forked from thoughtbot/shoulda-matchers
-
Notifications
You must be signed in to change notification settings - Fork 0
/
permit_matcher.rb
441 lines (389 loc) · 13 KB
/
permit_matcher.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
require 'delegate'
begin
require 'strong_parameters'
rescue LoadError
end
require 'active_support/hash_with_indifferent_access'
module Shoulda
module Matchers
module ActionController
# The `permit` matcher tests that an action in your controller receives a
# whitelist of parameters using Rails' Strong Parameters feature
# (specifically that `permit` was called with the correct arguments).
#
# Here's an example:
#
# class UsersController < ApplicationController
# def create
# user = User.create(user_params)
# # ...
# end
#
# private
#
# def user_params
# params.require(:user).permit(
# :first_name,
# :last_name,
# :email,
# :password
# )
# end
# end
#
# # RSpec
# describe UsersController do
# it do
# params = {
# user: {
# first_name: 'John',
# last_name: 'Doe',
# email: 'johndoe@example.com',
# password: 'password'
# }
# }
# should permit(:first_name, :last_name, :email, :password).
# for(:create, params: params).
# on(:user)
# end
# end
#
# # Minitest (Shoulda)
# class UsersControllerTest < ActionController::TestCase
# should "(for POST #create) restrict parameters on :user to first_name, last_name, email, and password" do
# params = {
# user: {
# first_name: 'John',
# last_name: 'Doe',
# email: 'johndoe@example.com',
# password: 'password'
# }
# }
# matcher = permit(:first_name, :last_name, :email, :password).
# for(:create, params: params).
# on(:user)
# assert_accepts matcher, subject
# end
# end
#
# If your action requires query parameters in order to work, then you'll
# need to supply them:
#
# class UsersController < ApplicationController
# def update
# user = User.find(params[:id])
#
# if user.update_attributes(user_params)
# # ...
# else
# # ...
# end
# end
#
# private
#
# def user_params
# params.require(:user).permit(
# :first_name,
# :last_name,
# :email,
# :password
# )
# end
# end
#
# # RSpec
# describe UsersController do
# before do
# create(:user, id: 1)
# end
#
# it do
# params = {
# id: 1,
# user: {
# first_name: 'Jon',
# last_name: 'Doe',
# email: 'jondoe@example.com',
# password: 'password'
# }
# }
# should permit(:first_name, :last_name, :email, :password).
# for(:update, params: params).
# on(:user)
# end
# end
#
# # Minitest (Shoulda)
# class UsersControllerTest < ActionController::TestCase
# setup do
# create(:user, id: 1)
# end
#
# should "(for PATCH #update) restrict parameters on :user to :first_name, :last_name, :email, and :password" do
# params = {
# id: 1,
# user: {
# first_name: 'Jon',
# last_name: 'Doe',
# email: 'jondoe@example.com',
# password: 'password'
# }
# }
# matcher = permit(:first_name, :last_name, :email, :password).
# for(:update, params: params).
# on(:user)
# assert_accepts matcher, subject
# end
# end
#
# Finally, if you have an action that isn't one of the seven resourceful
# actions, then you'll need to provide the HTTP verb that it responds to:
#
# Rails.application.routes.draw do
# resources :users do
# member do
# put :toggle
# end
# end
# end
#
# class UsersController < ApplicationController
# def toggle
# user = User.find(params[:id])
#
# if user.update_attributes(user_params)
# # ...
# else
# # ...
# end
# end
#
# private
#
# def user_params
# params.require(:user).permit(:activated)
# end
# end
#
# # RSpec
# describe UsersController do
# before do
# create(:user, id: 1)
# end
#
# it do
# params = { id: 1, user: { activated: true } }
# should permit(:activated).
# for(:toggle, params: params, verb: :put).
# on(:user)
# end
# end
#
# # Minitest (Shoulda)
# class UsersControllerTest < ActionController::TestCase
# setup do
# create(:user, id: 1)
# end
#
# should "(for PUT #toggle) restrict parameters on :user to :activated" do
# params = { id: 1, user: { activated: true } }
# matcher = permit(:activated).
# for(:toggle, params: params, verb: :put).
# on(:user)
# assert_accepts matcher, subject
# end
# end
#
# @return [PermitMatcher]
#
def permit(*params)
PermitMatcher.new(params).in_context(self)
end
# @private
class PermitMatcher
attr_writer :stubbed_params
def initialize(expected_permitted_parameter_names)
@expected_permitted_parameter_names = expected_permitted_parameter_names
@action = nil
@verb = nil
@request_params = {}
@subparameter_name = nil
@parameters_double_registry = CompositeParametersDoubleRegistry.new
end
def for(action, options = {})
@action = action
@verb = options.fetch(:verb, default_verb)
@request_params = options.fetch(:params, {})
self
end
def add_params(params)
request_params.merge!(params)
self
end
def on(subparameter_name)
@subparameter_name = subparameter_name
self
end
def in_context(context)
@context = context
self
end
def description
"(for #{verb.upcase} ##{action}) " + expectation
end
def matches?(controller)
@controller = controller
ensure_action_and_verb_present!
