<commit_before>"use strict";

var should = require('should');
var request = require('supertest');
var async = require('async');
var mongoose = require ('mongoose');
var ObjectId = mongoose.Types.ObjectId;

var app = require('../app.js');
var helpers = require('./helpers.js');
var ImportantDocument = mongoose.model("ImportantDocument");

function createFakeImportantDocument(done) {
  request(app)
    .post('/events/test/importants/' + helpers.MOCK_SERVER_DOC_ID + '?context=test')
    .set('Authorization', 'Bearer ' + helpers.MOCK_SERVER_TOKEN)
    .expect(204)
    .end(done);
}

function deleteImportantDocument(done) {
  request(app)
    .del('/events/test/importants/' + helpers.MOCK_SERVER_DOC_ID)
    .set('Authorization', 'Bearer ' + helpers.MOCK_SERVER_TOKEN)
    .expect(204)
    .end(done);
}


describe("Important documents endpoint", function() {
  beforeEach(helpers.createFakeToken);

  describe("GET /events/:eventId/importants", function() {
    beforeEach(createFakeImportantDocument);

    it("should refuse access if token is missing", helpers.checkForAuth('get', '/events/test/importants'));

    it("should accept queries and return results", function(done) {
      request(app)
        .get('/events/test/importants')
        .set('Authorization', 'Bearer ' + helpers.MOCK_SERVER_TOKEN)
        .expect(200)
        .expect(function assert(res) {
          res.body.should.have.lengthOf(1);
          res.body[0].should.have.property('type', 'file');
          res.body[0].should.have.property('document', helpers.MOCK_SERVER_DOC_ID);
          res.body[0].should.have.property('date', '2014-07-22T10:04:22.441Z');
        })
        .end(done);
    });
  });

  describe("POST /events/:eventId/importants/:id", function() {
    it("should refuse access if token is missing", helpers.checkForAuth('post', '/events/test/importants/' + helpers.MOCK_SERVER_DOC_ID + '?context=test'));

    it("should add successfully in the database the document", function(done) {
      async.waterfall([
        createFakeImportantDocument,
        function queryMongo(res, cb) {<commit_msg>Ensure ACLs are respected for important documents<commit_after>"use strict";

var should = require('should');
var request = require('supertest');
var async = require('async');
var mongoose = require ('mongoose');
var ObjectId = mongoose.Types.ObjectId;

var app = require('../app.js');
var helpers = require('./helpers.js');
var ImportantDocument = mongoose.model("ImportantDocument");
var AccessToken = mongoose.model("AccessToken");

function createFakeImportantDocument(done) {
  request(app)
    .post('/events/test/importants/' + helpers.MOCK_SERVER_DOC_ID + '?context=test')
    .set('Authorization', 'Bearer ' + helpers.MOCK_SERVER_TOKEN)
    .expect(204)
    .end(done);
}

function deleteImportantDocument(done) {
  request(app)
    .del('/events/test/importants/' + helpers.MOCK_SERVER_DOC_ID)
    .set('Authorization', 'Bearer ' + helpers.MOCK_SERVER_TOKEN)
    .expect(204)
    .end(done);
}


describe("Important documents endpoint", function() {
  beforeEach(helpers.createFakeToken);

  describe("GET /events/:eventId/importants", function() {
    beforeEach(createFakeImportantDocument);

    it("should refuse access if token is missing", helpers.checkForAuth('get', '/events/test/importants'));

    it("should accept queries and return results", function(done) {
      request(app)
        .get('/events/test/importants')
        .set('Authorization', 'Bearer ' + helpers.MOCK_SERVER_TOKEN)
        .expect(200)
        .expect(function assert(res) {
          res.body.should.have.lengthOf(1);
          res.body[0].should.have.property('type', 'file');
          res.body[0].should.have.property('document', helpers.MOCK_SERVER_DOC_ID);
          res.body[0].should.have.property('date', '2014-07-22T10:04:22.441Z');
        })
        .end(done);
    });

    it("should not find the documents from another company", function(done) {
      async.waterfall([
        function createWrongToken(cb) {
          var accessToken = new AccessToken({
            token: '<PASSWORD>',
            company: new ObjectId('111111111111111111111111'),
            user: new ObjectId('111111111111111111111111')
          });
          accessToken.save(cb);
        },
        function tryAccess(accessToken, affected, cb) {
          request(app)
            .get('/events/test/importants')
            .set('Authorization', 'Bearer wrongCompany')
            .expect(200)
            .end(cb);
        },
        function assertEmpty(res, cb) {
          res.body.should.have.lengthOf(0);
          cb();
        }
      ], done);
    });
  });

  describe("POST /events/:eventId/importants/:id", function() {
    it("should refuse access if token is missing", helpers.checkForAuth('post', '/events/test/importants/' + helpers.MOCK_SERVER_DOC_ID + '?context=test'));

    it("should add successfully in the database the document", function(done) {
      async.waterfall([
        createFakeImportantDocument,
        function queryMongo(res, cb) {
{'fraction_non_alphanumeric': 0.15005931198102015, 'fraction_numerical': 0.022143139580862, 'mean_word_length': 3.4572687224669605, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 2, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2085535', 'n_tokens_mistral': 1607, 'n_tokens_neox': 1531, 'n_words': 285}