FEATURE: Public groups.

spec/integration/groups_spec.rb

@@ -2,6 +2,7 @@ require 'rails_helper'
 
 describe "Groups" do
   let(:user) { Fabricate(:user) }
+  let(:group) { Fabricate(:group, users: [user]) }
 
   def sign_in(user)
     password = 'somecomplicatedpassword'
@@ -12,11 +13,9 @@ describe "Groups" do
   end
 
   describe "checking if a group can be mentioned" do
-    let(:group) { Fabricate(:group, name: 'test', users: [user]) }
-
     it "should return the right response" do
       sign_in(user)
-      group
+      group.update_attributes!(name: 'test')
 
       get "/groups/test/mentionable.json", { name: group.name }
 
@@ -36,7 +35,11 @@ describe "Groups" do
   end
 
   describe "group can be updated" do
-    let(:group) { Fabricate(:group, name: 'test', users: [user]) }
+    let(:group) { Fabricate(:group, name: 'test', users: [user], public: false) }
+
+    before do
+      sign_in(user)
+    end
 
     context "when user is group owner" do
       before do
@@ -50,7 +53,8 @@ describe "Groups" do
           flair_color: 'BBB',
           flair_url: 'fa-adjust',
           bio_raw: 'testing',
-          title: 'awesome team'
+          title: 'awesome team',
+          public: true
         } }
 
         expect(response).to be_success
@@ -62,6 +66,7 @@ describe "Groups" do
         expect(group.flair_url).to eq('fa-adjust')
         expect(group.bio_raw).to eq('testing')
         expect(group.title).to eq('awesome team')
+        expect(group.public).to eq(true)
       end
     end
 
