<commit_before>require 'spec_helper'
require 'cancan/matchers'

describe Ability do
  describe "::Site Admins" do
    it "should be able to manage every object" do
      ability = Ability.new(Factory(:user, :access_level => "admin"))
      [ User, Ling, Property, Category, LingsProperty, Example, Group, Membership ].each do |klass|
        ability.should be_able_to(:manage, klass )
      end
    end
  end

  describe "::Visitors" do
    before { @visitor = Ability.new(nil) }

    it "should be able to register as a new user" do
      @visitor.should be_able_to(:create, User)
    end

    it "should not be able to see users" do
      @visitor.should_not be_able_to(:read, User)
    end

    it "should not be able to see private groups and their data" do
      @group = Factory(:group, :name => "privy", :privacy => "private")
      @visitor.should_not be_able_to(:read, @group)
      [ :ling, :category ].each do |model|
        @visitor.should_not be_able_to(:read, Factory(model, :group => @group))
      end
    end

    it "should be able to view public groups and their data" do
      @group = Factory(:group, :name => "pubs", :privacy => "public")
      @visitor.should be_able_to(:read, @group)
      @visitor.should be_able_to(:read, Factory(:ling, :group => @group))
      @visitor.should be_able_to(:read, Factory(:category, :group => @group))
    end
  end

  describe "::Logged in Users" do
    before do
      @user = Factory(:user, :name => "bob", :access_level => "user")
      @logged = Ability.new(@user)
    end

    it "should be able to manage themselves" do
      @logged.should be_able_to(:manage, @user)
    end

    it "should not be able to manage other users" do
      @logged.should_not be_able_to(:manage, Factory(:user, :name => "otherguy", :email => "<EMAIL>"))
    end
  end

  describe "::Group Admins" do
    it "should be able to manage their group and all data within it" do
      @group = Factory(:group)
      user   = Factory(:user)
      @admin = Ability.new(user)
      Membership.create(:group => @group, :user => user, :level => "admin")

      @admin.should be_able_to(:manage, @group)
      [ Ling, Property, Category, LingsProperty, Example, Membership ].each do |klass|
        @admin.should be_able_to(:manage, klass)
      end
    end

    describe "should not be able to" do
      before do
        group  = Factory(:group)
        user   = Factory(:user)
        @admin = Ability.new(user)
        Membership.create(:group => group, :user => user, :level => "admin")
        @other_group = Factory(:group, :name => "haters", :privacy => "private")
      end

      [ :read, :update, :create, :destroy ].each do |action|
        it ":{action} other groups" do
          @admin.should_not be_able_to(action, @other_group)
        end

        [ Ling, Property, Category, LingsProperty, Example, Membership ].each do |klass|
          it "perform :#{action} on #{klass.to_s.capitalize}" do
            @admin.should be_able_to(action, klass)
          end
        end
      end
    end
  end

  describe "::Group Members" do
    before do
      @group  = Factory(:group)
      user    = Factory(:user)
      @member = Ability.new(user)
      @membership = Membership.create(:group => @group, :user => user, :level => "member")
    end

    it "should be able to manage examples, LPVs, ELPVs in their groups" do
      [ LingsProperty, Example ].each { |klass| @member.should be_able_to(:manage, klass) }
    end

    it "should only be able to read the group and its lings, properties, categories" do
      [ Ling, Property, Category ].each do     |klass|
        @member.should      be_able_to(:read,   klass)
        @member.should_not  be_able_to(:create, klass)
        @member.should_not  be_able_to(:update, klass)
        @member.should_not  be_able_to(:delete, klass)
      end
    end

    it "should only be able to read and delete their own memberships" do
      @member.should      be_able_to(:delete, @membership)
      @member.should      be_able_to(:read,   @membership)
      @member.should_not  be_able_to(:create,  Membership)
      @member.should_not  be_able_to(:update, @membership)
    end
  end

  describe "::Non-Groupmembers" do
    before { @nonmember = Ability.new(Factory(:user)) }

    it "should only be able to read public group data" do
      [ lings(            :level0    ),
        properties(       :level0    ),
        categories(       :inclusive0),
        examples(         :inclusive ),
        lings_properties( :inclusive )
      ].each do |data|
        @nonmember.should     be_able_to(:read,   data)
        @nonmember.should_not be_able_to(:update, data)
        @nonmember.should_not be_able_to(:delete, data)
      end
    end

    [ :read, :update, :delete ].each do |action|<commit_msg>added public group tests, added notes to places that the specs are by definition wrong (they need to scope to group still)<commit_after>require 'spec_helper'
require 'cancan/matchers'

describe Ability do
  describe "::Site Admins" do
    it "should be able to manage every object" do
      ability = Ability.new(Factory(:user, :access_level => "admin"))
      [ User, Ling, Property, Category, LingsProperty, Example, Group, Membership ].each do |klass|
        ability.should be_able_to(:manage, klass )
      end
    end
  end

  describe "::Visitors" do
    before { @visitor = Ability.new(nil) }

    it "should be able to register as a new user" do
      @visitor.should be_able_to(:create, User)
    end

    it "should not be able to see users" do
      @visitor.should_not be_able_to(:read, User)
    end

    it "should not be able to see private groups and their data" do
      @group = Factory(:group, :name => "privy", :privacy => "private")
      @visitor.should_not be_able_to(:read, @group)
      [ :ling, :category ].each do |model|
        @visitor.should_not be_able_to(:read, Factory(model, :group => @group))
      end
    end

