X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/832fbd65afcaa8d8f2953fe04de2e479053dbc29..refs/pull/3598/head:/tests/User/UserApiTokenTest.php

diff --git a/tests/User/UserApiTokenTest.php b/tests/User/UserApiTokenTest.php
index 86c2b7bcc..716f3614c 100644
--- a/tests/User/UserApiTokenTest.php
+++ b/tests/User/UserApiTokenTest.php
@@ -1,20 +1,22 @@
-<?php namespace Test;
+<?php
 
+namespace Tests\User;
+
+use BookStack\Actions\ActivityType;
 use BookStack\Api\ApiToken;
 use Carbon\Carbon;
 use Tests\TestCase;
 
 class UserApiTokenTest extends TestCase
 {
-
     protected $testTokenData = [
-        'name' => 'My test API token',
-        'expires_at' => '2099-04-01',
+        'name'       => 'My test API token',
+        'expires_at' => '2050-04-01',
     ];
 
     public function test_tokens_section_not_visible_without_access_api_permission()
     {
-        $user = $this->getEditor();
+        $user = $this->getViewer();
 
         $resp = $this->actingAs($user)->get($user->getEditUrl());
         $resp->assertDontSeeText('API Tokens');
@@ -30,9 +32,9 @@ class UserApiTokenTest extends TestCase
     {
         $viewer = $this->getViewer();
         $editor = $this->getEditor();
-        $this->giveUserPermissions($editor, ['users-manage']);
+        $this->giveUserPermissions($viewer, ['users-manage']);
 
-        $resp = $this->actingAs($editor)->get($viewer->getEditUrl());
+        $resp = $this->actingAs($viewer)->get($editor->getEditUrl());
         $resp->assertSeeText('API Tokens');
         $resp->assertDontSeeText('Create Token');
     }
@@ -44,14 +46,14 @@ class UserApiTokenTest extends TestCase
         $resp = $this->asAdmin()->get($editor->getEditUrl('/create-api-token'));
         $resp->assertStatus(200);
         $resp->assertSee('Create API Token');
-        $resp->assertSee('client secret');
+        $resp->assertSee('Token Secret');
 
         $resp = $this->post($editor->getEditUrl('/create-api-token'), $this->testTokenData);
         $token = ApiToken::query()->latest()->first();
         $resp->assertRedirect($editor->getEditUrl('/api-tokens/' . $token->id));
         $this->assertDatabaseHas('api_tokens', [
-            'user_id' => $editor->id,
-            'name' => $this->testTokenData['name'],
+            'user_id'    => $editor->id,
+            'name'       => $this->testTokenData['name'],
             'expires_at' => $this->testTokenData['expires_at'],
         ]);
 
@@ -59,27 +61,28 @@ class UserApiTokenTest extends TestCase
         $this->assertSessionHas('api-token-secret:' . $token->id);
         $secret = session('api-token-secret:' . $token->id);
         $this->assertDatabaseMissing('api_tokens', [
-            'client_secret' => $secret,
+            'secret' => $secret,
         ]);
-        $this->assertTrue(\Hash::check($secret, $token->client_secret));
+        $this->assertTrue(\Hash::check($secret, $token->secret));
 
-        $this->assertTrue(strlen($token->client_id) === 32);
+        $this->assertTrue(strlen($token->token_id) === 32);
         $this->assertTrue(strlen($secret) === 32);
 
         $this->assertSessionHas('success');
+        $this->assertActivityExists(ActivityType::API_TOKEN_CREATE);
     }
 
     public function test_create_with_no_expiry_sets_expiry_hundred_years_away()
     {
         $editor = $this->getEditor();
-        $this->asAdmin()->post($editor->getEditUrl('/create-api-token'), ['name' => 'No expiry token']);
+        $this->asAdmin()->post($editor->getEditUrl('/create-api-token'), ['name' => 'No expiry token', 'expires_at' => '']);
         $token = ApiToken::query()->latest()->first();
 
         $over = Carbon::now()->addYears(101);
         $under = Carbon::now()->addYears(99);
         $this->assertTrue(
             ($token->expires_at < $over && $token->expires_at > $under),
-            "Token expiry set at 100 years in future"
+            'Token expiry set at 100 years in future'
         );
     }
 
