BookStack Code Mirror - bookstack/blob - tests/Api/PagesApiTest.php

   1 <?php
   2
   3 namespace Tests\Api;
   4
   5 use BookStack\Entities\Models\Chapter;
   6 use BookStack\Entities\Models\Page;
   7 use Carbon\Carbon;
   8 use Illuminate\Support\Facades\DB;
   9 use Tests\TestCase;
  10
  11 class PagesApiTest extends TestCase
  12 {
  13     use TestsApi;
  14
  15     protected string $baseEndpoint = '/api/pages';
  16
  17     public function test_index_endpoint_returns_expected_page()
  18     {
  19         $this->actingAsApiEditor();
  20         $firstPage = Page::query()->orderBy('id', 'asc')->first();
  21
  22         $resp = $this->getJson($this->baseEndpoint . '?count=1&sort=+id');
  23         $resp->assertJson(['data' => [
  24             [
  25                 'id'       => $firstPage->id,
  26                 'name'     => $firstPage->name,
  27                 'slug'     => $firstPage->slug,
  28                 'book_id'  => $firstPage->book->id,
  29                 'priority' => $firstPage->priority,
  30             ],
  31         ]]);
  32     }
  33
  34     public function test_create_endpoint()
  35     {
  36         $this->actingAsApiEditor();
  37         $book = $this->entities->book();
  38         $details = [
  39             'name'    => 'My API page',
  40             'book_id' => $book->id,
  41             'html'    => '<p>My new page content</p>',
  42             'tags'    => [
  43                 [
  44                     'name'  => 'tagname',
  45                     'value' => 'tagvalue',
  46                 ],
  47             ],
  48         ];
  49
  50         $resp = $this->postJson($this->baseEndpoint, $details);
  51         unset($details['html']);
  52         $resp->assertStatus(200);
  53         $newItem = Page::query()->orderByDesc('id')->where('name', '=', $details['name'])->first();
  54         $resp->assertJson(array_merge($details, ['id' => $newItem->id, 'slug' => $newItem->slug]));
  55         $this->assertDatabaseHas('tags', [
  56             'entity_id'   => $newItem->id,
  57             'entity_type' => $newItem->getMorphClass(),
  58             'name'        => 'tagname',
  59             'value'       => 'tagvalue',
  60         ]);
  61         $resp->assertSeeText('My new page content');
  62         $resp->assertJsonMissing(['book' => []]);
  63         $this->assertActivityExists('page_create', $newItem);
  64     }
  65
  66     public function test_page_name_needed_to_create()
  67     {
  68         $this->actingAsApiEditor();
  69         $book = $this->entities->book();
  70         $details = [
  71             'book_id' => $book->id,
  72             'html'    => '<p>A page created via the API</p>',
  73         ];
  74
  75         $resp = $this->postJson($this->baseEndpoint, $details);
  76         $resp->assertStatus(422);
  77         $resp->assertJson($this->validationResponse([
  78             'name' => ['The name field is required.'],
  79         ]));
  80     }
  81
  82     public function test_book_id_or_chapter_id_needed_to_create()
  83     {
  84         $this->actingAsApiEditor();
  85         $details = [
  86             'name' => 'My api page',
  87             'html' => '<p>A page created via the API</p>',
  88         ];
  89
  90         $resp = $this->postJson($this->baseEndpoint, $details);
  91         $resp->assertStatus(422);
  92         $resp->assertJson($this->validationResponse([
  93             'book_id'    => ['The book id field is required when chapter id is not present.'],
  94             'chapter_id' => ['The chapter id field is required when book id is not present.'],
  95         ]));
  96
  97         $chapter = $this->entities->chapter();
  98         $resp = $this->postJson($this->baseEndpoint, array_merge($details, ['chapter_id' => $chapter->id]));
  99         $resp->assertStatus(200);
 100
 101         $book = $this->entities->book();
 102         $resp = $this->postJson($this->baseEndpoint, array_merge($details, ['book_id' => $book->id]));
 103         $resp->assertStatus(200);
 104     }
 105
 106     public function test_markdown_can_be_provided_for_create()
 107     {
 108         $this->actingAsApiEditor();
 109         $book = $this->entities->book();
 110         $details = [
 111             'book_id'  => $book->id,
 112             'name'     => 'My api page',
 113             'markdown' => "# A new API page \n[link](https://example.com)",
 114         ];
 115
 116         $resp = $this->postJson($this->baseEndpoint, $details);
 117         $resp->assertJson(['markdown' => $details['markdown']]);
 118
 119         $respHtml = $resp->json('html');
