diff options
| -rw-r--r-- | app/controllers/api_controller.rb | 145 | ||||
| -rw-r--r-- | app/models/info_request.rb | 10 | ||||
| -rw-r--r-- | config/routes.rb | 1 | ||||
| -rw-r--r-- | spec/controllers/api_controller_spec.rb | 823 |
4 files changed, 587 insertions, 392 deletions
diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index e6b0c121a..837364b19 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -1,5 +1,9 @@ class ApiController < ApplicationController before_filter :check_api_key + before_filter :check_external_request, + :only => [:add_correspondence, :update_state] + before_filter :check_request_ownership, + :only => [:add_correspondence, :update_state] def show_request @request = InfoRequest.find(params[:id]) @@ -9,16 +13,11 @@ class ApiController < ApplicationController :id => @request.id, :url => make_url("request", @request.url_title), :title => @request.title, - :created_at => @request.created_at, :updated_at => @request.updated_at, - :status => @request.calculate_status, - :public_body_url => make_url("body", @request.public_body.url_name), - :request_email => @request.incoming_email, - :request_text => @request.last_event_forming_initial_request.outgoing_message.body, } if @request.user @@ -73,35 +72,19 @@ class ApiController < ApplicationController 'url' => make_url("request", request.url_title), 'id' => request.id } - end def add_correspondence - request = InfoRequest.find_by_id(params[:id]) - if request.nil? - render :json => { "errors" => ["Could not find request #{params[:id]}"] }, :status => 404 - return - end - json = ActiveSupport::JSON.decode(params[:correspondence_json]) attachments = params[:attachments] direction = json["direction"] body = json["body"] sent_at = json["sent_at"] + new_state = params["state"] errors = [] - if !request.is_external? - render :json => { "errors" => ["Request #{params[:id]} cannot be updated using the API"] }, :status => 500 - return - end - - if request.public_body_id != @public_body.id - render :json => { "errors" => ["You do not own request #{params[:id]}"] }, :status => 500 - return - end - if !["request", "response"].include?(direction) errors << "The direction parameter must be 'request' or 'response'" end @@ -116,6 +99,10 @@ class ApiController < ApplicationController errors << "You cannot attach files to messages in the 'request' direction" end + if new_state && !InfoRequest.allowed_incoming_states.include?(new_state) + errors << "'#{new_state}' is not a valid request state" + end + if !errors.empty? render :json => { "errors" => errors }, :status => 500 return @@ -125,16 +112,16 @@ class ApiController < ApplicationController # In the 'request' direction, i.e. what we (Alaveteli) regard as outgoing outgoing_message = OutgoingMessage.new( - :info_request => request, + :info_request => @request, :status => 'ready', :message_type => 'followup', :body => body, :last_sent_at => sent_at, :what_doing => 'normal_sort' ) - request.outgoing_messages << outgoing_message - request.save! - request.log_event("followup_sent", + @request.outgoing_messages << outgoing_message + @request.save! + @request.log_event("followup_sent", :api => true, :email => nil, :outgoing_message_id => outgoing_message.id, @@ -154,12 +141,48 @@ class ApiController < ApplicationController ) end - mail = RequestMailer.external_response(request, body, sent_at, attachment_hashes) + mail = RequestMailer.external_response(@request, body, sent_at, attachment_hashes) + + @request.receive(mail, mail.encoded, true) - request.receive(mail, mail.encoded, true) + if new_state + # we've already checked above that the status is valid + # so no need to check a second time + event = @request.log_event("status_update", + { :script => "#{@public_body.name} via API", + :old_described_state => @request.described_state, + :described_state => new_state, + }) + @request.set_described_state(new_state) + end end render :json => { - 'url' => make_url("request", request.url_title), + 'url' => make_url("request", @request.url_title), + } + end + + def update_state + new_state = params["state"] + + if InfoRequest.allowed_incoming_states.include?(new_state) + ActiveRecord::Base.transaction do + event = @request.log_event("status_update", + { :script => "#{@public_body.name} on behalf of requester via API", + :old_described_state => @request.described_state, + :described_state => new_state, + }) + @request.set_described_state(new_state) + end + else + render :json => { + "errors" => ["'#{new_state}' is not a valid request state" ] + }, + :status => 500 + return + end + + render :json => { + 'url' => make_url("request", @request.url_title), } end @@ -170,36 +193,36 @@ class ApiController < ApplicationController since_date_str = params[:since_date] if since_date_str.nil? @events = InfoRequestEvent.find_by_sql([ - %(select info_request_events.