@@ -90,17 +93,17 @@ class UserApiTokenTest extends TestCase
         $token = ApiToken::query()->latest()->first();
 
         $resp = $this->get($editor->getEditUrl());
-        $resp->assertElementExists('#api_tokens');
-        $resp->assertElementContains('#api_tokens', $token->name);
-        $resp->assertElementContains('#api_tokens', $token->client_id);
-        $resp->assertElementContains('#api_tokens', $token->expires_at->format('Y-m-d'));
+        $this->withHtml($resp)->assertElementExists('#api_tokens');
+        $this->withHtml($resp)->assertElementContains('#api_tokens', $token->name);
+        $this->withHtml($resp)->assertElementContains('#api_tokens', $token->token_id);
+        $this->withHtml($resp)->assertElementContains('#api_tokens', $token->expires_at->format('Y-m-d'));
     }
 
-    public function test_client_secret_shown_once_after_creation()
+    public function test_secret_shown_once_after_creation()
     {
         $editor = $this->getEditor();
         $resp = $this->asAdmin()->followingRedirects()->post($editor->getEditUrl('/create-api-token'), $this->testTokenData);
-        $resp->assertSeeText('Client Secret');
+        $resp->assertSeeText('Token Secret');
 
         $token = ApiToken::query()->latest()->first();
         $this->assertNull(session('api-token-secret:' . $token->id));
@@ -115,7 +118,7 @@ class UserApiTokenTest extends TestCase
         $this->asAdmin()->post($editor->getEditUrl('/create-api-token'), $this->testTokenData);
         $token = ApiToken::query()->latest()->first();
         $updateData = [
-            'name' => 'My updated token',
+            'name'       => 'My updated token',
             'expires_at' => '2011-01-01',
         ];
 
@@ -124,6 +127,27 @@ class UserApiTokenTest extends TestCase
 
         $this->assertDatabaseHas('api_tokens', array_merge($updateData, ['id' => $token->id]));
         $this->assertSessionHas('success');
+        $this->assertActivityExists(ActivityType::API_TOKEN_UPDATE);
+    }
+
+    public function test_token_update_with_blank_expiry_sets_to_hundred_years_away()
+    {
+        $editor = $this->getEditor();
+        $this->asAdmin()->post($editor->getEditUrl('/create-api-token'), $this->testTokenData);
+        $token = ApiToken::query()->latest()->first();
+
+        $resp = $this->put($editor->getEditUrl('/api-tokens/' . $token->id), [
+            'name'       => 'My updated token',
+            'expires_at' => '',
+        ]);
+        $token->refresh();
+
+        $over = Carbon::now()->addYears(101);
+        $under = Carbon::now()->addYears(99);
+        $this->assertTrue(
+            ($token->expires_at < $over && $token->expires_at > $under),
+            'Token expiry set at 100 years in future'
+        );
     }
 
     public function test_token_delete()
@@ -137,11 +161,12 @@ class UserApiTokenTest extends TestCase
         $resp = $this->get($tokenUrl . '/delete');
         $resp->assertSeeText('Delete Token');
         $resp->assertSeeText($token->name);
-        $resp->assertElementExists('form[action="'.$tokenUrl.'"]');
+        $this->withHtml($resp)->assertElementExists('form[action="' . $tokenUrl . '"]');
 
         $resp = $this->delete($tokenUrl);
         $resp->assertRedirect($editor->getEditUrl('#api_tokens'));
         $this->assertDatabaseMissing('api_tokens', ['id' => $token->id]);
+        $this->assertActivityExists(ActivityType::API_TOKEN_DELETE);
     }
 
     public function test_user_manage_can_delete_token_without_api_permission_themselves()
@@ -161,5 +186,4 @@ class UserApiTokenTest extends TestCase
         $resp->assertRedirect($viewer->getEditUrl('#api_tokens'));
         $this->assertDatabaseMissing('api_tokens', ['id' => $token->id]);
     }
-
-}
\ No newline at end of file
+}