cartodb-4.42/spec/requests/admin/visualizations_spec.rb

require 'sequel'
require 'rack/test'
require 'json'
require_relative '../../spec_helper'
require_relative '../../support/factories/organizations'
require_relative '../../../app/controllers/admin/visualizations_controller'
require 'helpers/unique_names_helper'

def app
  CartoDB::Application.new
end #app

describe Admin::VisualizationsController do
  include UniqueNamesHelper
  include Rack::Test::Methods
  include Warden::Test::Helpers
  include CacheHelper
  include Carto::Factories::Visualizations

  # Mock for a Rails context
  class ContextMock
    def initialize(global_context)
      @global_context = global_context
    end

    def request
      nil
    end

    def polymorphic_path(*args)
      @global_context.polymorphic_path(*args)
    end
  end

  before(:all) do
    @user = FactoryGirl.create(:valid_user, private_tables_enabled: true)

    @api_key = @user.api_key
    @user.stubs(:should_load_common_data?).returns(false)

    @headers = {
      'CONTENT_TYPE'  => 'application/json',
    }
    @mock_context = ContextMock.new(self)
  end

  after(:all) do
    @user.destroy
  end

  before(:each) do
    bypass_named_maps
    delete_user_data @user
    host! "#{@user.username}.localhost.lan"
  end

  describe 'GET /viz' do
    it 'returns a list of visualizations' do
      # we use this to avoid generating the static assets in CI
      Admin::VisualizationsController.any_instance.stubs(:render).returns('')
      login_as(@user, scope: @user.username)

      get "/viz", {}, @headers
      last_response.status.should == 200
    end

    it 'returns 403 if user not logged in' do
      get "/viz", {}, @headers
      last_response.status.should == 302
    end
  end # GET /viz

  describe 'GET /viz:id' do
    it 'returns a visualization' do
      id = factory.fetch('id')
      login_as(@user, scope: @user.username)

      get "/viz/#{id}", {}, @headers
      last_response.status.should == 200
    end

    it 'redirects to the public view if visualization private' do
      id = factory.fetch('id')

      get "/viz/#{id}", {}, @headers
      follow_redirect!
      last_request.path.should =~ %r{/viz/}
    end

    it 'keeps the base path (table|visualization) when redirecting' do
      id = table_factory.id

      get "/tables/#{id}", {}, @headers
      follow_redirect!
      last_request.path.should =~ %r{/tables/}
    end

    describe 'redirects to builder' do
      describe 'for tables' do
        before(:each) do
          @id = table_factory.id
        end
        it 'if forced' do
          @user.stubs(:builder_enabled).returns(true)
          @user.stubs(:builder_enabled?).returns(true)

          login_as(@user, scope: @user.username)
          get "/tables/#{@id}", {}, @headers
          last_response.status.should eq 302
          follow_redirect!
          last_request.path.should =~ %r{/dataset/}
        end

        it 'only if enabled' do
          @user.stubs(:builder_enabled).returns(true)
          @user.stubs(:builder_enabled?).returns(false)

          login_as(@user, scope: @user.username)
          get "/tables/#{@id}", {}, @headers
          last_response.status.should eq 200
        end

        it 'only if forced' do
          @user.stubs(:builder_enabled).returns(nil)
          @user.stubs(:builder_enabled?).returns(false)

          login_as(@user, scope: @user.username)
          get "/tables/#{@id}", {}, @headers
          last_response.status.should eq 200
        end
      end

      describe 'for visualizations' do
        before(:each) do
          @id = factory.fetch('id')
        end
        it 'if forced' do
          @user.stubs(:builder_enabled).returns(true)
          @user.stubs(:builder_enabled?).returns(true)

          login_as(@user, scope: @user.username)
          get "/viz/#{@id}", {}, @headers
          last_response.status.should eq 302
          follow_redirect!
          last_request.path.should =~ %r{/builder/}
        end

        it 'only if enabled' do
          @user.stubs(:builder_enabled).returns(true)
          @user.stubs(:builder_enabled?).returns(false)

          login_as(@user, scope: @user.username)
          get "/viz/#{@id}", {}, @headers
          last_response.status.should eq 200
        end

        it 'only if forced' do
          @user.stubs(:builder_enabled).returns(nil)
          @user.stubs(:builder_enabled?).returns(false)

          login_as(@user, scope: @user.username)
          get "/viz/#{@id}", {}, @headers
          last_response.status.should eq 200
        end

