Add a couple basic request specs (#478)

app/controllers/async_info_controller.rb

@@ -1,5 +1,6 @@
 class AsyncInfoController < ApplicationController
   include Devise::Controllers::Rememberable
+  # No pundit policy. All actions are unrestricted.
 
   def base_data
     flash.discard(:notice)

app/controllers/pusher_controller.rb

@@ -7,7 +7,7 @@ class PusherController < ApplicationController
       })
       render json: response
     else
-      render text: 'Forbidden', status: '403'
+      render json: { text: 'Forbidden', status: '403' }
     end
   end
 
@@ -20,6 +20,7 @@ class PusherController < ApplicationController
   end
 
   def valid_presence_channel
+    return false unless params[:channel_name].include?("presence-channel-")
     id = params[:channel_name].split("presence-channel-")[1].split("-")[0]
     channel = ChatChannel.find(id)
     channel.has_member?(current_user)

spec/requests/async_info_spec.rb

@@ -0,0 +1,18 @@
+require "rails_helper"
+
+RSpec.describe "AsyncInfo", type: :request do
+  let(:user) { build(:user) }
+  describe "GET /async_info/base_data" do
+    it "returns token and no user for non-logged-in" do
+      get "/async_info/base_data"
+      expect(response.body).to include("token")
+      expect(response.body).not_to include("user")
+    end
+    it "returns token and no user for non-logged-in" do
+      sign_in user
+      get "/async_info/base_data"
+      expect(response.body).to include("token")
+      expect(response.body).to include("user")
+    end
+  end
+end

spec/requests/pusher_auth_spec.rb

@@ -0,0 +1,22 @@
+require "rails_helper"
+
+RSpec.describe "PusherAuth", type: :request do
+  let(:user) { build(:user) }
+  let(:chat_channel) { build(:chat_channel) }
+  describe "POST /pusher/auth" do
+    it "returns forbidden with invalid channel" do
+      post "/pusher/auth", params: {
+        channel_name: "hey hey hey hey"
+      }
+      expect(response.body).to include("Forbidden")
+    end
+
+    # it "returns forbidden with invalid channel" do
+    #   sign_in user
+    #   post "/pusher/auth", params: {
+    #     channel_name: "private-message-notifications-#{user.id}"
+    #   }
+    #   expect(response.body).to include("Forbidden")
+    # end
+  end
+end