@@ -, +, @@ --- api/v1/swagger/x-primitives.json | 3 +- t/db_dependent/api/v1/cities.t | 69 ++++++++++++++++++++++++++++++++-------- 2 files changed, 58 insertions(+), 14 deletions(-) --- a/api/v1/swagger/x-primitives.json +++ a/api/v1/swagger/x-primitives.json @@ -17,7 +17,8 @@ }, "cityid": { "type": "string", - "description": "internally assigned city identifier" + "description": "internally assigned city identifier", + "readOnly": true }, "email": { "type": ["string", "null"], --- a/t/db_dependent/api/v1/cities.t +++ a/t/db_dependent/api/v1/cities.t @@ -129,7 +129,7 @@ subtest 'get() tests' => sub { subtest 'add() tests' => sub { - plan tests => 11; + plan tests => 17; $schema->storage->txn_begin; @@ -151,17 +151,6 @@ subtest 'add() tests' => sub { $tx->req->env( { REMOTE_ADDR => $remote_address } ); $t->request_ok($tx)->status_is(403); - # Authorized attempt to write - $tx = $t->ua->build_tx( POST => "/api/v1/cities/" => json => $city ); - $tx->req->cookies( - { name => 'CGISESSID', value => $authorized_session_id } ); - $tx->req->env( { REMOTE_ADDR => $remote_address } ); - $t->request_ok($tx)->status_is(200) - ->json_is( '/city_name' => $city->{city_name} ) - ->json_is( '/city_state' => $city->{city_state} ) - ->json_is( '/city_zipcode' => $city->{city_zipcode} ) - ->json_is( '/city_country' => $city->{city_country} ); - # Authorized attempt to write invalid data my $city_with_invalid_field = { city_blah => "City Blah", @@ -184,12 +173,56 @@ subtest 'add() tests' => sub { ] ); + # Authorized attempt to write + $tx = $t->ua->build_tx( POST => "/api/v1/cities/" => json => $city ); + $tx->req->cookies( + { name => 'CGISESSID', value => $authorized_session_id } ); + $tx->req->env( { REMOTE_ADDR => $remote_address } ); + my $cityid = $t->request_ok($tx)->status_is(200) + ->json_is( '/city_name' => $city->{city_name} ) + ->json_is( '/city_state' => $city->{city_state} ) + ->json_is( '/city_zipcode' => $city->{city_zipcode} ) + ->json_is( '/city_country' => $city->{city_country} ) + ->tx->res->json->{cityid}; + + # Authorized attempt to create with null id + $city->{cityid} = undef; + $tx = $t->ua->build_tx( + POST => "/api/v1/cities/" => json => $city ); + $tx->req->cookies( + { name => 'CGISESSID', value => $authorized_session_id } ); + $tx->req->env( { REMOTE_ADDR => $remote_address } ); + $t->request_ok($tx)->status_is(400)->json_is( + "/errors" => [ + { + message => "Read-only.", + path => "/body/cityid" + } + ] + ); + + # Authorized attempt to create with existing id + $city->{cityid} = $cityid; + $tx = $t->ua->build_tx( + POST => "/api/v1/cities/" => json => $city ); + $tx->req->cookies( + { name => 'CGISESSID', value => $authorized_session_id } ); + $tx->req->env( { REMOTE_ADDR => $remote_address } ); + $t->request_ok($tx)->status_is(400)->json_is( + "/errors" => [ + { + message => "Read-only.", + path => "/body/cityid" + } + ] + ); + $schema->storage->txn_rollback; }; subtest 'update() tests' => sub { - plan tests => 13; + plan tests => 15; $schema->storage->txn_begin; @@ -272,6 +305,16 @@ subtest 'update() tests' => sub { $t->request_ok($tx)->status_is(404); $schema->storage->txn_rollback; + + # Wrong mathod (POST) + $city_with_updated_field->{cityid} = 2; + + $tx = $t->ua->build_tx( + POST => "/api/v1/cities/$city_id" => json => $city_with_updated_field ); + $tx->req->cookies( + { name => 'CGISESSID', value => $authorized_session_id } ); + $tx->req->env( { REMOTE_ADDR => $remote_address } ); + $t->request_ok($tx)->status_is(404); }; subtest 'delete() tests' => sub { --