Merge pull request #15 from strongloop/feature/improve-access-checks

helpers: Improve ACL asserts

Author: bajtos

lib/helpers.js

@@ -142,7 +142,12 @@ _beforeEach.givenAnAnonymousToken = function(attrs, optionalHandler) {
   _beforeEach.givenModel('accessToken', {id: '$anonymous'}, optionalHandler);
 }
 
-_describe.whenCalledRemotely = function(verb, url, cb) {
+_describe.whenCalledRemotely = function(verb, url, data, cb) {
+  if (cb == undefined) {
+    cb = data;
+    data = null;
+  }
+
   var urlStr = url;
   if(typeof url === 'function') {
     urlStr = '/<dynamic>';
@@ -165,6 +170,12 @@ _describe.whenCalledRemotely = function(verb, url, cb) {
       if(this.loggedInAccessToken) {
         this.http.set('authorization', this.loggedInAccessToken.id);
       }
+      if (data) {
+        var payload = data;
+        if (typeof data === 'function')
+          payload = data.call(this);
+        this.http.send(payload);
+      }
       this.req = this.http.req;
       var test = this;
       this.http.end(function(err) {
@@ -186,43 +197,43 @@ _describe.whenLoggedInAsUser = function(credentials, cb) {
   });
 }
 
-_describe.whenCalledByUser = function(credentials, verb, url, cb) {
+_describe.whenCalledByUser = function(credentials, verb, url, data, cb) {
   describe('when called by logged in user', function () {
     _beforeEach.givenLoggedInUser(credentials);
-    _describe.whenCalledRemotely(verb, url, cb);
+    _describe.whenCalledRemotely(verb, url, data, cb);
   });
 }
 
-_describe.whenCalledAnonymously = function(verb, url, cb) {
+_describe.whenCalledAnonymously = function(verb, url, data, cb) {
   describe('when called anonymously', function () {
     _beforeEach.givenAnAnonymousToken();
-    _describe.whenCalledRemotely(verb, url, cb);
+    _describe.whenCalledRemotely(verb, url, data, cb);
   });
 }
 
-_describe.whenCalledUnauthenticated = function(verb, url, cb) {
+_describe.whenCalledUnauthenticated = function(verb, url, data, cb) {
   describe('when called with unauthenticated token', function () {
     _beforeEach.givenAnAnonymousToken();
-    _describe.whenCalledRemotely(verb, url, cb);
+    _describe.whenCalledRemotely(verb, url, data, cb);
   });
 }
 
 _it.shouldBeAllowed = function() {
   it('should be allowed', function() {
     assert(this.req);
     assert(this.res);
-    //status 200 -> 399
-    var status = this.res.statusCode;
-    assert(status >= 200 && status <= 399);
+    // expect success - status 2xx or 3xx
+    expect(this.res.statusCode).to.be.within(100, 399);
   });
 }
 
 _it.shouldBeDenied = function() {
   it('should not be allowed', function() {
     assert(this.res);
-    //if in list
-    var status = this.res.statusCode;
-    assert([403,401].indexOf(status) > -1);
+    var expectedStatus = this.aclErrorStatus ||
+      this.app && this.app.get('aclErrorStatus') ||
+      401;
+    expect(this.res.statusCode).to.equal(expectedStatus);
   });
 }
 
@@ -234,8 +245,8 @@ _it.shouldNotBeFound = function() {
 }
 
 _it.shouldBeAllowedWhenCalledAnonymously =
-function(verb, url) {
-  _describe.whenCalledAnonymously(verb, url, function() {
+function(verb, url, data) {
+  _describe.whenCalledAnonymously(verb, url, data, function() {
     _it.shouldBeAllowed();
   });
 }
@@ -248,8 +259,8 @@ function(verb, url) {
 }
 
 _it.shouldBeAllowedWhenCalledUnauthenticated =
-function(verb, url) {
-  _describe.whenCalledUnauthenticated(verb, url, function() {
+function(verb, url, data) {
+  _describe.whenCalledUnauthenticated(verb, url, data, function() {
     _it.shouldBeAllowed();
   });
 }
@@ -262,8 +273,8 @@ function(verb, url) {
 }
 
 _it.shouldBeAllowedWhenCalledByUser =
-function(credentials, verb, url) {
-  _describe.whenCalledByUser(credentials, verb, url, function() {
+function(credentials, verb, url, data) {
+  _describe.whenCalledByUser(credentials, verb, url, data, function() {
     _it.shouldBeAllowed();
   });
 }