@@ -145,4 +150,220 @@ describe "Groups" do
       expect(members.map { |m| m["id"] }).to eq([user1.id, user2.id])
     end
   end
+
+  describe "membership edit permissions" do
+    let(:group) { Fabricate(:group) }
+
+    context 'when user is not signed in' do
+      it 'should be fobidden' do
+        xhr :put, "/groups/#{group.id}/members", usernames: "bob"
+        expect(response).to be_forbidden
+
+        xhr :delete, "/groups/#{group.id}/members", username: "bob"
+        expect(response).to be_forbidden
+      end
+
+      context 'public group' do
+        it 'should be fobidden' do
+          group.update_attributes!(public: true)
+
+          expect { xhr :put, "/groups/#{group.id}/members", usernames: "bob" }
+            .to raise_error(Discourse::NotLoggedIn)
+
+          expect { xhr :delete, "/groups/#{group.id}/members", username: "bob" }
+            .to raise_error(Discourse::NotLoggedIn)
+        end
+      end
+    end
+
+    context 'when user is not an owner of the group' do
+      before do
+        sign_in(user)
+      end
+
+      it "refuses membership changes to unauthorized users" do
+        xhr :put, "/groups/#{group.id}/members", usernames: "bob"
+        expect(response).to be_forbidden
+
+        xhr :delete, "/groups/#{group.id}/members", username: "bob"
+        expect(response).to be_forbidden
+      end
+    end
+
+    context 'when user is an admin' do
+      let(:user) { Fabricate(:admin) }
+      let(:group) { Fabricate(:group, users: [user], automatic: true) }
+
+      before do
+        sign_in(user)
+      end
+
+      it "cannot add members to automatic groups" do
+        xhr :put, "/groups/#{group.id}/members", usernames: "bob"
+        expect(response).to be_forbidden
+
+        xhr :delete, "/groups/#{group.id}/members", username: "bob"
+        expect(response).to be_forbidden
+      end
+    end
+  end
+
+  describe "membership edits" do
+    let(:admin) { Fabricate(:admin) }
+
+    before do
+      sign_in(admin)
+    end
+
+    context 'adding members' do
+      it "can make incremental adds" do
+        user2 = Fabricate(:user)
+        expect(group.users.count).to eq(1)
+
+        xhr :put, "/groups/#{group.id}/members", usernames: user2.username
+
+        expect(response).to be_success
+        expect(group.reload.users.count).to eq(2)
+      end
+
+      it "can make incremental deletes" do
+        expect(group.users.count).to eq(1)
+
+        xhr :delete, "/groups/#{group.id}/members", username: user.username
+
+        expect(response).to be_success
+        expect(group.reload.users.count).to eq(0)
+      end
+
+      it "cannot add members to automatic groups" do
+        group.update!(automatic: true)
+
+        xhr :put, "/groups/#{group.id}/members", usernames: "l77t"
+        expect(response.status).to eq(403)
+      end
+
+      context "is able to add several members to a group" do
+        let(:user1) { Fabricate(:user) }
+        let(:user2) { Fabricate(:user) }
+
+        it "adds by username" do
+          expect { xhr :put, "/groups/#{group.id}/members", usernames: [user1.username, user2.username].join(",") }
+            .to change { group.users.count }.by(2)
+
+          expect(response).to be_success
+        end
+
+        it "adds by id" do
+          expect { xhr :put, "/groups/#{group.id}/members", user_ids: [user1.id, user2.id].join(",") }
+            .to change { group.users.count }.by(2)
+
+          expect(response).to be_success
+        end
+      end
+
+      it "returns 422 if member already exists" do
+        xhr :put, "/groups/#{group.id}/members", usernames: user.username
+
+        expect(response.status).to eq(422)
+      end
+
+      it "returns 404 if member is not found" do
+        xhr :put, "/groups/#{group.id}/members", usernames: 'some donkey'
+
+        expect(response.status).to eq(404)
+      end
+
+      context 'public group' do
+        let(:other_user) { Fabricate(:user) }
+
+        before do
+          group.update!(public: true)
+        end
+
+        it 'should allow a user to join the group' do
+          sign_in(other_user)
+
+          expect { xhr :put, "/groups/#{group.id}/members", usernames: other_user.username }
+            .to change { group.users.count }.by(1)
+
+          expect(response).to be_success
+        end
+
+        it 'should not allow a user to add another user to a group' do
+          xhr :put, "/groups/#{group.id}/members", usernames: other_user.username
+
+          expect(response).to be_forbidden
+        end
+      end
+    end
+
+    context 'removing members' do
+      it "cannot remove members from automatic groups" do
+        group.update!(automatic: true)
+
+        xhr :delete, "/groups/#{group.id}/members", user_id: 42
+        expect(response.status).to eq(403)
+      end
+
+      it "raises an error if user to be removed is not found" do
+        xhr :delete, "/groups/#{group.id}/members", user_id: -10
+        expect(response.status).to eq(404)
+      end
+
+      context "is able to remove a member" do
+        it "removes by id" do
+          expect { xhr :delete, "/groups/#{group.id}/members", user_id: user.id }
+            .to change { group.users.count }.by(-1)
+
+          expect(response).to be_success
+        end
+
+        it "removes by username" do
+          expect { xhr :delete, "/groups/#{group.id}/members", username: user.username }
+            .to change { group.users.count }.by(-1)
+
+          expect(response).to be_success
+        end
+
+        it "removes user.primary_group_id when user is removed from group" do
+          user.update!(primary_group_id: group.id)
+
+          xhr :delete, "/groups/#{group.id}/members", user_id: user.id
+
+          expect(user.reload.primary_group_id).to eq(nil)
+        end
+
+        it "removes by user_email" do
+          expect { xhr :delete, "/groups/#{group.id}/members", user_email: user.email }
+            .to change { group.users.count }.by(-1)
+
+          expect(response).to be_success
+        end
+
+        context 'public group' do
+          let(:other_user) { Fabricate(:user) }
+          let(:group) { Fabricate(:group, users: [other_user]) }
+
+          before do
+            group.update!(public: true)
+          end
+
+          it 'should allow a user to leave a group' do
+            sign_in(other_user)
+
+            expect { xhr :delete, "/groups/#{group.id}/members", username: other_user.username }
+              .to change { group.users.count }.by(-1)
+
+            expect(response).to be_success
+          end
+
+          it 'should not allow a user to leave a group for another user' do
+            xhr :delete, "/groups/#{group.id}/members", username: other_user.username
+
+            expect(response).to be_forbidden
+          end
+        end
+      end
+    end
+  end
 end