* - from info_requests - join info_request_events on info_requests.id = info_request_events.info_request_id - where info_requests.public_body_id = ? - and info_request_events.event_type in ( - 'sent', 'followup_sent', 'resent', 'followup_resent' - ) - order by info_request_events.created_at desc - ), @public_body.id + %(select info_request_events.* + from info_requests + join info_request_events on info_requests.id = info_request_events.info_request_id + where info_requests.public_body_id = ? + and info_request_events.event_type in ( + 'sent', 'followup_sent', 'resent', 'followup_resent' + ) + order by info_request_events.created_at desc + ), @public_body.id ]) else begin - since_date = Date.strptime(since_date_str, "%Y-%m-%d") + since_date = Date.strptime(since_date_str, "%Y-%m-%d") rescue ArgumentError - render :json => {"errors" => [ - "Parameter since_date must be in format yyyy-mm-dd (not '#{since_date_str}')" ] }, - :status => 500 - return + render :json => {"errors" => [ + "Parameter since_date must be in format yyyy-mm-dd (not '#{since_date_str}')" ] }, + :status => 500 + return end @events = InfoRequestEvent.find_by_sql([ - %(select info_request_events.* - from info_requests - join info_request_events on info_requests.id = info_request_events.info_request_id - where info_requests.public_body_id = ? - and info_request_events.event_type in ( - 'sent', 'followup_sent', 'resent', 'followup_resent' - ) - and info_request_events.created_at >= ? - order by info_request_events.created_at desc - ), @public_body.id, since_date + %(select info_request_events.* + from info_requests + join info_request_events on info_requests.id = info_request_events.info_request_id + where info_requests.public_body_id = ? + and info_request_events.event_type in ( + 'sent', 'followup_sent', 'resent', 'followup_resent' + ) + and info_request_events.created_at >= ? + order by info_request_events.created_at desc + ), @public_body.id, since_date ]) end if feed_type == "atom" @@ -224,7 +247,6 @@ class ApiController < ApplicationController :request_email => request.incoming_email, :title => request.title, :body => event.outgoing_message.body, - :user_name => request.user_name, } if request.user @@ -246,6 +268,21 @@ class ApiController < ApplicationController raise PermissionDenied if @public_body.nil? end + def check_external_request + @request = InfoRequest.find_by_id(params[:id]) + if @request.nil? + render :json => { "errors" => ["Could not find request #{params[:id]}"] }, :status => 404 + elsif !@request.is_external? + render :json => { "errors" => ["Request #{params[:id]} cannot be updated using the API"] }, :status => 403 + end + end + + def check_request_ownership + if @request.public_body_id != @public_body.id + render :json => { "errors" => ["You do not own request #{params[:id]}"] }, :status => 403 + end + end + private def make_url(*args) "http://" + AlaveteliConfiguration::domain + "/" + args.join("/") diff --git a/app/models/info_request.rb b/app/models/info_request.rb index a2112a210..aed651ad3 100644 --- a/app/models/info_request.rb +++ b/app/models/info_request.rb @@ -115,6 +115,16 @@ class InfoRequest < ActiveRecord::Base states end + # Subset of states accepted via the API + def self.allowed_incoming_states + [ + 'waiting_response', + 'rejected', + 'successful', + 'partially_successful' + ] + end + # Possible reasons that a request could be reported for administrator attention def report_reasons [_("Contains defamatory material"), diff --git a/config/routes.rb b/config/routes.rb index 7cc85c974..9f426fabf 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -261,6 +261,7 @@ Alaveteli::Application.routes.draw do match '/api/v2/request/:id.json' => 'api#show_request', :as => :api_show_request, :via => :get match '/api/v2/request/:id.json' => 'api#add_correspondence', :as => :api_add_correspondence, :via => :post + match '/api/v2/request/:id/update.json' => 'api#update_state', :as => :api_update_state, :via => :post match '/api/v2/body/:id/request_events.:feed_type' => 'api#body_request_events', :as => :api_body_request_events, :feed_type => '^(json|atom)$' #### diff --git a/spec/controllers/api_controller_spec.rb b/spec/controllers/api_controller_spec.rb index 6b02bd5b4..7b1d73e8a 100644 --- a/spec/controllers/api_controller_spec.rb +++ b/spec/controllers/api_controller_spec.rb @@ -4,382 +4,529 @@ require File.expand_path(File.dirname(__FILE__) + '/../spec_helper') describe ApiController, "when using the API" do describe 'checking API keys' do - before do - @number_of_requests = InfoRequest.count - @request_data = { - "title" => "Tell me about your chickens", - "body" => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n", - - "external_url" => "http://www.example.gov.uk/foi/chickens_23", - "external_user_name" => "Bob