        it 'never for vizjson2 visualizations' do
          @user.stubs(:builder_enabled).returns(true)
          @user.stubs(:builder_enabled?).returns(true)
          Carto::Visualization::any_instance.stubs(:uses_vizjson2?).returns(true)

          login_as(@user, scope: @user.username)
          get public_visualizations_show_path(id: @id), {}, @headers
          last_response.status.should eq 200
        end

        it 'embed redirects to builder for v3 when needed' do
          # These two tests are in the same testcase to test proper embed cache invalidation
          @user.stubs(:builder_enabled).returns(false)
          @user.stubs(:builder_enabled?).returns(false)
          visualization = CartoDB::Visualization::Member.new(id: @id).fetch
          visualization.version = 2
          visualization.store

          login_as(@user, scope: @user.username)
          get public_visualizations_embed_map_path(id: @id), {}, @headers
          last_response.status.should eq 200

          visualization.version = 3
          visualization.store

          login_as(@user, scope: @user.username)
          get public_visualizations_embed_map_path(id: @id), {}, @headers
          last_response.status.should eq 302
        end
      end
    end
  end # GET /viz/:id

  describe 'GET /tables/:id/public/table' do
    it 'returns 404 for private tables' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PRIVATE).id

      get "/tables/#{id}/public/table", {}, @headers
      last_response.status.should == 404
    end
  end

  describe 'GET /viz/:id/protected_public_map' do
    it 'returns 404 for private maps' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PRIVATE).table_visualization.id

      get "/viz/#{id}/protected_public_map", {}, @headers
      last_response.status.should == 404
    end
  end

  describe 'GET /viz/:id/protected_embed_map' do
    it 'returns 404 for private maps' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PRIVATE).table_visualization.id

      get "/viz/#{id}/protected_embed_map", {}, @headers
      last_response.status.should == 404
    end
  end

  describe 'GET /viz/:id/public_map' do
    it 'returns 403 for private maps' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PRIVATE).table_visualization.id

      get "/viz/#{id}/public_map", {}, @headers
      last_response.status.should == 403
    end

    it 'go to password protected page if the viz is password protected' do
      id = factory.fetch('id')
      visualization = CartoDB::Visualization::Member.new(id: id).fetch
      visualization.version = 2
      visualization.password = 'foobar'
      visualization.privacy = Carto::Visualization::PRIVACY_PROTECTED
      visualization.store

      get "/viz/#{id}/public_map", {}, @headers
      last_response.status.should == 200
      last_response.body.scan(/Insert your password/).present?.should == true
    end

    it 'returns proper surrogate-keys' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id

      get "/viz/#{id}/public_map", {}, @headers
      last_response.status.should == 200
      last_response.headers["Surrogate-Key"].should_not be_empty
      last_response.headers["Surrogate-Key"].should include(CartoDB::SURROGATE_NAMESPACE_PUBLIC_PAGES)
    end

    it 'returns public map for org users' do
      org = OrganizationFactory.new.new_organization.save

      user_a = create_user(quota_in_bytes: 123456789, table_quota: 400)
      user_org = CartoDB::UserOrganization.new(org.id, user_a.id)
      user_org.promote_user_to_admin

      vis_id = new_table({user_id: user_a.id, privacy: ::UserTable::PRIVACY_PUBLIC}).save.reload.table_visualization.id

      host! "#{org.name}.localhost.lan"
      get "/viz/#{vis_id}/public_map", @headers
      last_response.status.should == 200
    end

    it 'go to password protected page if the organization viz is password protected' do
      org = OrganizationFactory.new.new_organization.save

      user_a = create_user(quota_in_bytes: 123456789, table_quota: 400)
      user_org = CartoDB::UserOrganization.new(org.id, user_a.id)
      user_org.promote_user_to_admin
      id = factory(owner=user_a).fetch('id')
      visualization = CartoDB::Visualization::Member.new(id: id).fetch
      visualization.version = 2
      visualization.password = 'foobar'
      visualization.privacy = Carto::Visualization::PRIVACY_PROTECTED
      visualization.store

      get "/viz/#{id}/public_map", {}, @headers

      last_response.status.should == 302
      follow_redirect!
      last_response.status.should == 200
      last_response.body.scan(/Insert your password/).present?.should == true
    end

    it 'does not load daily mapviews stats' do
      CartoDB::Visualization::Stats.expects(:mapviews).never
      CartoDB::Visualization::Stats.any_instance.expects(:to_poro).never
      CartoDB::Visualization.expects(:stats).never
      Carto::Visualization.expects(:stats).never

