api_spec.rb

require 'spec_helper'

require 'device_auth/provider/basic'
require 'device_auth/provider/anonymous'

module DeviceAuth
  describe API do

    describe 'POST /api/v1/auth/register' do

      it 'should create a user account when registering' do
        post '/api/v1/auth/register', {
            method: 'basic',
            device_id: 'IPHONE123',
            credentials: {
                username: 'johnsmith',
                email: 'doe@hotmail.com',
                password: 'abcd'
            }
        }

        json.token.should_not be_nil
        User.count.should eq 1
      end

      it 'should not allow a re-registration with a different password' do
        post '/api/v1/auth/register', {
            method: 'basic',
            device_id: 'IPHONE123',
            credentials: {
                username: 'johnsmith',
                email: 'doe@hotmail.com',
                password: 'abcd'
            }
        }

        post '/api/v1/auth/register', {
            method: 'basic',
            device_id: 'IPHONE123',
            credentials: {
                username: 'johnsmith',
                email: 'doe@hotmail.com',
                password: 'qwer'
            }
        }

        json.token.should be_nil
        User.count.should eq 1
      end

      context 'when registering with a username, email, and password' do

        before do
          post '/api/v1/auth/register', {
              method: 'basic',
              device_id: 'APPLE123',
              credentials: {
                  username: 'bobjohnson',
                  email: 'joe@gmail.com',
                  password: '123'
              }
          }

          @token = json.token
        end

        it 'should allow one to login after registering' do
          post '/api/v1/auth/login', {
              method: 'basic',
              device_id: 'LOGIN',
              credentials: {
                  email: 'joe@gmail.com',
                  password: '123'
              }
          }

          json.token.should_not be_nil
          User.count.should eq 1
        end

        it 'should not allow a login with an incorrect password' do
          post '/api/v1/auth/login', {
              method: 'basic',
              device_id: 'LOGIN',
              credentials: {
                  email: 'joe@gmail.com',
                  password: 'moo'
              }
          }

          json.token.should be_nil

          post '/api/v1/auth/login', {
              method: 'basic',
              device_id: 'LOGIN',
              credentials: {
                  email: 'joe@gmail.com',
                  password: '123'
              }
          }
          json.token.should_not be_nil

          User.count.should eq 1
        end

      end

      it 'should not be possible to login if you havent registered' do
        post '/api/v1/auth/login', {
            method: 'anonymous',
            device_id: 'PEAR1234',
            credentials: {device_id: 'KANGAROO987'}
        }

        json.token.should be_nil
        User.count.should eq 0
      end

      context 'when registering as an anonymous user' do

        before do
          post '/api/v1/auth/register', {
              method: 'anonymous',
              device_id: 'PEAR1234',
              credentials: {device_id: 'PEAR1234'}
          }

          @token = json.token
        end

        it 'should have created a single device' do
          DeviceAuth::Device.count.should eq 1
        end

        it 'should have created a single user' do
          User.count.should eq 1
        end

        context 'when registering a second time' do

          before do
            post '/api/v1/auth/register', {
                method: 'anonymous',
                device_id: 'PEAR1234',
                credentials: {device_id: 'PEAR1234'}
            }
          end

          it 'should not have created a duplicate device' do
            DeviceAuth::Device.count.should eq 1
            User.count.should eq 1
          end

        end

        it 'should fail when connecting without authorizing' do
          post '/api/v1/auth/connect', {
              method: 'basic',
              device_id: 'PEAR1234',
              credentials: {
                  username: 'brucelee',
                  email: 'bruce@lee.com',
                  password: '1234'
              }
          }
          DeviceAuth::Identity.count.should eq 1
          last_response.status.should eq 401
        end

        context 'when later connecting with a username and password' do
          before do
            authorize "anything", @token
            post '/api/v1/auth/connect', {
                method: 'basic',
                device_id: 'PEAR1234',
                credentials: {
                    username: 'brucelee',
                    email: 'bruce@lee.com',
                    password: '1234'
                }
            }

            @connect_token = json.token
          end

          it 'should still have just a single device but have two identities' do
            DeviceAuth::Device.count.should eq 1
            DeviceAuth::Identity.count.should eq 2
            User.count.should eq 1
          end

        end

      end


    end

  end
end