Smith", - } - end - - it 'should check that an API key is given as a param' do - expect { - post :create_request, :request_json => @request_data.to_json - }.to raise_error ApplicationController::PermissionDenied - InfoRequest.count.should == @number_of_requests - end - - it "should check the API key" do - expect { - post :create_request, - :k => "This is not really an API key", - :request_json => @request_data.to_json - }.to raise_error ApplicationController::PermissionDenied - InfoRequest.count.should == @number_of_requests - end + before do + @number_of_requests = InfoRequest.count + @request_data = { + 'title' => 'Tell me about your chickens', + 'body' => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n", + 'external_url' => 'http://www.example.gov.uk/foi/chickens_23', + 'external_user_name' => 'Bob Smith' + } + end + + it 'should check that an API key is given as a param' do + expect { + post :create_request, :request_json => @request_data.to_json + }.to raise_error ApplicationController::PermissionDenied + InfoRequest.count.should == @number_of_requests + end + + it 'should check the API key' do + expect { + post :create_request, + :k => 'This is not really an API key', + :request_json => @request_data.to_json + }.to raise_error ApplicationController::PermissionDenied + InfoRequest.count.should == @number_of_requests + end + end + + def _create_request + post :create_request, + :k => public_bodies(:geraldine_public_body).api_key, + :request_json => { + 'title' => 'Tell me about your chickens', + 'body' => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n", + 'external_url' => 'http://www.example.gov.uk/foi/chickens_23', + 'external_user_name' => 'Bob Smith' + }.to_json + response.content_type.should == 'application/json' + ActiveSupport::JSON.decode(response.body)['id'] end - it "should create a new request from a POST" do - number_of_requests = InfoRequest.count( + # POST /api/v2/request.json + describe 'creating a request' do + it 'should create a new request from a POST' do + number_of_requests = InfoRequest.count( :conditions => [ - "public_body_id = ?", - public_bodies(:geraldine_public_body).id + "public_body_id = ?", + public_bodies(:geraldine_public_body).id ] - ) - - request_data = { - "title" => "Tell me about your chickens", - "body" => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n", + ) + + request_data = { + 'title' => 'Tell me about your chickens', + 'body' => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n", + 'external_url' => 'http://www.example.gov.uk/foi/chickens_23', + 'external_user_name' => 'Bob Smith', + } + + post :create_request, + :k => public_bodies(:geraldine_public_body).api_key, + :request_json => request_data.to_json + response.should be_success + + response.content_type.should == 'application/json' + response_body = ActiveSupport::JSON.decode(response.body) + response_body['errors'].should be_nil + response_body['url'].should =~ /^http/ + + InfoRequest.count(:conditions => [ + 'public_body_id = ?', + public_bodies(:geraldine_public_body).id] + ).should == number_of_requests + 1 + + new_request = InfoRequest.find(response_body['id']) + new_request.user_id.should be_nil + new_request.external_user_name.should == request_data['external_user_name'] + new_request.external_url.should == request_data['external_url'] + + new_request.title.should == request_data['title'] + new_request.last_event_forming_initial_request.outgoing_message.body.should == request_data['body'].strip + + new_request.public_body_id.should == public_bodies(:geraldine_public_body).id + new_request.info_request_events.size.should == 1 + new_request.info_request_events[0].event_type.should == 'sent' + new_request.info_request_events[0].calculated_state.should == 'waiting_response' + end + end - "external_url" => "http://www.example.gov.uk/foi/chickens_23", - "external_user_name" => "Bob Smith", - } + # POST /api/v2/request/:id/add_correspondence.json + describe 'adding correspondence to a request' do + it 'should add a response to a request' do + # First we need an external request + request_id = info_requests(:external_request).id + + # Initially it has no incoming messages + IncomingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 0 + + # Now add one + sent_at = '2012-05-28T12:35:39+01:00' + response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'response', + 'sent_at' => sent_at, + 'body' => response_body + }.to_json + + # And make sure it worked + response.should be_success + incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id]) + incoming_messages.count.should == 1 + incoming_message = incoming_messages[0] + + incoming_message.sent_at.should == Time.iso8601(sent_at) + incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body) + end - post :create_request, :k => public_bodies(:geraldine_public_body).api_key, :request_json => request_data.to_json - response.should be_success + it 'should add a followup to a request' do + # First we need an external request + request_id = info_requests(:external_request).id + + # Initially it has one outgoing message + OutgoingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 1 + + # Add another, as a followup + sent_at = '2012-05-29T12:35:39+01:00' + followup_body = "Pls answer ASAP.