From 13a92d17cbc369cd3f739c0fc28d9085a5f76e44 Mon Sep 17 00:00:00 2001
From: Ben Halpern <bendhalpern@gmail.com>
Date: Thu, 21 Jun 2018 18:35:34 -0400
Subject: [PATCH] Add a couple basic request specs (#478)

---
 app/controllers/async_info_controller.rb |  1 +
 app/controllers/pusher_controller.rb     |  3 ++-
 spec/requests/async_info_spec.rb         | 18 ++++++++++++++++++
 spec/requests/pusher_auth_spec.rb        | 22 ++++++++++++++++++++++
 4 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 spec/requests/async_info_spec.rb
 create mode 100644 spec/requests/pusher_auth_spec.rb

diff --git a/app/controllers/async_info_controller.rb b/app/controllers/async_info_controller.rb
index c606c9ede..12f0f22d2 100644
--- a/app/controllers/async_info_controller.rb
+++ b/app/controllers/async_info_controller.rb
@@ -1,5 +1,6 @@
 class AsyncInfoController < ApplicationController
   include Devise::Controllers::Rememberable
+  # No pundit policy. All actions are unrestricted.
 
   def base_data
     flash.discard(:notice)
diff --git a/app/controllers/pusher_controller.rb b/app/controllers/pusher_controller.rb
index acd5481dc..0cf437dda 100644
--- a/app/controllers/pusher_controller.rb
+++ b/app/controllers/pusher_controller.rb
@@ -7,7 +7,7 @@ class PusherController < ApplicationController
       })
       render json: response
     else
-      render text: 'Forbidden', status: '403'
+      render json: { text: 'Forbidden', status: '403' }
     end
   end
 
@@ -20,6 +20,7 @@ class PusherController < ApplicationController
   end
 
   def valid_presence_channel
+    return false unless params[:channel_name].include?("presence-channel-")
     id = params[:channel_name].split("presence-channel-")[1].split("-")[0]
     channel = ChatChannel.find(id)
     channel.has_member?(current_user)
diff --git a/spec/requests/async_info_spec.rb b/spec/requests/async_info_spec.rb
new file mode 100644
index 000000000..0bd8fe98e
--- /dev/null
+++ b/spec/requests/async_info_spec.rb
@@ -0,0 +1,18 @@
+require "rails_helper"
+
+RSpec.describe "AsyncInfo", type: :request do
+  let(:user) { build(:user) }
+  describe "GET /async_info/base_data" do
+    it "returns token and no user for non-logged-in" do
+      get "/async_info/base_data"
+      expect(response.body).to include("token")
+      expect(response.body).not_to include("user")
+    end
+    it "returns token and no user for non-logged-in" do
+      sign_in user
+      get "/async_info/base_data"
+      expect(response.body).to include("token")
+      expect(response.body).to include("user")
+    end
+  end
+end
diff --git a/spec/requests/pusher_auth_spec.rb b/spec/requests/pusher_auth_spec.rb
new file mode 100644
index 000000000..ac237613a
--- /dev/null
+++ b/spec/requests/pusher_auth_spec.rb
@@ -0,0 +1,22 @@
+require "rails_helper"
+
+RSpec.describe "PusherAuth", type: :request do
+  let(:user) { build(:user) }
+  let(:chat_channel) { build(:chat_channel) }
+  describe "POST /pusher/auth" do
+    it "returns forbidden with invalid channel" do
+      post "/pusher/auth", params: {
+        channel_name: "hey hey hey hey"
+      }
+      expect(response.body).to include("Forbidden")
+    end
+
+    # it "returns forbidden with invalid channel" do
+    #   sign_in user
+    #   post "/pusher/auth", params: {
+    #     channel_name: "private-message-notifications-#{user.id}"
+    #   }
+    #   expect(response.body).to include("Forbidden")
+    # end
+  end
+end