      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id

      get public_visualizations_public_map_url(id: id), {}, @headers
      last_response.status.should == 200
    end

    it 'serves X-Frame-Options: DENY' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id

      get "/viz/#{id}/public_map", {}, @headers
      last_response.status.should == 200
      last_response.headers['X-Frame-Options'].should == 'DENY'
    end
  end

  describe 'public_visualizations_show_map' do

    it 'does not load daily mapviews stats' do
      CartoDB::Visualization::Stats.expects(:mapviews).never
      CartoDB::Visualization::Stats.any_instance.expects(:to_poro).never
      CartoDB::Stats::APICalls.any_instance.expects(:get_api_calls_from_redis_source).never

      CartoDB::Visualization.expects(:stats).never
      Carto::Visualization.expects(:stats).never

      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id

      login_as(@user, scope: @user.username)
      get public_visualizations_show_map_url(id: id), {}, @headers
      last_response.status.should == 200
    end

  end

  describe 'GET /viz/:id/public' do
    it 'returns public data for a table visualization' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id

      get "/viz/#{id}/public", {}, @headers
      last_response.status.should == 200
    end

    it 'returns a 404 if table is private' do
      id = table_factory.table_visualization.id

      get "/viz/#{id}/public", {}, @headers
      last_response.status.should == 404
    end

    it "redirects to embed_map if visualization is 'derived'" do
      map = FactoryGirl.create(:map, user_id: @user.id)
      derived_visualization = FactoryGirl.create(:derived_visualization, user_id: @user.id, map_id: map.id)
      id = derived_visualization.id

      get "/viz/#{id}/public", {}, @headers
      last_response.status.should == 302
      follow_redirect!
      last_response.status.should == 200
      last_request.url.should =~ %r{.*#{id}/public_map.*}
    end
  end # GET /viz/:id/public

  describe 'GET /tables/:id/embed_map' do
    it 'returns 404 for nonexisting tables when table name is used' do
      get "/tables/tablethatdoesntexist/embed_map", {}, @headers
      last_response.status.should == 404
    end
  end

  describe 'GET /viz/:name/embed_map' do
    it 'renders the view by passing a visualization name' do
      table = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC)
      name = table.table_visualization.name

      get "/viz/#{URI::encode(name)}/embed_map", {}, @headers
      last_response.status.should == 200
      last_response.headers["X-Cache-Channel"].should_not be_empty
      last_response.headers["X-Cache-Channel"].should include(table.name)
      last_response.headers["X-Cache-Channel"].should include(table.table_visualization.varnish_key)
      last_response.headers["Surrogate-Key"].should_not be_empty
      last_response.headers["Surrogate-Key"].should include(CartoDB::SURROGATE_NAMESPACE_PUBLIC_PAGES)
      last_response.headers["Surrogate-Key"].should include(table.table_visualization.surrogate_key)
    end

    it 'renders embed map error page if visualization private' do
      table = table_factory
      put "/api/v1/tables/#{table.id}?api_key=#{@api_key}",
        { privacy: 0 }.to_json, @headers

      name = table.table_visualization.name
      name = URI::encode(name)

      login_as(@user, scope: @user.username)

      get "/viz/#{name}/embed_map", {}, @headers
      last_response.status.should == 403
      last_response.body.should include("Map or dataset not found, or with restricted access.")
    end

    it 'renders embed map error when an exception is raised' do
      login_as(@user, scope: @user.username)

      get "/viz/220d2f46-b371-11e4-93f7-080027880ca6/embed_map", {}, @headers
      last_response.status.should == 404
    end

    it 'doesnt serve X-Frame-Options: DENY on embedded with name' do
      table = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC)
      name = table.table_visualization.name

      get "/viz/#{URI::encode(name)}/embed_map", {}, @headers
      last_response.status.should == 200
      last_response.headers.include?('X-Frame-Options').should_not == true
    end

    it 'redirects to kuviz when needed' do
      kuviz = FactoryGirl.create(:kuviz_visualization, user_id: @user.id)

      get public_tables_embed_map_url(id: kuviz.id), {}, @headers
      last_response.status.should eq 302

      follow_redirect!

