<commit_before>require 'spec_helper'
require 'spree/testing_support/bar_ability'

module Spree
  describe Api::OrdersController do
    render_views

    let!(:order) { create(:order) }
    let(:variant) { create(:variant) }
    let(:line_item) { create(:line_item) }

    let(:attributes) { [:number, :item_total, :display_total, :total,
                        :state, :adjustment_total,
                        :user_id, :created_at, :updated_at,
                        :completed_at, :payment_total, :shipment_state,
                        :payment_state, :email, :special_instructions,
                        :total_quantity, :display_item_total, :currency] }

    let(:address_params) { { :country_id => Country.first.id, :state_id => State.first.id } }

    let(:billing_address) { { :firstname => "Tiago", :lastname => "Motta", :address1 => "Av Paulista",
                              :city => "Sao Paulo", :zipcode => "1234567", :phone => "12345678",
                              :country_id => Country.first.id, :state_id => State.first.id} }

    let(:shipping_address) { { :firstname => "Tiago", :lastname => "Motta", :address1 => "Av Paulista",
                               :city => "Sao Paulo", :zipcode => "1234567", :phone => "12345678",
                               :country_id => Country.first.id, :state_id => State.first.id} }

    let(:current_api_user) do
      user = Spree.user_class.new(:email => "<EMAIL>")
      user.generate_spree_api_key!
      user
    end

    before do
      stub_authentication!
    end

    it "cannot view all orders" do
      api_get :index
      assert_unauthorized!
    end

    context "the current api user is not persisted" do
      let(:current_api_user) { double(persisted?: false) }

      it "returns a 401" do
        api_get :mine

        response.status.should == 401
      end
    end

    context "the current api user is authenticated" do
      let(:current_api_user) { order.user }
      let(:order) { create(:order, line_items: [line_item]) }

      it "can view all of their own orders" do
        api_get :mine

        response.status.should == 200
        json_response["pages"].should == 1
        json_response["current_page"].should == 1
        json_response["orders"].length.should == 1
        json_response["orders"].first["number"].should == order.number
        json_response["orders"].first["line_items"].length.should == 1
        json_response["orders"].first["line_items"].first["id"].should == line_item.id
      end

      it "can filter the returned results" do
        api_get :mine, q: {completed_at_not_null: 1}

        response.status.should == 200
        json_response["orders"].length.should == 0
      end
    end

    it "can view their own order" do
      Order.any_instance.stub :user => current_api_user
      api_get :show, :id => order.to_param
      response.status.should == 200
      json_response.should have_attributes(attributes)
      json_response["adjustments"].should be_empty
    end

    it "orders contain the basic checkout steps" do
      Order.any_instance.stub :user => current_api_user
      api_get :show, :id => order.to_param
      response.status.should == 200
      json_response["checkout_steps"].should == ["address", "delivery", "complete"]
    end

    # Regression test for #1992
    it "can view an order not in a standard state" do
      Order.any_instance.stub :user => current_api_user
      order.update_column(:state, 'shipped')
      api_get :show, :id => order.to_param
    end

    it "can not view someone else's order" do
      Order.any_instance.stub :user => stub_model(Spree::LegacyUser)
      api_get :show, :id => order.to_param
      assert_unauthorized!
    end

    it "can view an order if the token is known" do
      api_get :show, :id => order.to_param, :order_token => order.token
      response.status.should == 200
    end

    it "can view an order if the token is passed in header" do
      request.headers["X-Spree-Order-Token"] = order.token
      api_get :show, :id => order.to_param
      response.status.should == 200
    end

    context "with BarAbility registered" do
      before { Spree::Ability.register_ability(::BarAbility) }
      after { Spree::Ability.remove_ability(::BarAbility) }

      it "can view an order" do
        user = mock_model(Spree::LegacyUser)
        user.should_receive(:has_spree_role?).with('bar').and_return(true)
        user.should_receive(:has_spree_role?).with('admin').and_return(false)
        controller.stub try_spree_current_user: user
        api_get :show, :id => order.to_param
        response.status.should == 200
      end
    end

    it "cannot cancel an order that doesn't belong to them" do<commit_msg>[api] Use stub instead of should_receive for has_spree_role? calls<commit_after>require 'spec_helper'
require 'spree/testing_support/bar_ability'

