraldine_public_body) ]
     end
 
+    it "should support simple searching of bodies by short_name" do
+        get :list, :public_body_query => 'DfH'
+        assigns[:public_bodies].should == [ public_bodies(:humpadink_public_body) ]
+    end
+
     it "should support simple searching of bodies by notes" do
         get :list, :public_body_query => 'Albatross'
         assigns[:public_bodies].should == [ public_bodies(:humpadink_public_body) ]
@@ -287,6 +292,23 @@ describe PublicBodyController, "when asked to export public bodies as CSV" do
         all_data[1].length.should == 11
     end
 
+    it "only includes visible bodies" do
+        get :list_all_csv
+        all_data = CSV.parse(response.body)
+        all_data.any?{ |row| row.include?('Internal admin authority') }.should be_false
+    end
+
+    it "does not include site_administration bodies" do
+        FactoryGirl.create(:public_body,
+                           :name => 'Site Admin Body',
+                           :tag_string => 'site_administration')
+
+        get :list_all_csv
+
+        all_data = CSV.parse(response.body)
+        all_data.any?{ |row| row.include?('Site Admin Body') }.should be_false
+    end
+
 end
 
 describe PublicBodyController, "when showing public body statistics" do
diff --git a/spec/controllers/request_controller_spec.rb b/spec/controllers/request_controller_spec.rb
index 9353efcb3..f7c935af3 100644
--- a/spec/controllers/request_controller_spec.rb
+++ b/spec/controllers/request_controller_spec.rb
@@ -77,7 +77,7 @@ describe RequestController, "when changing things that appear on the request pag
         PurgeRequest.all().count.should == 0
     end
     it "should purge the downstream cache when censor rules have changed" do
-        # XXX really, CensorRules should execute expiry logic as part
+        # TODO: really, CensorRules should execute expiry logic as part
         # of the after_save of the model. Currently this is part of
         # the AdminCensorRuleController logic, so must be tested from
         # there. Leaving this stub test in place as a reminder
@@ -643,7 +643,7 @@ describe RequestController, "when showing one request" do
             ir = info_requests(:fancy_dog_request)
             receive_incoming_mail('incoming-request-two-same-name.email', ir.incoming_email)
 
-            # XXX this is horrid, but don't know a better way.  If we
+            # TODO: this is horrid, but don't know a better way.  If we
             # don't do this, the info_request_event to which the
             # info_request is attached still uses the unmodified
             # version from the fixture.
@@ -900,7 +900,7 @@ describe RequestController, "when handling prominence" do
 
 end
 
-# XXX do this for invalid ids
+# TODO: do this for invalid ids
 #  it "should render 404 file" do
 #    response.should render_template("#{Rails.root}/public/404.html")
 #    response.headers["Status"].should == "404 Not Found"
@@ -923,7 +923,6 @@ describe RequestController, "when searching for an authority" do
     end
 
     it "should return matching bodies" do
-
         session[:user_id] = @user.id
         get :select_authority, :query => "Quango"
 
@@ -1004,7 +1003,18 @@ describe RequestController, "when creating a new request" do
         post :new, params
         post_redirect = PostRedirect.get_last_post_redirect
         response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token)
-        # post_redirect.post_params.should == params # XXX get this working. there's a : vs '' problem amongst others
+        # post_redirect.post_params.should == params # TODO: get this working. there's a : vs '' problem amongst others
+    end
+
+    it 'redirects to the frontpage if the action is sent the invalid
+        public_body param' do
+        post :new, :info_request => { :public_body => @body.id,
+                                      :title => 'Why Geraldine?',
+                                      :tag_string => '' },
+                   :outgoing_message => { :body => 'This is a silly letter.' },
+                   :submitted_new_request => 1,
+                   :preview => 1
+        response.should redirect_to frontpage_url
     end
 
     it "should show preview when input is good" do
@@ -1793,7 +1803,7 @@ describe RequestController, "when sending a followup message" do
         session[:user_id] = users(:bob_smith_user).id
         post :show_response, :outgoing_message => { :body => "", :what_doing => 'normal_sort'}, :id => info_requests(:fancy_dog_request).id, :incoming_message_id => incoming_messages(:useless_incoming_message), :submitted_followup => 1
 
-        # XXX how do I check the error message here?
+        # TODO: how do I check the error message here?
         response.should render_template('show_response')
     end
 
@@ -1843,13 +1853,13 @@ describe RequestController, "when sending a followup message" do
 
         # second time should give an error
         post :show_response, :outgoing_message => { :body => "Stop repeating yourself!", :what_doing => 'normal_sort' }, :id => info_requests(:fancy_dog_request).id, :incoming_message_id => incoming_messages(:useless_incoming_message), :submitted_followup => 1
-        # XXX how do I check the error message here?
+        # TODO: how do I check the error message here?
         response.should render_template('show_response')
     end
 
 end
 
-# XXX Stuff after here should probably be in request_mailer_spec.rb - but then
+# TODO: Stuff after here should probably be in request_mailer_spec.rb - but then
 # it can't check the URLs in the emails I don't think, ugh.
 