parameters_double_registry.register
Doublespeak.with_doubles_activated do
context.__send__(verb, action, request_params)
end
unpermitted_parameter_names.empty?
end
def failure_message
"Expected #{verb.upcase} ##{action} to #{expectation},\nbut #{reality}."
end
def failure_message_when_negated
"Expected #{verb.upcase} ##{action} not to #{expectation},\nbut it did."
end
protected
attr_reader :controller, :double_collections_by_parameter_name, :action, :verb,
:request_params, :expected_permitted_parameter_names, :context, :subparameter_name,
:parameters_double_registry
def expectation
message = 'restrict parameters '
if subparameter_name
message << "on #{subparameter_name.inspect} "
end
message << 'to ' + format_parameter_names(expected_permitted_parameter_names)
message
end
def reality
if actual_permitted_parameter_names.empty?
'it did not restrict any parameters'
else
'the restricted parameters were ' +
format_parameter_names(actual_permitted_parameter_names) +
' instead'
end
end
def format_parameter_names(parameter_names)
parameter_names.map(&:inspect).to_sentence
end
def actual_permitted_parameter_names
@_actual_permitted_parameter_names ||= begin
if subparameter_name
options = { for: subparameter_name }
else
options = {}
end
parameters_double_registry.permitted_parameter_names(options)
end
end
def unpermitted_parameter_names
expected_permitted_parameter_names - actual_permitted_parameter_names
end
def ensure_action_and_verb_present!
if action.blank?
raise ActionNotDefinedError
end
if verb.blank?
raise VerbNotDefinedError
end
end
def default_verb
case action
when :create then :post
when :update then RailsShim.verb_for_update
end
end
def parameter_names_as_sentence
expected_permitted_parameter_names.map(&:inspect).to_sentence
end
# @private
class CompositeParametersDoubleRegistry
def initialize
@parameters_double_registries_by_params = {}
end
def register
double_collection = Doublespeak.double_collection_for(
::ActionController::Parameters.singleton_class
)
double_collection.register_proxy(:new).to_return do |call|
params = call.return_value
parameters_double_registry = ParametersDoubleRegistry.new(params)
parameters_double_registry.register
parameters_double_registries_by_params[params] =
parameters_double_registry
end
end
def permitted_parameter_names(options = {})
parameters_double_registries_by_params.flat_map do |params, double_registry|
double_registry.permitted_parameter_names(options)
end
end
protected
attr_reader :parameters_double_registries_by_params
end
# @private
class ParametersDoubleRegistry
TOP_LEVEL = Object.new
def self.permitted_parameter_names_within(double_collection)
double_collection.calls_to(:permit).map(&:args).flatten
end
def initialize(params)
@params = params
@double_collections_by_parameter_name = {}
end
def register
register_double_for_permit_against(params, TOP_LEVEL)
end
def permitted_parameter_names(args = {})
subparameter_name = args.fetch(:for, TOP_LEVEL)
if double_collections_by_parameter_name.key?(subparameter_name)
self.class.permitted_parameter_names_within(
double_collections_by_parameter_name[subparameter_name]
)
else
[]
end
end
protected
attr_reader :params, :double_collections_by_parameter_name
private
def register_double_for_permit_against(params, subparameter_name)
klass = params.singleton_class
double_collection = Doublespeak.double_collection_for(klass)
register_double_for_permit_on(double_collection)
register_double_for_require_on(double_collection)
double_collections_by_parameter_name[subparameter_name] =
double_collection
end
def register_double_for_permit_on(double_collection)
double_collection.register_proxy(:permit)
end
def register_double_for_require_on(double_collection)
double_collection.register_proxy(:require).to_return do |call|
params = call.return_value
subparameter_name = call.args.first
register_double_for_permit_against(params, subparameter_name)
end
end
end
# @private
class ActionNotDefinedError < StandardError
def message
'You must specify the controller action using the #for method.'
end
end
# @private
class VerbNotDefinedError < StandardError
def message
'You must specify an HTTP verb when using a non-RESTful action. For example: for(:authorize, verb: :post)'
end
end
end
end
end
end