      uri = URI.parse(last_request.url)
      uri.host.should == "#{@user.username}.localhost.lan"
      uri.path.should == "/kuviz/#{kuviz.id}"
    end

    it 'redirects to app when needed' do
      app = FactoryGirl.create(:app_visualization, user_id: @user.id)

      get public_tables_embed_map_url(id: app.id), {}, @headers
      last_response.status.should eq 302

      follow_redirect!

      uri = URI.parse(last_request.url)
      uri.host.should == "#{@user.username}.localhost.lan"
      uri.path.should == "/app/#{app.id}"
    end
  end

  describe 'GET /viz/:id/embed_map' do
    it 'caches and serves public embed map successful responses' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id
      embed_redis_cache = EmbedRedisCache.new

      embed_redis_cache.get(id, https=false).should == nil
      get "/viz/#{id}/embed_map", {}, @headers
      last_response.status.should == 200

      # The https key/value pair should be differenent
      embed_redis_cache.get(id, https=true).should == nil
      last_response.status.should == 200

      # It should be cached after the first request
      embed_redis_cache.get(id, https=false).should_not be_nil
      first_response = last_response

      get "/viz/#{id}/embed_map", {}, @headers
      last_response.status.should == 200
      # Headers of both responses should be the same excluding some
      remove_changing = lambda {|h| h.reject {|k, v| ['X-Request-Id', 'X-Runtime'].include?(k)} }
      remove_changing.call(first_response.headers).should == remove_changing.call(last_response.headers)
      first_response.body.should == last_response.body
    end

    it 'doesnt serve X-Frame-Options: DENY on embedded' do
      id = table_factory(privacy: ::UserTable::PRIVACY_PUBLIC).table_visualization.id

      get "/viz/#{id}/embed_map", {}, @headers
      last_response.status.should == 200
      last_response.headers.include?('X-Frame-Options').should_not == true
    end
  end

  describe 'GET /viz/:name/track_embed' do
    it 'renders the view by passing a visualization name' do
      login_as(@user, scope: @user.username)

      get "/viz/track_embed", {}, @headers
      last_response.status.should == 200
    end

    it 'doesnt serve X-Frame-Options: DENY for track_embed' do
      login_as(@user, scope: @user.username)

      get "/viz/track_embed", {}, @headers
      last_response.status.should == 200
      last_response.headers.include?('X-Frame-Options').should_not == true
    end
  end

  describe 'non existent visualization' do
    it 'returns 404' do
      login_as(@user, scope: @user.username)

      get "/viz/220d2f46-b371-11e4-93f7-080027880ca6?api_key=#{@api_key}", {}, @headers
      last_response.status.should == 404

      get "/viz/220d2f46-b371-11e4-93f7-080027880ca6/public?api_key=#{@api_key}", {}, @headers
      last_response.status.should == 404

      get "/viz/220d2f46-b371-11e4-93f7-080027880ca6/embed_map?api_key=#{@api_key}", {}, @headers
      last_response.status.should == 404
    end
  end # non existent visualization

  describe 'org user visualization redirection' do
    it 'if A shares a (shared) vis link to B with A username, performs a redirect to B username' do
      Carto::ApiKey.any_instance.stubs(:save_cdb_conf_info)
      CartoDB::UserModule::DBService.any_instance.stubs(:move_to_own_schema).returns(nil)
      CartoDB::TablePrivacyManager.any_instance.stubs(
          :set_from_table_privacy => nil,
          :propagate_to_varnish => nil
      )

      ::User.any_instance.stubs(
        after_create: nil
      )

      CartoDB::UserModule::DBService.any_instance.stubs(
        grant_user_in_database: nil,
        grant_publicuser_in_database: nil,
        set_user_privileges_at_db: nil,
        set_statement_timeouts: nil,
        set_user_as_organization_member: nil,
        rebuild_quota_trigger: nil,
        setup_organization_user_schema: nil,
        set_database_search_path: nil,
        cartodb_extension_version_pre_mu?: false,
        load_cartodb_functions: nil,
        create_schema: nil,
        move_tables_to_schema: nil,
        create_public_db_user: nil,
        monitor_user_notification: nil,
        enable_remote_db_user: nil
      )

      Carto::NamedMaps::Api.any_instance.stubs(get: nil, create: true, update: true)

      Table.any_instance.stubs(perform_cartodb_function: nil,
                               update_cdb_tablemetadata: nil,
                               update_table_pg_stats: nil,
                               create_table_in_database!: nil,
                               get_table_id: 1,
                               grant_select_to_tiler_user: nil,
                               cartodbfy: nil,
                               set_the_geom_column!: nil)

