425 lines
16 KiB
Ruby
425 lines
16 KiB
Ruby
require_relative '../../../../spec_helper'
|
|
require_relative '../../../../factories/organizations_contexts.rb'
|
|
require 'helpers/feature_flag_helper'
|
|
|
|
describe Carto::Builder::Public::EmbedsController do
|
|
include Warden::Test::Helpers, Carto::Factories::Visualizations, HelperMethods
|
|
include FeatureFlagHelper
|
|
|
|
before(:all) do
|
|
bypass_named_maps
|
|
@user = FactoryGirl.create(:valid_user, private_maps_enabled: true)
|
|
@carto_user = Carto::User.find(@user.id)
|
|
@map = FactoryGirl.create(:map, user_id: @user.id)
|
|
@visualization = FactoryGirl.create(:carto_visualization, user: @carto_user, map_id: @map.id, version: 3)
|
|
# Only mapcapped visualizations are presented by default
|
|
Carto::Mapcap.create!(visualization_id: @visualization.id)
|
|
end
|
|
|
|
before(:each) do
|
|
bypass_named_maps
|
|
Carto::Visualization.any_instance.stubs(:organization?).returns(false)
|
|
Carto::Visualization.any_instance.stubs(:get_auth_tokens).returns(['trusty_token'])
|
|
end
|
|
|
|
after(:all) do
|
|
@map.destroy
|
|
@visualization.destroy
|
|
User[@user.id].destroy
|
|
@feature_flag.destroy
|
|
end
|
|
|
|
def stub_passwords(password)
|
|
Carto::Visualization.any_instance.stubs(:has_password?).returns(true)
|
|
Carto::Visualization.any_instance.stubs(:password_valid?).returns(false)
|
|
Carto::Visualization.any_instance.stubs(:password_valid?).with(password).returns(true)
|
|
end
|
|
|
|
TEST_PASSWORD = 'manolo'.freeze
|
|
|
|
describe '#show' do
|
|
it 'does not display public visualizations without mapcaps' do
|
|
unpublished_visualization = FactoryGirl.create(:carto_visualization, user: @carto_user, map_id: @map.id, version: 3, privacy: Carto::Visualization::PRIVACY_PUBLIC)
|
|
get builder_visualization_public_embed_url(visualization_id: unpublished_visualization.id)
|
|
response.status.should == 404
|
|
|
|
unpublished_visualization.map = nil
|
|
unpublished_visualization.destroy
|
|
end
|
|
|
|
it 'does not display link visualizations without mapcaps' do
|
|
unpublished_visualization = FactoryGirl.create(:carto_visualization, user: @carto_user, map_id: @map.id, version: 3, privacy: Carto::Visualization::PRIVACY_LINK)
|
|
get builder_visualization_public_embed_url(visualization_id: unpublished_visualization.id)
|
|
response.status.should == 404
|
|
|
|
unpublished_visualization.map = nil
|
|
unpublished_visualization.destroy
|
|
end
|
|
|
|
it 'does not display visualizations without mapcaps' do
|
|
unpublished_visualization = FactoryGirl.create(:carto_visualization, user: @carto_user, map_id: @map.id, version: 3)
|
|
get builder_visualization_public_embed_url(visualization_id: unpublished_visualization.id)
|
|
response.status.should == 404
|
|
|
|
unpublished_visualization.map = nil
|
|
unpublished_visualization.destroy
|
|
end
|
|
|
|
it 'displays published layers, not ("live") visualization layers' do
|
|
@map, @table, @table_visualization, @visualization = create_full_builder_vis(@carto_user)
|
|
Carto::Mapcap.create!(visualization_id: @visualization.id)
|
|
|
|
layer = @visualization.layers[1]
|
|
old_tile_style = layer.options['tile_style']
|
|
|
|
new_layer_style = '#layer { marker-width: 7; }'
|
|
layer.options['tile_style'] = new_layer_style
|
|
layer.save
|
|
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should_not include(new_layer_style)
|
|
response.body.should include(old_tile_style)
|
|
|
|
destroy_full_visualization(@map, @table, @table_visualization, @visualization)
|
|
end
|
|
|
|
it 'embeds visualizations' do
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.include?(@visualization.name).should be true
|
|
end
|
|
|
|
it 'sends caching headers' do
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.headers['X-Cache-Channel'].should eq "#{@visualization.varnish_key}:vizjson"
|
|
