Add tests

Author: dorner

app/controllers/concerns/validatable.rb

@@ -3,8 +3,8 @@ module Validatable
 
   included do
     rescue_from ActionController::InvalidAuthenticityToken do
-      if action_name == 'validate'
-        render json: { valid: false }
+      if action_name == "validate"
+        render json: {valid: false}
       else
         session_expired
       end

spec/requests/distributions_requests_spec.rb

@@ -816,6 +816,17 @@
 
       include_examples "restricts access to organization users/admins"
     end
+
+    describe 'POST #validate' do
+      it 'should handle missing CSRF gracefully' do
+        ActionController::Base.allow_forgery_protection = true
+        post validate_partners_individuals_requests_path
+        ActionController::Base.allow_forgery_protection = false
+
+        expect(JSON.parse(response.body)).to eq({'valid' => false})
+        expect(response.status).to eq(200)
+      end
+    end
   end
 
   context "While not signed in" do

…tners/family_requests_controller_spec.rb …artners/family_requests_requests_spec.rbspec/requests/partners/family_requests_controller_spec.rb renamed to spec/requests/partners/family_requests_requests_spec.rb spec/requests/partners/family_requests_controller_spec.rb renamed to spec/requests/partners/family_requests_requests_spec.rb

@@ -11,7 +11,7 @@
 
   before { sign_in(partner_user) }
 
-  describe 'GET #new' do
+  describe "GET #new" do
     subject { get new_partners_family_request_path }
 
     it "does not allow deactivated partners" do
@@ -27,7 +27,7 @@
     end
   end
 
-  describe 'POST #create' do
+  describe "POST #create" do
     before do
       # Set one child as deactivated and the other as active but
       # without a item_needed_diaperid
@@ -66,4 +66,15 @@
       expect(Partners::ChildItemRequest.find_by(child_id: children[2].id)).to be_present
     end
   end
+
+  describe "POST #validate" do
+    it "should handle missing CSRF gracefully" do
+      ActionController::Base.allow_forgery_protection = true
+      post validate_partners_family_requests_path
+      ActionController::Base.allow_forgery_protection = false
+
+      expect(JSON.parse(response.body)).to eq({"valid" => false})
+      expect(response.status).to eq(200)
+    end
+  end
 end

…/individuals_requests_controller_spec.rb …rs/individuals_requests_requests_spec.rbspec/requests/partners/individuals_requests_controller_spec.rb renamed to spec/requests/partners/individuals_requests_requests_spec.rb spec/requests/partners/individuals_requests_controller_spec.rb renamed to spec/requests/partners/individuals_requests_requests_spec.rb

@@ -156,4 +156,15 @@
       end
     end
   end
+
+  describe "POST #validate" do
+    it "should handle missing CSRF gracefully" do
+      ActionController::Base.allow_forgery_protection = true
+      post validate_partners_individuals_requests_path
+      ActionController::Base.allow_forgery_protection = false
+
+      expect(JSON.parse(response.body)).to eq({"valid" => false})
+      expect(response.status).to eq(200)
+    end
+  end
 end

spec/requests/partners/requests_spec.rb

@@ -407,4 +407,17 @@
       end
     end
   end
+
+  describe 'POST #validate' do
+    it 'should handle missing CSRF gracefully' do
+      sign_in(partner_user)
+
+      ActionController::Base.allow_forgery_protection = true
+      post validate_partners_requests_path
+      ActionController::Base.allow_forgery_protection = false
+
+      expect(JSON.parse(response.body)).to eq({'valid' => false})
+      expect(response.status).to eq(200)
+    end
+  end
 end