\nkthxbye\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'request', + 'sent_at' => sent_at, + 'body' => followup_body + }.to_json + + # Make sure it worked + response.should be_success + followup_messages = OutgoingMessage.all( + :conditions => ["info_request_id = ? and message_type = 'followup'", request_id] + ) + followup_messages.size.should == 1 + followup_message = followup_messages[0] + + followup_message.last_sent_at.should == Time.iso8601(sent_at) + followup_message.body.should == followup_body.strip + end - response.content_type.should == "application/json" + it 'should update the status if a valid state is supplied' do + # First we need an external request + request_id = info_requests(:external_request).id + + # Initially it has no incoming messages + IncomingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 0 + + # Now add one + sent_at = '2012-05-28T12:35:39+01:00' + response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :state => 'successful', + :correspondence_json => { + 'direction' => 'response', + 'sent_at' => sent_at, + 'body' => response_body, + }.to_json + + # And make sure it worked + response.should be_success + incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id]) + incoming_messages.count.should == 1 + request = InfoRequest.find_by_id(request_id) + request.described_state.should == 'successful' + end - response_body = ActiveSupport::JSON.decode(response.body) - response_body["errors"].should be_nil - response_body["url"].should =~ /^http/ + it 'should raise a JSON 500 error if an invalid state is supplied' do + # First we need an external request + request_id = info_requests(:external_request).id + + # Initially it has no incoming messages + IncomingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 0 + + # Now add one + sent_at = '2012-05-28T12:35:39+01:00' + response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :state => 'random_string', + :correspondence_json => { + 'direction' => 'response', + 'sent_at' => sent_at, + 'body' => response_body, + }.to_json + + # And make sure it worked + response.status.should == 500 + ActiveSupport::JSON.decode(response.body)['errors'].should == [ + "'random_string' is not a valid request state"] + + incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id]) + incoming_messages.count.should == 0 + request = InfoRequest.find_by_id(request_id) + request.described_state.should == 'waiting_response' + end - InfoRequest.count(:conditions => [ - "public_body_id = ?", - public_bodies(:geraldine_public_body).id] - ).should == number_of_requests + 1 + it 'should not allow internal requests to be updated' do + n_incoming_messages = IncomingMessage.count + n_outgoing_messages = OutgoingMessage.count + + request_id = info_requests(:naughty_chicken_request).id + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'request', + 'sent_at' => Time.now.iso8601, + 'body' => 'xxx' + }.to_json + + response.status.should == 403 + ActiveSupport::JSON.decode(response.body)['errors'].should == [ + "Request #{request_id} cannot be updated using the API"] + + IncomingMessage.count.should == n_incoming_messages + OutgoingMessage.count.should == n_outgoing_messages + end - new_request = InfoRequest.find(response_body["id"]) - new_request.user_id.should be_nil - new_request.external_user_name.should == request_data["external_user_name"] - new_request.external_url.should == request_data["external_url"] + it 'should not allow other people\'s requests to be updated' do + request_id = _create_request + n_incoming_messages = IncomingMessage.count + n_outgoing_messages = OutgoingMessage.count + + post :add_correspondence, + :k => public_bodies(:humpadink_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'request', + 'sent_at' => Time.now.iso8601, + 'body' => 'xxx' + }.to_json + + response.status.should == 403 + ActiveSupport::JSON.decode(response.body)['errors'].should == [ + "You do not own request #{request_id}"] + + IncomingMessage.count.should == n_incoming_messages + OutgoingMessage.count.should == n_outgoing_messages + end - new_request.title.should == request_data["title"] - new_request.last_event_forming_initial_request.outgoing_message.body.should == request_data["body"].strip + it 'should return a JSON 404 error for non-existent