    it "should be able to view public groups and their data" do
      @group = Factory(:group, :name => "pubs", :privacy => "public")
      @visitor.should be_able_to(:read, @group)
      @visitor.should be_able_to(:read, Factory(:ling, :group => @group))
      @visitor.should be_able_to(:read, Factory(:category, :group => @group))
    end
  end

  describe "::Logged in Users" do
    before do
      @user = Factory(:user, :name => "bob", :access_level => "user")
      @logged = Ability.new(@user)
    end

    it "should be able to manage themselves" do
      @logged.should be_able_to(:manage, @user)
    end

    it "should not be able to manage other users" do
      @logged.should_not be_able_to(:manage, Factory(:user, :name => "otherguy", :email => "<EMAIL>"))
    end
  end

  describe "::Group Admins" do
    describe "on their own group" do
      before do
        @group = Factory(:group)
        user   = Factory(:user)
        @admin = Ability.new(user)
        Membership.create(:group => @group, :user => user, :level => "admin")
      end

      it "should be able to manage it" do
        @admin.should be_able_to(:manage, @group)
      end

      [ Ling, Property, Category, LingsProperty, Example, Membership ].each do |klass|
        it "should be able to manage the group's #{klass.to_s.pluralize}" do
          @admin.should be_able_to(:manage, klass) #TODO this doesnt specify anything scoping management to the group, how can this work?
        end
      end
    end

    describe "looking at another public group" do #TODO this one doesnt scope down either. what gives?
      before do
        group  = Factory(:group)
        user   = Factory(:user)
        @admin = Ability.new(user)
        Membership.create(:group => group, :user => user, :level => "admin")
        @other_group = Factory(:group, :name => "openness", :privacy => "public")
      end

      it "should not be able to read the group" do
        @admin.should be_able_to(:read, @other_group)
      end

      [ Ling, Property, Category, LingsProperty, Example, Membership ].each do |klass|
        it "should be able to read the group's #{klass.to_s.capitalize.pluralize}" do
          @admin.should be_able_to(:read, klass)
        end
      end

      [:update, :create, :destroy ].each do |action|
        it "should not be able to :{action} them" do
          @admin.should_not be_able_to(action, @other_group)
        end

        [ Ling, Property, Category, LingsProperty, Example, Membership ].each do |klass|
          it "should not be able to perform :#{action} on #{klass.to_s.capitalize}" do
            @admin.should_not be_able_to(action, klass)
          end
        end
      end
    end

    describe "looking at another private group" do #TODO this one doesnt scope down either. what gives?
      before do
        group  = Factory(:group)
        user   = Factory(:user)
        @admin = Ability.new(user)
        Membership.create(:group => group, :user => user, :level => "admin")
        @other_group = Factory(:group, :name => "haters", :privacy => "private")
      end

      [ :read, :update, :create, :destroy ].each do |action|
        it "should not be able to :{action} them" do
          @admin.should_not be_able_to(action, @other_group)
        end

        [ Ling, Property, Category, LingsProperty, Example, Membership ].each do |klass|
          it "should not be able to perform :#{action} on #{klass.to_s.capitalize}" do
            @admin.should_not be_able_to(action, klass)
          end
        end
      end
    end
  end

  describe "::Group Members" do
    before do
      @group  = Factory(:group)
      user    = Factory(:user)
      @member = Ability.new(user)
      @membership = Membership.create(:group => @group, :user => user, :level => "member")
    end

    it "should be able to manage examples, LPVs, ELPVs in their groups" do
      [ LingsProperty, Example ].each { |klass| @member.should be_able_to(:manage, klass) }
    end

    it "should only be able to read the group and its lings, properties, categories" do
      [ Ling, Property, Category ].each do     |klass| #TODO notice that these classes are all not scoped to the group
        @member.should      be_able_to(:read,   klass)
        @member.should_not  be_able_to(:create, klass)
        @member.should_not  be_able_to(:update, klass)
        @member.should_not  be_able_to(:delete, klass)
      end
    end

    it "should only be able to read and delete their own memberships" do
      @member.should      be_able_to(:delete, @membership)
      @member.should      be_able_to(:read,   @membership)
      @member.should_not  be_able_to(:create,  Membership) #TODO needs to specify creating memberships misgrouped
      @member.should_not  be_able_to(:update, @membership)
    end
  end

  describe "::Non-Groupmembers" do
    before { @nonmember = Ability.new(Factory(:user)) }

    it "should only be able to read public group data" do
      [ lings(            :level0    ),
        properties(       :level0    ),
        categories(       :inclusive0),
        examples(         :inclusive ),
        lings_properties( :inclusive )
      ].each do |data|
        @nonmember.should     be_able_to(:read,   data)
        @nonmember.should_not be_able_to(:update, data)
        @nonmember.should_not be_able_to(:delete, data)
      end
    end

    [ :read, :update, :delete ].each do |action|
{'fraction_non_alphanumeric': 0.11527961250550418, 'fraction_numerical': 0.0005284015852047556, 'mean_word_length': 2.6691437802907916, 'pattern_counts': {'":': 13, '<': 5, '<?xml version=': 0, '>': 56, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5802761', 'n_tokens_mistral': 3568, 'n_tokens_neox': 3514, 'n_words': 1113}