 120         $this->assertStringContainsString('new API page</h1>', $respHtml);
 121         $this->assertStringContainsString('link</a>', $respHtml);
 122         $this->assertStringContainsString('href="https://example.com"', $respHtml);
 123     }
 124
 125     public function test_read_endpoint()
 126     {
 127         $this->actingAsApiEditor();
 128         $page = $this->entities->page();
 129
 130         $resp = $this->getJson($this->baseEndpoint . "/{$page->id}");
 131         $resp->assertStatus(200);
 132         $resp->assertJson([
 133             'id'         => $page->id,
 134             'slug'       => $page->slug,
 135             'created_by' => [
 136                 'name' => $page->createdBy->name,
 137             ],
 138             'book_id'    => $page->book_id,
 139             'updated_by' => [
 140                 'name' => $page->createdBy->name,
 141             ],
 142             'owned_by' => [
 143                 'name' => $page->ownedBy->name,
 144             ],
 145         ]);
 146     }
 147
 148     public function test_read_endpoint_provides_rendered_html()
 149     {
 150         $this->actingAsApiEditor();
 151         $page = $this->entities->page();
 152         $page->html = "<p>testing</p><script>alert('danger')</script><h1>Hello</h1>";
 153         $page->save();
 154
 155         $resp = $this->getJson($this->baseEndpoint . "/{$page->id}");
 156         $html = $resp->json('html');
 157         $this->assertStringNotContainsString('script', $html);
 158         $this->assertStringContainsString('Hello', $html);
 159         $this->assertStringContainsString('testing', $html);
 160     }
 161
 162     public function test_read_endpoint_provides_raw_html()
 163     {
 164         $html = "<p>testing</p><script>alert('danger')</script><h1>Hello</h1>";
 165
 166         $this->actingAsApiEditor();
 167         $page = $this->entities->page();
 168         $page->html = $html;
 169         $page->save();
 170
 171         $resp = $this->getJson($this->baseEndpoint . "/{$page->id}");
 172         $this->assertEquals($html, $resp->json('raw_html'));
 173         $this->assertNotEquals($html, $resp->json('html'));
 174     }
 175
 176     public function test_read_endpoint_returns_not_found()
 177     {
 178         $this->actingAsApiEditor();
 179         // get an id that is not used
 180         $id = Page::orderBy('id', 'desc')->first()->id + 1;
 181         $this->assertNull(Page::find($id));
 182
 183         $resp = $this->getJson($this->baseEndpoint . "/$id");
 184
 185         $resp->assertNotFound();
 186         $this->assertNull($resp->json('id'));
 187         $resp->assertJsonIsObject('error');
 188         $resp->assertJsonStructure([
 189             'error' => [
 190                 'code',
 191                 'message',
 192             ],
 193         ]);
 194         $this->assertSame(404, $resp->json('error')['code']);
 195     }
 196
 197     public function test_update_endpoint()
 198     {
 199         $this->actingAsApiEditor();
 200         $page = $this->entities->page();
 201         $details = [
 202             'name' => 'My updated API page',
 203             'html' => '<p>A page created via the API</p>',
 204             'tags' => [
 205                 [
 206                     'name'  => 'freshtag',
 207                     'value' => 'freshtagval',
 208                 ],
 209             ],
 210         ];
 211
 212         $resp = $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
 213         $page->refresh();
 214
 215         $resp->assertStatus(200);
 216         unset($details['html']);
 217         $resp->assertJson(array_merge($details, [
 218             'id' => $page->id, 'slug' => $page->slug, 'book_id' => $page->book_id,
 219         ]));
 220         $this->assertActivityExists('page_update', $page);
 221     }
 222
 223     public function test_providing_new_chapter_id_on_update_will_move_page()
 224     {
 225         $this->actingAsApiEditor();
 226         $page = $this->entities->page();
 227         $chapter = Chapter::visible()->where('book_id', '!=', $page->book_id)->first();
 228         $details = [
 229             'name'       => 'My updated API page',
 230             'chapter_id' => $chapter->id,
 231             'html'       => '<p>A page created via the API</p>',
 232         ];
 233
 234         $resp = $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
 235         $resp->assertStatus(200);
 236         $resp->assertJson([
 237             'chapter_id' => $chapter->id,
 238             'book_id'    => $chapter->book_id,
 239         ]);
 240     }
 241