response.headers['Surrogate-Key'].should eq "#{CartoDB::SURROGATE_NAMESPACE_PUBLIC_PAGES} #{@visualization.surrogate_key}"
|
|
response.headers['Cache-Control'].should eq "no-cache,max-age=86400,must-revalidate,public"
|
|
end
|
|
|
|
describe 'connectivity issues' do
|
|
it 'does not need connection to the user db' do
|
|
@map, @table, @table_visualization, @visualization = create_full_builder_vis(@carto_user)
|
|
Carto::Mapcap.create!(visualization_id: @visualization.id)
|
|
|
|
@actual_database_name = @visualization.user.database_name
|
|
@visualization.user.update_attribute(:database_name, 'wadus')
|
|
|
|
CartoDB::Logger.expects(:warning).never
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
response.status.should == 200
|
|
|
|
@visualization.user.update_attribute(:database_name, @actual_database_name)
|
|
destroy_full_visualization(@map, @table, @table_visualization, @visualization)
|
|
end
|
|
end
|
|
|
|
it 'redirects to builder for v2 visualizations' do
|
|
Carto::Visualization.any_instance.stubs(:version).returns(2)
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 302
|
|
end
|
|
|
|
it 'does not include auth tokens for public/link visualizations' do
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should include("var authTokens = JSON.parse('[]');")
|
|
end
|
|
|
|
it 'does not include google maps if not configured' do
|
|
@map.provider = 'googlemaps'
|
|
@map.save
|
|
@visualization.create_mapcap!
|
|
@user.google_maps_key = ''
|
|
@user.save
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should_not include("maps.googleapis.com/maps/api/js")
|
|
end
|
|
|
|
it 'includes the google maps client id if configured' do
|
|
@map.provider = 'googlemaps'
|
|
@map.save
|
|
@visualization.create_mapcap!
|
|
@user.google_maps_key = 'client=wadus_cid'
|
|
@user.save
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should include("maps.googleapis.com/maps/api/js?v=3.32&client=wadus_cid")
|
|
end
|
|
|
|
it 'does not includes google maps if the maps does not need it' do
|
|
@map.provider = 'leaflet'
|
|
@map.save
|
|
@visualization.create_mapcap!
|
|
@user.google_maps_key = 'client=wadus_cid'
|
|
@user.save
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should_not include("maps.googleapis.com/maps/api/js")
|
|
end
|
|
|
|
it 'includes 3rd party scripts for analytics' do
|
|
Cartodb.with_config(
|
|
trackjs: {
|
|
'customer' => 'fake_trackjs_customer',
|
|
'frequency' => 1
|
|
},
|
|
metrics: {
|
|
'hubspot': {
|
|
'enabled' => true,
|
|
'token' => 'fake_hubspot_token'
|
|
}
|
|
},
|
|
google_tag_manager_id: 'google_tag_manager_id'
|
|
) do
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.body.should include("d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js")
|
|
end
|
|
end
|
|
|
|
it 'does not include 3rd party scripts if cookies=0 query param is present' do
|
|
Cartodb.with_config(
|
|
trackjs: {
|
|
'customer' => 'fake_trackjs_customer',
|
|
'frequency' => 1
|
|
},
|
|
metrics: {
|
|
'hubspot': {
|
|
'enabled' => true,
|
|
'token' => 'fake_hubspot_token'
|
|
}
|
|
},
|
|
google_tag_manager_id: 'google_tag_manager_id'
|
|
) do
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id, cookies: '0')
|
|
|
|
response.body.should_not include("d2zah9y47r7bi2.cloudfront.net/releases/current/tracker.js")
|
|
end
|
|
end
|
|
|
|
it 'does not embed password protected viz' do
|
|
stub_passwords(TEST_PASSWORD)
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PROTECTED
|
|
@visualization.save
|
|
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.body.include?('Protected map').should be true
|
|
response.status.should == 403
|
|
end
|
|
|
|
it 'returns 404 for inexistent visualizations' do
|
|
get builder_visualization_public_embed_url(visualization_id: UUIDTools::UUID.timestamp_create.to_s)
|
|
|
|
response.status.should == 404
|
|
end
|
|
|
|
describe 'private visualizations' do
|
|
it 'cannot be embedded' do
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PRIVATE