      # --------TEST ITSELF-----------

      org = Organization.new
      org.name = 'vis-spec-org-2'
      org.quota_in_bytes = 1024 ** 3
      org.seats = 10
      org.builder_enabled = false
      org.save

      ::User.any_instance.stubs(:remaining_quota).returns(1000)
      user_a = create_user(username: 'user-a', quota_in_bytes: 123456789, table_quota: 400)
      user_org = CartoDB::UserOrganization.new(org.id, user_a.id)
      user_org.promote_user_to_admin
      org.reload
      user_a.reload

      user_b = create_user(username: 'user-b',
                           quota_in_bytes: 123456789,
                           table_quota: 400,
                           organization: org,
                           account_type: 'ORGANIZATION USER')

      # Needed because after_create is stubbed
      user_a.create_api_keys
      user_b.create_api_keys

      vis_id = factory(user_a).fetch('id')
      vis = CartoDB::Visualization::Member.new(id: vis_id).fetch
      vis.privacy = CartoDB::Visualization::Member::PRIVACY_PRIVATE
      vis.store

      login_host(user_b, org)

      get CartoDB.url(@mock_context, 'public_table', params: { id: vis.name }, user: user_a)
      last_response.status.should be(404)

      ['public_visualizations_public_map', 'public_tables_embed_map'].each do |forbidden_endpoint|
        get CartoDB.url(@mock_context, forbidden_endpoint, params: { id: vis.name }, user: user_a)
        follow_redirects
        last_response.status.should be(403), "#{forbidden_endpoint} is #{last_response.status}"
      end

      perm = vis.permission
      perm.set_user_permission(user_b, CartoDB::Permission::ACCESS_READONLY)
      perm.save

      get CartoDB.url(@mock_context, 'public_table', params: { id: vis.name }, user: user_a)
      last_response.status.should == 302
      # First we'll get redirected to the public map url
      follow_redirect!
      # Now url will get rewritten to current user
      last_response.status.should == 302
      url = CartoDB.base_url(org.name, user_b.username) +
            CartoDB.path(self, 'public_visualizations_show', id: "#{user_a.username}.#{vis.name}") + "?redirected=true"
      last_response.location.should eq url

      ['public_visualizations_public_map', 'public_tables_embed_map'].each do |forbidden_endpoint|
        get CartoDB.url(@mock_context, forbidden_endpoint, params: { id: vis.name }, user: user_a)
        follow_redirects
        last_response.status.should be(200), "#{forbidden_endpoint} is #{last_response.status}"
        last_response.length.should >= 100
      end
      org.destroy
    end

    # @see https://github.com/CartoDB/cartodb/issues/6081
    it 'If logged user navigates to legacy url from org user without org name, gets redirected properly' do
      Carto::ApiKey.any_instance.stubs(:save_cdb_conf_info)
      CartoDB::UserModule::DBService.any_instance.stubs(:move_to_own_schema).returns(nil)
      CartoDB::TablePrivacyManager.any_instance.stubs(
        set_from_table_privacy: nil,
        propagate_to_varnish: nil
      )

      ::User.any_instance.stubs(
        after_create: nil
      )

      CartoDB::UserModule::DBService.any_instance.stubs(
        grant_user_in_database: nil,
        grant_publicuser_in_database: nil,
        set_user_privileges_at_db: nil,
        set_statement_timeouts: nil,
        set_user_as_organization_member: nil,
        rebuild_quota_trigger: nil,
        setup_organization_user_schema: nil,
        set_database_search_path: nil,
        cartodb_extension_version_pre_mu?: false,
        load_cartodb_functions: nil,
        create_schema: nil,
        move_tables_to_schema: nil,
        create_public_db_user: nil,
        monitor_user_notification: nil,
        enable_remote_db_user: nil
      )

      Carto::NamedMaps::Api.any_instance.stubs(get: nil, create: true, update: true)
      Table.any_instance.stubs(
        perform_cartodb_function: nil,
        update_cdb_tablemetadata: nil,
        update_table_pg_stats: nil,
        create_table_in_database!: nil,
        get_table_id: 1,
        grant_select_to_tiler_user: nil,
        cartodbfy: nil,
        set_the_geom_column!: nil
      )

      # --------TEST ITSELF-----------

      org = Organization.new
      org.name = 'vis-spec-org'
      org.quota_in_bytes = 1024**3
      org.seats = 10
      org.builder_enabled = false
      org.save