 describe RequestController, "sending overdue request alerts" do
@@ -1878,7 +1888,7 @@ describe RequestController, "sending overdue request alerts" do
         mail_token = $2
 
         session[:user_id].should be_nil
-        controller.test_code_redirect_by_email_token(mail_token, self) # XXX hack to avoid having to call User controller for email link
+        controller.test_code_redirect_by_email_token(mail_token, self) # TODO: hack to avoid having to call User controller for email link
         session[:user_id].should == info_requests(:naughty_chicken_request).user.id
 
         response.should render_template('show_response')
@@ -1935,7 +1945,7 @@ describe RequestController, "sending overdue request alerts" do
         mail_token = $2
 
         session[:user_id].should be_nil
-        controller.test_code_redirect_by_email_token(mail_token, self) # XXX hack to avoid having to call User controller for email link
+        controller.test_code_redirect_by_email_token(mail_token, self) # TODO: hack to avoid having to call User controller for email link
         session[:user_id].should == info_requests(:naughty_chicken_request).user.id
 
         response.should render_template('show_response')
@@ -2017,12 +2027,12 @@ describe RequestController, "sending unclassified new response reminder alerts"
         mail_token = $2
 
         session[:user_id].should be_nil
-        controller.test_code_redirect_by_email_token(mail_token, self) # XXX hack to avoid having to call User controller for email link
+        controller.test_code_redirect_by_email_token(mail_token, self) # TODO: hack to avoid having to call User controller for email link
         session[:user_id].should == info_requests(:fancy_dog_request).user.id
 
         response.should render_template('show')
         assigns[:info_request].should == info_requests(:fancy_dog_request)
-        # XXX should check anchor tag here :) that it goes to last new response
+        # TODO: should check anchor tag here :) that it goes to last new response
     end
 
 end
@@ -2053,7 +2063,7 @@ describe RequestController, "clarification required alerts" do
         mail_token = $2
 
         session[:user_id].should be_nil
-        controller.test_code_redirect_by_email_token(mail_token, self) # XXX hack to avoid having to call User controller for email link
+        controller.test_code_redirect_by_email_token(mail_token, self) # TODO: hack to avoid having to call User controller for email link
         session[:user_id].should == info_requests(:fancy_dog_request).user.id
 
         response.should render_template('show_response')
diff --git a/spec/controllers/track_controller_spec.rb b/spec/controllers/track_controller_spec.rb
index d2b45b6bf..29f5c7fe1 100644
--- a/spec/controllers/track_controller_spec.rb
+++ b/spec/controllers/track_controller_spec.rb
@@ -122,11 +122,11 @@ describe TrackController, "when sending alerts for a track" do
 
         mail.body.should =~ /This a the daftest comment the world has ever seen/ # comment text included
         # Check subscription managing link
-# XXX We can't do this, as it is redirecting to another controller. I'm
+# TODO: We can't do this, as it is redirecting to another controller. I'm
 # apparently meant to be writing controller unit tests here, not functional
 # tests.  Bah, I so don't care, bit of an obsessive constraint.
 #        session[:user_id].should be_nil
-#        controller.test_code_redirect_by_email_token(mail_token, self) # XXX hack to avoid having to call User controller for email link
+#        controller.test_code_redirect_by_email_token(mail_token, self) # TODO: hack to avoid having to call User controller for email link
 #        session[:user_id].should == users(:silly_name_user).id
 #
 #        response.should render_template('users/show')
@@ -173,7 +173,7 @@ describe TrackController, "when viewing RSS feed for a track" do
         get :track_request, :feed => 'feed', :url_title => track_thing.info_request.url_title
         response.should render_template('track/atom_feed')
         response.content_type.should == 'application/atom+xml'
-        # XXX should check it is an atom.builder type being rendered, not sure how to
+        # TODO: should check it is an atom.builder type being rendered, not sure how to
 
         assigns[:xapian_object].matches_estimated.should == 3
         assigns[:xapian_object].results.size.should == 3
diff --git a/spec/controllers/user_controller_spec.rb b/spec/controllers/user_controller_spec.rb
index cf361d898..6ecdf1ad4 100644
--- a/spec/controllers/user_controller_spec.rb
+++ b/spec/controllers/user_controller_spec.rb
@@ -1,7 +1,7 @@
 # coding: utf-8
 require File.expand_path(File.dirname(__FILE__) + '/../spec_helper')
 
-# XXX Use route_for or params_from to check /c/ links better
+# TODO: Use route_for or params_from to check /c/ links better
 # http://rspec.rubyforge.org/rspec-rails/1.1.12/classes/Spec/Rails/Example/ControllerExampleGroup.html
 describe UserController, "when redirecting a show request to a canonical url" do
 
@@ -327,7 +327,7 @@ describe UserController, "when signing up" do
         deliveries[0].body.should match(/when\s+you\s+already\s+have\s+an/)
     end
 
-    # XXX need to do bob@localhost signup and check that sends different email
+    # TODO: need to do bob@localhost signup and check that sends different email
 end
 
 describe UserController, "when signing out" do
@@ -380,7 +380,7 @@ describe UserController, "when sending another user a message" do
         mail = deliveries[0]
         mail.body.should include("Bob Smith has used #{AlaveteliConfiguration::site_name} to send you the message below")
         mail.body.should include("Just a test!")
-        #mail.to_addrs.first.to_s.should == users(:silly_name_user).name_and_email # XXX fix some nastiness with quoting name_and_email
+        #mail.to_addrs.first.to_s.should == users(:silly_name_user).name_and_email # TODO: fix some nastiness with quoting name_and_email
         mail.from_addrs.first.to_s.should == users(:bob_smith_user).email
     end
 
@@ -651,7 +651,7 @@ describe UserController, "when using profile photos" do
         @user.profile_photo.should_not be_nil
     end
 
-    # XXX todo check the two stage javascript cropping (above only tests one stage non-javascript one)
+    # TODO: todo check the two stage javascript cropping (above only tests one stage non-javascript one)
 end
 
 describe UserController, "when showing JSON version for API" do