requests' do + request_id = '123459876' + InfoRequest.stub(:find_by_id).with(request_id).and_return(nil) + sent_at = '2012-05-28T12:35:39+01:00' + response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'response', + 'sent_at' => sent_at, + 'body' => response_body + }.to_json + response.status.should == 404 + ActiveSupport::JSON.decode(response.body)['errors'].should == ['Could not find request 123459876'] + end - new_request.public_body_id.should == public_bodies(:geraldine_public_body).id - new_request.info_request_events.size.should == 1 - new_request.info_request_events[0].event_type.should == 'sent' - new_request.info_request_events[0].calculated_state.should == 'waiting_response' - end + it 'should return a JSON 403 error if we try to add correspondence to a request we don\'t own' do + request_id = info_requests(:naughty_chicken_request).id + sent_at = '2012-05-28T12:35:39+01:00' + response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'response', + 'sent_at' => sent_at, + 'body' => response_body + }.to_json + response.status.should == 403 + ActiveSupport::JSON.decode(response.body)['errors'].should == ["Request #{request_id} cannot be updated using the API"] + end - def _create_request - post :create_request, - :k => public_bodies(:geraldine_public_body).api_key, - :request_json => { - "title" => "Tell me about your chickens", - "body" => "Dear Sir,\n\nI should like to know about your chickens.\n\nYours in faith,\nBob\n", - - "external_url" => "http://www.example.gov.uk/foi/chickens_23", - "external_user_name" => "Bob Smith", - }.to_json - response.content_type.should == "application/json" - return ActiveSupport::JSON.decode(response.body)["id"] - end + it 'should not allow files to be attached to a followup' do + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => info_requests(:external_request).id, + :correspondence_json => { + 'direction' => 'request', + 'sent_at' => Time.now.iso8601, + 'body' => 'Are you joking, or are you serious?' + }.to_json, + :attachments => [ + fixture_file_upload('/files/tfl.pdf') + ] + + # Make sure it worked + response.status.should == 500 + errors = ActiveSupport::JSON.decode(response.body)['errors'] + errors.should == ["You cannot attach files to messages in the 'request' direction"] + end - it "should add a response to a request" do - # First we need an external request - request_id = info_requests(:external_request).id - - # Initially it has no incoming messages - IncomingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 0 - - # Now add one - sent_at = "2012-05-28T12:35:39+01:00" - response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "response", - "sent_at" => sent_at, - "body" => response_body - }.to_json - - # And make sure it worked - response.should be_success - incoming_messages = IncomingMessage.all(:conditions => ["info_request_id = ?", request_id]) - incoming_messages.count.should == 1 - incoming_message = incoming_messages[0] - - incoming_message.sent_at.should == Time.iso8601(sent_at) - incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body) + it 'should allow files to be attached to a response' do + # First we need an external request + request_id = info_requests(:external_request).id + + # Initially it has no incoming messages + IncomingMessage.count(:conditions => ['info_request_id = ?', request_id]).should == 0 + + # Now add one + sent_at = '2012-05-28T12:35:39+01:00' + response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" + post :add_correspondence, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :correspondence_json => { + 'direction' => 'response', + 'sent_at' => sent_at, + 'body' => response_body + }.to_json, + :attachments => [ + fixture_file_upload('/files/tfl.pdf') + ] + + # And make sure it worked + response.should be_success + incoming_messages = IncomingMessage.all(:conditions => ['info_request_id = ?', request_id]) + incoming_messages.count.should == 1 + incoming_message = incoming_messages[0] + + incoming_message.sent_at.should == Time.iso8601(sent_at) + incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body) + + # Get the attachment + attachments = incoming_message.get_attachments_for_display + attachments.size.should == 1 + attachment = attachments[0] + attachment.filename.should == 'tfl.pdf' + attachment.body.should == load_file_fixture('tfl.pdf') + end end - it "should add a followup to a request" do - # First we need an external request - request_id = info_requests(:external_request).id - - # Initially it has one outgoing message - OutgoingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 1 - - # Add another, as a followup - sent_at = "2012-05-29T12:35:39+01:00" - followup_body = "Pls answer ASAP.