module Spree
  describe Api::OrdersController do
    render_views

    let!(:order) { create(:order) }
    let(:variant) { create(:variant) }
    let(:line_item) { create(:line_item) }

    let(:attributes) { [:number, :item_total, :display_total, :total,
                        :state, :adjustment_total,
                        :user_id, :created_at, :updated_at,
                        :completed_at, :payment_total, :shipment_state,
                        :payment_state, :email, :special_instructions,
                        :total_quantity, :display_item_total, :currency] }

    let(:address_params) { { :country_id => Country.first.id, :state_id => State.first.id } }

    let(:billing_address) { { :firstname => "Tiago", :lastname => "Motta", :address1 => "Av Paulista",
                              :city => "Sao Paulo", :zipcode => "1234567", :phone => "12345678",
                              :country_id => Country.first.id, :state_id => State.first.id} }

    let(:shipping_address) { { :firstname => "Tiago", :lastname => "Motta", :address1 => "Av Paulista",
                               :city => "Sao Paulo", :zipcode => "1234567", :phone => "12345678",
                               :country_id => Country.first.id, :state_id => State.first.id} }

    let(:current_api_user) do
      user = Spree.user_class.new(:email => "<EMAIL>")
      user.generate_spree_api_key!
      user
    end

    before do
      stub_authentication!
    end

    it "cannot view all orders" do
      api_get :index
      assert_unauthorized!
    end

    context "the current api user is not persisted" do
      let(:current_api_user) { double(persisted?: false) }

      it "returns a 401" do
        api_get :mine

        response.status.should == 401
      end
    end

    context "the current api user is authenticated" do
      let(:current_api_user) { order.user }
      let(:order) { create(:order, line_items: [line_item]) }

      it "can view all of their own orders" do
        api_get :mine

        response.status.should == 200
        json_response["pages"].should == 1
        json_response["current_page"].should == 1
        json_response["orders"].length.should == 1
        json_response["orders"].first["number"].should == order.number
        json_response["orders"].first["line_items"].length.should == 1
        json_response["orders"].first["line_items"].first["id"].should == line_item.id
      end

      it "can filter the returned results" do
        api_get :mine, q: {completed_at_not_null: 1}

        response.status.should == 200
        json_response["orders"].length.should == 0
      end
    end

    it "can view their own order" do
      Order.any_instance.stub :user => current_api_user
      api_get :show, :id => order.to_param
      response.status.should == 200
      json_response.should have_attributes(attributes)
      json_response["adjustments"].should be_empty
    end

    it "orders contain the basic checkout steps" do
      Order.any_instance.stub :user => current_api_user
      api_get :show, :id => order.to_param
      response.status.should == 200
      json_response["checkout_steps"].should == ["address", "delivery", "complete"]
    end

    # Regression test for #1992
    it "can view an order not in a standard state" do
      Order.any_instance.stub :user => current_api_user
      order.update_column(:state, 'shipped')
      api_get :show, :id => order.to_param
    end

    it "can not view someone else's order" do
      Order.any_instance.stub :user => stub_model(Spree::LegacyUser)
      api_get :show, :id => order.to_param
      assert_unauthorized!
    end

    it "can view an order if the token is known" do
      api_get :show, :id => order.to_param, :order_token => order.token
      response.status.should == 200
    end

    it "can view an order if the token is passed in header" do
      request.headers["X-Spree-Order-Token"] = order.token
      api_get :show, :id => order.to_param
      response.status.should == 200
    end

    context "with BarAbility registered" do
      before { Spree::Ability.register_ability(::BarAbility) }
      after { Spree::Ability.remove_ability(::BarAbility) }

      it "can view an order" do
        user = mock_model(Spree::LegacyUser)
        user.stub(:has_spree_role?).with('bar').and_return(true)
        user.stub(:has_spree_role?).with('admin').and_return(false)
        controller.stub try_spree_current_user: user
        api_get :show, :id => order.to_param
        response.status.should == 200
      end
    end

    it "cannot cancel an order that doesn't belong to them" do
{'fraction_non_alphanumeric': 0.11916552523443262, 'fraction_numerical': 0.014540090612158888, 'mean_word_length': 2.629827915869981, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 67, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2977719', 'n_tokens_mistral': 3008, 'n_tokens_neox': 2821, 'n_words': 709}