 242     public function test_providing_move_via_update_requires_page_create_permission_on_new_parent()
 243     {
 244         $this->actingAsApiEditor();
 245         $page = $this->entities->page();
 246         $chapter = Chapter::visible()->where('book_id', '!=', $page->book_id)->first();
 247         $this->permissions->setEntityPermissions($chapter, ['view'], [$this->users->editor()->roles()->first()]);
 248         $details = [
 249             'name'       => 'My updated API page',
 250             'chapter_id' => $chapter->id,
 251             'html'       => '<p>A page created via the API</p>',
 252         ];
 253
 254         $resp = $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
 255         $resp->assertStatus(403);
 256     }
 257
 258     public function test_update_endpoint_does_not_wipe_content_if_no_html_or_md_provided()
 259     {
 260         $this->actingAsApiEditor();
 261         $page = $this->entities->page();
 262         $originalContent = $page->html;
 263         $details = [
 264             'name' => 'My updated API page',
 265             'tags' => [
 266                 [
 267                     'name'  => 'freshtag',
 268                     'value' => 'freshtagval',
 269                 ],
 270             ],
 271         ];
 272
 273         $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
 274         $page->refresh();
 275
 276         $this->assertEquals($originalContent, $page->html);
 277     }
 278
 279     public function test_update_increments_updated_date_if_only_tags_are_sent()
 280     {
 281         $this->actingAsApiEditor();
 282         $page = $this->entities->page();
 283         DB::table('pages')->where('id', '=', $page->id)->update(['updated_at' => Carbon::now()->subWeek()]);
 284
 285         $details = [
 286             'tags' => [['name' => 'Category', 'value' => 'Testing']],
 287         ];
 288
 289         $resp = $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
 290         $resp->assertOk();
 291
 292         $page->refresh();
 293         $this->assertGreaterThan(Carbon::now()->subDay()->unix(), $page->updated_at->unix());
 294     }
 295
 296     public function test_delete_endpoint()
 297     {
 298         $this->actingAsApiEditor();
 299         $page = $this->entities->page();
 300         $resp = $this->deleteJson($this->baseEndpoint . "/{$page->id}");
 301
 302         $resp->assertStatus(204);
 303         $this->assertActivityExists('page_delete', $page);
 304     }
 305
 306     public function test_export_html_endpoint()
 307     {
 308         $this->actingAsApiEditor();
 309         $page = $this->entities->page();
 310
 311         $resp = $this->get($this->baseEndpoint . "/{$page->id}/export/html");
 312         $resp->assertStatus(200);
 313         $resp->assertSee($page->name);
 314         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.html"');
 315     }
 316
 317     public function test_export_plain_text_endpoint()
 318     {
 319         $this->actingAsApiEditor();
 320         $page = $this->entities->page();
 321
 322         $resp = $this->get($this->baseEndpoint . "/{$page->id}/export/plaintext");
 323         $resp->assertStatus(200);
 324         $resp->assertSee($page->name);
 325         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.txt"');
 326     }
 327
 328     public function test_export_pdf_endpoint()
 329     {
 330         $this->actingAsApiEditor();
 331         $page = $this->entities->page();
 332
 333         $resp = $this->get($this->baseEndpoint . "/{$page->id}/export/pdf");
 334         $resp->assertStatus(200);
 335         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.pdf"');
 336     }
 337
 338     public function test_export_markdown_endpoint()
 339     {
 340         $this->actingAsApiEditor();
 341         $page = $this->entities->page();
 342
 343         $resp = $this->get($this->baseEndpoint . "/{$page->id}/export/markdown");
 344         $resp->assertStatus(200);
 345         $resp->assertSee('# ' . $page->name);
 346         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
 347     }
 348
 349     public function test_cant_export_when_not_have_permission()
 350     {
 351         $types = ['html', 'plaintext', 'pdf', 'markdown'];
 352         $this->actingAsApiEditor();
 353         $this->permissions->removeUserRolePermissions($this->users->editor(), ['content-export']);
 354
 355         $page = $this->entities->page();
 356         foreach ($types as $type) {
 357             $resp = $this->get($this->baseEndpoint . "/{$page->id}/export/{$type}");
 358             $this->assertPermissionError($resp);
 359         }
 360     }
 361 }