      ::User.any_instance.stubs(:remaining_quota).returns(1000)
      user_a = create_user(quota_in_bytes: 123456789, table_quota: 400)
      user_org = CartoDB::UserOrganization.new(org.id, user_a.id)
      user_org.promote_user_to_admin
      org.reload
      user_a.reload

      user_b = create_user(quota_in_bytes: 123456789, table_quota: 400)

      # Needed because after_create is stubbed
      user_a.create_api_keys
      user_b.create_api_keys

      vis_id = factory(user_a).fetch('id')
      vis = CartoDB::Visualization::Member.new(id: vis_id).fetch
      vis.privacy = CartoDB::Visualization::Member::PRIVACY_PUBLIC
      vis.store

      login_host(user_b)

      # dirty but effective trick, generate the url as if were for a non-org user, then replace usernames
      # to respect format and just have no organization
      destination_url = CartoDB.url(@mock_context, 'public_visualizations_public_map',
                                    params: { id: vis.name }, user: user_b)
                               .sub(user_b.username, user_a.username)

      get destination_url
      last_response.status.should be(302)
      last_response.headers["Location"].should eq CartoDB.url(@mock_context, 'public_visualizations_public_map',
                                                              params: { id: vis.id, redirected: true }, user: user_a)
      follow_redirect!
      last_response.status.should be(200)

      org.destroy
    end
  end

  describe 'find visualizations by name' do
    before(:all) do
      @organization = create_organization_with_users(name: unique_name('organization'))
      @org_user = @organization.users.first
      bypass_named_maps
      @table = new_table(user_id: @org_user.id, privacy: ::UserTable::PRIVACY_PUBLIC).save.reload
      @faketable = new_table(user_id: @user.id, privacy: ::UserTable::PRIVACY_PUBLIC).save.reload
      @faketable_name = @faketable.table_visualization.name
    end

    it 'finds visualization by org and name' do
      url = CartoDB.url(@mock_context, 'public_table', params: { id: @table.table_visualization.name }, user: @org_user)
      url = url.sub("/u/#{@org_user.username}", '')

      get url
      last_response.status.should == 200
    end

    it 'does not find visualizations outside org' do
      url = CartoDB.url(@mock_context, 'public_table', params: { id: @faketable_name }, user: @org_user)
      url = url.sub("/u/#{@org_user.username}", '')

      get url
      last_response.status.should == 404
    end

    it 'finds visualization by user and public.name' do
      url = CartoDB.url(@mock_context, 'public_table',
                        params: { id: "public.#{@table.table_visualization.name}" }, user: @org_user)

      get url
      last_response.status.should == 200
    end

    it 'finds visualization by user and public.id' do
      url = CartoDB.url(@mock_context, 'public_table',
                        params: { id: "public.#{@table.table_visualization.id}" }, user: @org_user)

      get url
      last_response.status.should == 200
    end

    it 'does not find visualizations outside user with public schema' do
      url = CartoDB.url(@mock_context, 'public_table',
                        params: { id: "public.#{@faketable_name}" }, user: @org_user)
      url = url.sub("/u/#{@org_user.username}", '')

      get url
      last_response.status.should == 404
    end

    it 'does not try to search visualizations with invalid user/org' do
      url = CartoDB.url(@mock_context, 'public_table', params: { id: "public.#{@table.name}" }, user: @org_user)
      url = url.sub("/u/#{@org_user.username}", '/u/invalidus3r')

      get url
      last_response.status.should == 404
    end
  end

  def login_host(user, org = nil)
    login_as(user, scope: user.username)
    host! "#{org.nil? ? user.username : org.name}.localhost.lan"
  end

  def follow_redirects(limit = 10)
    while last_response.status == 302 && (limit -= 1) > 0 do
        follow_redirect!
    end
  end

  def factory(owner=nil)
    owner = @user if owner.nil?
    map     = Map.create(user_id: owner.id)
    payload = {
      name:         unique_name('viz'),
      tags:         ['foo', 'bar'],
      map_id:       map.id,
      description:  'bogus',
      type:         'derived'
    }

    with_host "#{owner.username}.localhost.lan" do
      post "/api/v1/viz?api_key=#{owner.api_key}", payload.to_json
    end


    JSON.parse(last_response.body)
  end

  def table_factory(attrs = {})
    new_table(attrs.merge(user_id: @user.id)).save.reload
  end

end # Admin::VisualizationsController