|
|
@visualization.save
|
|
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.body.include?('Embed error | CARTO').should be true
|
|
response.status.should == 404
|
|
end
|
|
|
|
it 'can be embedded if logged in' do
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PRIVATE
|
|
@visualization.save
|
|
|
|
login_as(@user)
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should include @visualization.name
|
|
end
|
|
|
|
it 'include auth tokens in embed' do
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PRIVATE
|
|
@visualization.save
|
|
|
|
login_as(@user)
|
|
get builder_visualization_public_embed_url(visualization_id: @visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should include @visualization.name
|
|
|
|
@user.reload
|
|
auth_tokens = @user.get_auth_tokens
|
|
auth_tokens.each { |token| response.body.should include token }
|
|
end
|
|
end
|
|
|
|
describe 'in organizations' do
|
|
include_context 'organization with users helper'
|
|
|
|
before(:each) do
|
|
@org_map = FactoryGirl.create(:map, user_id: @org_user_owner.id)
|
|
@org_visualization = FactoryGirl.create(:carto_visualization, user: @carto_org_user_owner, map_id: @org_map.id, version: 3)
|
|
@org_visualization.privacy = Carto::Visualization::PRIVACY_PRIVATE
|
|
@org_visualization.save
|
|
|
|
# Only mapcapped visualizations are presented by default
|
|
Carto::Mapcap.create!(visualization_id: @org_visualization.id)
|
|
|
|
share_visualization(@org_visualization, @org_user_1)
|
|
Carto::Visualization.any_instance.unstub(:organization?)
|
|
Carto::Visualization.any_instance.stubs(:needed_auth_tokens).returns([])
|
|
|
|
@org_map2 = FactoryGirl.create(:map, user_id: @org_user_owner.id)
|
|
|
|
@org_protected_visualization = FactoryGirl.create(
|
|
:carto_visualization,
|
|
user: @carto_org_user_owner,
|
|
map_id: @org_map2.id,
|
|
version: 3,
|
|
privacy: Carto::Visualization::PRIVACY_PROTECTED,
|
|
encrypted_password: 'xxx',
|
|
password_salt: 'yyy'
|
|
)
|
|
share_visualization(@org_protected_visualization, @org_user_1)
|
|
end
|
|
|
|
it 'does not embed private visualizations' do
|
|
get builder_visualization_public_embed_url(visualization_id: @org_visualization.id)
|
|
|
|
response.status.should == 404
|
|
response.body.should include 'Embed error | CARTO'
|
|
end
|
|
|
|
it 'embeds private visualizations if logged in as allowed user' do
|
|
login_as(@org_user_1)
|
|
get builder_visualization_public_embed_url(visualization_id: @org_visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should include @org_visualization.name
|
|
end
|
|
|
|
it 'embeds protected visualizations if logged in as allowed user with the right password' do
|
|
login_as(@org_user_1)
|
|
|
|
stub_passwords(TEST_PASSWORD)
|
|
|
|
post builder_visualization_public_embed_protected_url(visualization_id: @org_protected_visualization.id, password: TEST_PASSWORD)
|
|
|
|
response.status.should == 200
|
|
response.body.should include @org_protected_visualization.id
|
|
end
|
|
|
|
it 'returns 403 for private visualizations if logged in is not an allowed user' do
|
|
login_as(@org_user_2)
|
|
get builder_visualization_public_embed_url(visualization_id: @org_visualization.id)
|
|
|
|
response.status.should == 404
|
|
response.body.should include 'Embed error | CARTO'
|
|
end
|
|
|
|
it 'includes auth tokens for privately shared visualizations' do
|
|
login_as(@org_user_1)
|
|
get builder_visualization_public_embed_url(visualization_id: @org_visualization.id)
|
|
|
|
response.status.should == 200
|
|
@org_user_1.reload
|
|
auth_tokens = @org_user_1.get_auth_tokens
|
|
auth_tokens.count.should eq 2
|
|
auth_tokens.each { |token| response.body.should include token }
|
|
end
|
|
|
|
it 'includes the organizations google maps client id if configured' do
|
|
@org_visualization.map.provider = 'googlemaps'
|
|
@org_visualization.map.save
|
|
@org_visualization.create_mapcap!
