diff --git a/spec/integration/api_defender_spec.rb b/spec/integration/api_defender_spec.rb index 40f48e368..f603e10f4 100644 --- a/spec/integration/api_defender_spec.rb +++ b/spec/integration/api_defender_spec.rb @@ -10,6 +10,11 @@ describe ApiDefender do ActionController::HttpAuthentication::Basic.encode_credentials u, pass end + def get_request auth_user = nil, by_token = false + auth = auth_user ? {'HTTP_AUTHORIZATION' => get_basic_auth(auth_user, by_token)} : {} + get "/api/v1/users/#{@user.id}.json", {}, auth + end + before do stub_symlink_methods && stub_redis @redis = Redis.new @@ -29,61 +34,59 @@ describe ApiDefender do context 'for anonymous user' do it "should return the total limit" do - get "/api/v1/users/#{@user.id}.json" + get_request response.headers['X-RateLimit-Limit'].should == @rate_limit.to_s end it "should return the correct limit usage for anonymous user" do - get "/api/v1/users/#{@user.id}.json" + get_request response.headers['X-RateLimit-Remaining'].should == (@rate_limit-1).to_s end it "should return the correct limit usage for anonymous user after authenticated access" do - get("/api/v1/users/#{@user.id}.json", {}, {'HTTP_AUTHORIZATION' => get_basic_auth}) - get "/api/v1/users/#{@user.id}.json" + get_request @user + get_request response.headers['X-RateLimit-Remaining'].should == (@rate_limit-2).to_s end it "should forbidden anonymous user after exceeding limit rate" do - (@rate_limit+1).times {get "/api/v1/users/#{@user.id}.json"} + (@rate_limit+1).times {get_request} response.status.should == 403 end end context 'for user' do it "should return the correct limit usage for auth user" do - get("/api/v1/users/#{@user.id}.json", {'HTTP_AUTHORIZATION' => get_basic_auth}) + get_request @user response.headers['X-RateLimit-Remaining'].should == (@rate_limit-1).to_s end it "should return the correct limit usage for auth user after anonymous access" do - get "/api/v1/users/#{@user.id}.json" - get("/api/v1/users/#{@user.id}.json", {}, {'HTTP_AUTHORIZATION' => get_basic_auth}) + get_request + get_request @user response.headers['X-RateLimit-Remaining'].should == (@rate_limit-1).to_s end it "should forbidden user after exceeding limit rate" do - (@rate_limit+1).times {get "/api/v1/users/#{@user.id}.json", {}, {'HTTP_AUTHORIZATION' => get_basic_auth}} + (@rate_limit+1).times {get_request @user} response.status.should == 403 end it "should not forbidden user after exceeding limit rate of the anonymous" do - (@rate_limit+1).times {get "/api/v1/users/#{@user.id}.json"} - get("/api/v1/users/#{@user.id}.json", {}, {'HTTP_AUTHORIZATION' => get_basic_auth}) + (@rate_limit+1).times {get_request} + get_request @user response.status.should == 200 end end context 'for system user' do it "should not return the limit usage for system user" do - get("/api/v1/users/#{@user.id}.json", {}, {'HTTP_AUTHORIZATION' => get_basic_auth(@system_user, true)}) + get_request @system_user, true response.headers['X-RateLimit-Limit'].should_not == @rate_limit.to_s end it "should not forbidden system user" do - (@rate_limit+1).times do - get "/api/v1/users/#{@user.id}.json", {}, {'HTTP_AUTHORIZATION' => get_basic_auth(@system_user, true)} - end + (@rate_limit+1).times {get_request @system_user, true} response.status.should == 200 end end