\nkthxbye\n" - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "request", - "sent_at" => sent_at, - "body" => followup_body - }.to_json - - # Make sure it worked - response.should be_success - followup_messages = OutgoingMessage.all( - :conditions => ["info_request_id = ? and message_type = 'followup'", request_id] - ) - followup_messages.size.should == 1 - followup_message = followup_messages[0] - - followup_message.last_sent_at.should == Time.iso8601(sent_at) - followup_message.body.should == followup_body.strip - end + # POST /api/v2/request/:id/update.json + describe 'updating a request\'s status' do + it 'should update the status' do + # First we need an external request + request_id = info_requests(:external_request).id + request = InfoRequest.find_by_id(request_id) + + # Its status should be the default for a new request + request.described_state.should == 'waiting_response' + + # Now accept an update + post :update_state, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :state => 'partially_successful' + + # It should have updated the status + request = InfoRequest.find_by_id(request_id) + request.described_state.should == 'partially_successful' + + # It should have recorded the status_update event + last_event = request.info_request_events.last + last_event.event_type.should == 'status_update' + last_event.described_state.should == 'partially_successful' + last_event.params_yaml.should =~ /script: Geraldine Quango on behalf of requester via API/ + end - it "should not allow internal requests to be updated" do - n_incoming_messages = IncomingMessage.count - n_outgoing_messages = OutgoingMessage.count - - request_id = info_requests(:naughty_chicken_request).id - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "request", - "sent_at" => Time.now.iso8601, - "body" => "xxx" - }.to_json - - response.status.should == 500 - ActiveSupport::JSON.decode(response.body)["errors"].should == [ - "Request #{request_id} cannot be updated using the API"] - - IncomingMessage.count.should == n_incoming_messages - OutgoingMessage.count.should == n_outgoing_messages - end + it 'should return a JSON 500 error if an invalid state is sent' do + # First we need an external request + request_id = info_requests(:external_request).id + request = InfoRequest.find_by_id(request_id) - it "should not allow other people's requests to be updated" do - request_id = _create_request - n_incoming_messages = IncomingMessage.count - n_outgoing_messages = OutgoingMessage.count - - post :add_correspondence, - :k => public_bodies(:humpadink_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "request", - "sent_at" => Time.now.iso8601, - "body" => "xxx" - }.to_json - - response.status.should == 500 - ActiveSupport::JSON.decode(response.body)["errors"].should == [ - "You do not own request #{request_id}"] - - IncomingMessage.count.should == n_incoming_messages - OutgoingMessage.count.should == n_outgoing_messages - end + # Its status should be the default for a new request + request.described_state.should == 'waiting_response' - it "should not allow files to be attached to a followup" do - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => info_requests(:external_request).id, - :correspondence_json => { - "direction" => "request", - "sent_at" => Time.now.iso8601, - "body" => "Are you joking, or are you serious?" - }.to_json, - :attachments => [ - fixture_file_upload("/files/tfl.pdf") - ] + # Now post an invalid update + post :update_state, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :state => 'random_string' + # Check that the error has been raised... + response.status.should == 500 + ActiveSupport::JSON.decode(response.body)['errors'].should == ["'random_string' is not a valid request state"] - # Make sure it worked - response.status.should == 500 - errors = ActiveSupport::JSON.decode(response.body)["errors"] - errors.should == ["You cannot attach files to messages in the 'request' direction"] - end + # ..and that the status hasn't been updated + request = InfoRequest.find_by_id(request_id) + request.described_state.should == 'waiting_response' + end - it "should allow files to be attached to a response" do - # First we need an external request - request_id = info_requests(:external_request).id - - # Initially it has no incoming messages - IncomingMessage.count(:conditions => ["info_request_id = ?", request_id]).should == 0 - - # Now add one - sent_at = "2012-05-28T12:35:39+01:00" - response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "response", - "sent_at" => sent_at, - "body" => response_body - }.to_json, - :attachments => [ - fixture_file_upload("/files/tfl.pdf") - ] + it 'should return a JSON 404 error for non-existent requests' do + request_id = '123459876' + InfoRequest.stub(:find_by_id).with(request_id).and_return(nil) - # And make sure it worked - response.should be_success - incoming_messages = IncomingMessage.all(:conditions => ["info_request_id = ?", request_id]) - incoming_messages.count.should == 1 - incoming_message = incoming_messages[0] - - incoming_message.sent_at.should == Time.iso8601(sent_at) - incoming_message.get_main_body_text_folded.should be_equal_modulo_whitespace_to(response_body) - - # Get the attachment - attachments = incoming_message.get_attachments_for_display - attachments.size.should == 1 - attachment = attachments[0] - attachment.filename.should == "tfl.pdf" - attachment.body.should == load_file_fixture("tfl.pdf") - end + post :update_state, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :state => "successful" - it "should show information about a request" do - info_request = info_requests(:naughty_chicken_request) - get :show_request, - :k => public_bodies(:geraldine_public_body).api_key, - :id => info_request.id - - response.should be_success - assigns[:request].id.should == info_request.id - - r = ActiveSupport::JSON.decode(response.body) - r["title"].should == info_request.title - # Let’s not test all the fields here, because it would - # essentially just be a matter of copying the code that - # assigns them and changing assignment to an equality - # check, which does not really test anything at all. - end + response.status.should == 404 + ActiveSupport::JSON.decode(response.body)['errors'].should == ['Could not find request 123459876'] + end - it 'should show information about an external request' do - info_request = info_requests(:external_request) - get :show_request, - :k => public_bodies(:geraldine_public_body).api_key, - :id => info_request.id + it 'should return a JSON 403 error if we try to add correspondence to a request we don\'t own' do + request_id = info_requests(:naughty_chicken_request).id - response.should be_success - assigns[:request].id.should == info_request.id - r = ActiveSupport::JSON.decode(response.body) - r["title"].should == info_request.title - end + post :update_state, + :k => public_bodies(:geraldine_public_body).api_key, + :id => request_id, + :state => 'successful' - it "should show an Atom feed of new request events" do - get :body_request_events, - :id => public_bodies(:geraldine_public_body).id, - :k => public_bodies(:geraldine_public_body).api_key, - :feed_type => "atom" - - response.should be_success - response.should render_template("api/request_events") - assigns[:events].size.should > 0 - assigns[:events].each do |event| - event.info_request.public_body.should == public_bodies(:geraldine_public_body) - event.outgoing_message.should_not be_nil - event.event_type.should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)} + response.status.should == 403 + ActiveSupport::JSON.decode(response.body)['errors'].should == ["Request #{request_id} cannot be updated using the API"] end end - it "should show a JSON feed of new request events" do - get :body_request_events, - :id => public_bodies(:geraldine_public_body).id, - :k => public_bodies(:geraldine_public_body).api_key, - :feed_type => "json" - - response.should be_success - assigns[:events].size.should > 0 - assigns[:events].each do |event| - event.info_request.public_body.should == public_bodies(:geraldine_public_body) - event.outgoing_message.should_not be_nil - event.event_type.should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)} + # GET /api/v2/request/:id.json + describe 'showing request info' do + it 'should show information about a request' do + info_request = info_requests(:naughty_chicken_request) + + get :show_request, + :k => public_bodies(:geraldine_public_body).api_key, + :id => info_request.id + + response.should be_success + assigns[:request].id.should == info_request.id + + r = ActiveSupport::JSON.decode(response.body) + r['title'].should == info_request.title + # Let’s not test all the fields here, because it would + # essentially just be a matter of copying the code that + # assigns them and changing assignment to an equality + # check, which does not really test anything at all. end - assigns[:event_data].size.should == assigns[:events].size - assigns[:event_data].each do |event_record| - event_record[:event_type].should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)} + it 'should show information about an external request' do + info_request = info_requests(:external_request) + get :show_request, + :k => public_bodies(:geraldine_public_body).api_key, + :id => info_request.id + + response.should be_success + assigns[:request].id.should == info_request.id + r = ActiveSupport::JSON.decode(response.body) + r['title'].should == info_request.title end end - it "should honour the since_event_id parameter" do - get :body_request_events, - :id => public_bodies(:geraldine_public_body).id, - :k => public_bodies(:geraldine_public_body).api_key, - :feed_type => "json" - response.should be_success - first_event = assigns[:event_data][0] - second_event_id = assigns[:event_data][1][:event_id] - - get :body_request_events, - :id => public_bodies(:geraldine_public_body).id, - :k => public_bodies(:geraldine_public_body).api_key, - :feed_type => "json", - :since_event_id => second_event_id - response.should be_success - assigns[:event_data].should == [first_event] - end + # GET /api/v2/body/:id/request_events.:feed_type + describe 'showing public body info' do + it 'should show an Atom feed of new request events' do + get :body_request_events, + :id => public_bodies(:geraldine_public_body).id, + :k => public_bodies(:geraldine_public_body).api_key, + :feed_type => 'atom' + + response.should be_success + response.should render_template('api/request_events') + assigns[:events].size.should > 0 + assigns[:events].each do |event| + event.info_request.public_body.should == public_bodies(:geraldine_public_body) + event.outgoing_message.should_not be_nil + event.event_type.should satisfy { |x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x) } + end + end - it "should honour the since_date parameter for the Atom feed" do - get :body_request_events, - :id => public_bodies(:humpadink_public_body).id, - :k => public_bodies(:humpadink_public_body).api_key, - :since_date => "2010-01-01", - :feed_type => "atom" - - response.should be_success - response.should render_template("api/request_events") - assigns[:events].size.should > 0 - assigns[:events].each do |event| - event.created_at.should >= Date.new(2010, 1, 1) + it 'should show a JSON feed of new request events' do + get :body_request_events, + :id => public_bodies(:geraldine_public_body).id, + :k => public_bodies(:geraldine_public_body).api_key, + :feed_type => 'json' + + response.should be_success + assigns[:events].size.should > 0 + assigns[:events].each do |event| + event.info_request.public_body.should == public_bodies(:geraldine_public_body) + event.outgoing_message.should_not be_nil + event.event_type.should satisfy {|x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x)} + end + + assigns[:event_data].size.should == assigns[:events].size + assigns[:event_data].each do |event_record| + event_record[:event_type].should satisfy { |x| ['sent', 'followup_sent', 'resent', 'followup_resent'].include?(x) } + end end - end - it "should return a JSON 404 error for non-existent requests" do - request_id = 123459876 # Let's hope this doesn't exist! - sent_at = "2012-05-28T12:35:39+01:00" - response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "response", - "sent_at" => sent_at, - "body" => response_body - }.to_json - response.status.should == 404 - ActiveSupport::JSON.decode(response.body)["errors"].should == ["Could not find request 123459876"] - end + it 'should honour the since_event_id parameter' do + get :body_request_events, + :id => public_bodies(:geraldine_public_body).id, + :k => public_bodies(:geraldine_public_body).api_key, + :feed_type => 'json' + + response.should be_success + first_event = assigns[:event_data][0] + second_event_id = assigns[:event_data][1][:event_id] + + get :body_request_events, + :id => public_bodies(:geraldine_public_body).id, + :k => public_bodies(:geraldine_public_body).api_key, + :feed_type => 'json', + :since_event_id => second_event_id + response.should be_success + assigns[:event_data].should == [first_event] + end - it "should return a JSON 500 error if we try to add correspondence to a request we don't own" do - request_id = info_requests(:naughty_chicken_request).id - sent_at = "2012-05-28T12:35:39+01:00" - response_body = "Thank you for your request for information, which we are handling in accordance with the Freedom of Information Act 2000. You will receive a response within 20 working days or before the next full moon, whichever is sooner.\n\nYours sincerely,\nJohn Gandermulch,\nExample Council FOI Officer\n" - post :add_correspondence, - :k => public_bodies(:geraldine_public_body).api_key, - :id => request_id, - :correspondence_json => { - "direction" => "response", - "sent_at" => sent_at, - "body" => response_body - }.to_json - response.status.should == 500 - ActiveSupport::JSON.decode(response.body)["errors"].should == ["Request #{request_id} cannot be updated using the API"] + it 'should honour the since_date parameter for the Atom feed' do + get :body_request_events, + :id => public_bodies(:humpadink_public_body).id, + :k => public_bodies(:humpadink_public_body).api_key, + :since_date => '2010-01-01', + :feed_type => 'atom' + + response.should be_success + response.should render_template('api/request_events') + assigns[:events].size.should > 0 + assigns[:events].each do |event| + event.created_at.should >= Date.new(2010, 1, 1) + end + end end end |