|
|
@organization.google_maps_key = 'client=wadus_org_cid'
|
|
@organization.save
|
|
login_as(@org_user_1)
|
|
get builder_visualization_public_embed_url(visualization_id: @org_visualization.id)
|
|
|
|
response.status.should == 200
|
|
response.body.should include("maps.googleapis.com/maps/api/js?v=3.32&client=wadus_org_cid")
|
|
end
|
|
end
|
|
end
|
|
|
|
describe '#show_protected' do
|
|
it 'does not display visualizations without mapcaps' do
|
|
stub_passwords(TEST_PASSWORD)
|
|
unpublished_visualization = FactoryGirl.create(:carto_visualization, user: @carto_user, map_id: @map.id, version: 3, privacy: Carto::Visualization::PRIVACY_PROTECTED)
|
|
unpublished_visualization.published?.should be_false
|
|
|
|
|
|
post builder_visualization_public_embed_protected_url(visualization_id: unpublished_visualization.id, password: TEST_PASSWORD)
|
|
|
|
response.body.include?('Invalid password').should be false
|
|
response.status.should == 404
|
|
|
|
unpublished_visualization.map = nil
|
|
unpublished_visualization.destroy
|
|
end
|
|
|
|
it 'does display published visualizations' do
|
|
stub_passwords(TEST_PASSWORD)
|
|
published_visualization = FactoryGirl.create(:carto_visualization, user: @carto_user, map_id: @map.id, version: 3, privacy: Carto::Visualization::PRIVACY_PROTECTED)
|
|
Carto::Mapcap.create!(visualization_id: published_visualization.id)
|
|
published_visualization.published?.should be_true
|
|
|
|
|
|
post builder_visualization_public_embed_protected_url(visualization_id: published_visualization.id, password: TEST_PASSWORD)
|
|
|
|
response.status.should == 200
|
|
|
|
published_visualization.map = nil
|
|
published_visualization.destroy
|
|
end
|
|
|
|
it 'rejects incorrect passwords' do
|
|
stub_passwords(TEST_PASSWORD)
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PROTECTED
|
|
@visualization.save
|
|
|
|
|
|
post builder_visualization_public_embed_protected_url(visualization_id: @visualization.id, password: "${TEST_PASSWORD}NO!")
|
|
|
|
response.body.include?('Invalid password').should be true
|
|
response.status.should == 403
|
|
end
|
|
|
|
it 'accepts correct passwords' do
|
|
stub_passwords(TEST_PASSWORD)
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PROTECTED
|
|
@visualization.save
|
|
|
|
|
|
post builder_visualization_public_embed_protected_url(visualization_id: @visualization.id, password: TEST_PASSWORD)
|
|
|
|
response.body.include?('Invalid password').should_not be true
|
|
response.body.include?(@visualization.name).should be true
|
|
response.status.should == 200
|
|
end
|
|
|
|
it 'includes auth tokens' do
|
|
stub_passwords(TEST_PASSWORD)
|
|
@visualization.privacy = Carto::Visualization::PRIVACY_PROTECTED
|
|
@visualization.save
|
|
|
|
|
|
post builder_visualization_public_embed_protected_url(visualization_id: @visualization.id, password: TEST_PASSWORD)
|
|
|
|
response.status.should == 200
|
|
@visualization.get_auth_tokens.each { |token| response.body.should include token }
|
|
end
|
|
end
|
|
end
|