Fields definitions: Update/add tests

(cherry picked from commit 2586962)

Author: jlledom

features/developer_portal/admin/applications/extra_fields.feature

@@ -63,6 +63,28 @@ Feature: Developer portal application extra fields
       | Plate number |
       | Stealth      |
 
+  Scenario: Read-only extra fields are ignored if received
+    Given the following application:
+      | Buyer | Name       | Product |
+      | Jane  | Jane's App | The API |
+    And the application has the following extra fields:
+      | Description | It's a car |
+      | Engine      | 120        |
+      | Wheels      | 4          |
+      | Color       | White      |
+    When the buyer logs in
+    And the provider has the field "plate_number" for applications as editable
+    And they go to application "Jane's App" dev portal edit page
+    And the provider has the field "plate_number" for applications as read only
+    And the form is submitted with:
+      | Description  | It's a car |
+      | Engine       | 120        |
+      | Wheels       | 4          |
+      | Color        | White      |
+      | Plate number | edit me    |
+    Then they should see the flash message "Application was successfully updated"
+    And they should not see "Plate number"
+
   Scenario: Extra fields validation
     When they go to the dev portal new application page
     And the form is submitted with:

features/old/accounts/buyers/account_fields.feature

@@ -46,6 +46,18 @@ Feature: Buyer side, account fields
        And I press "Update"
      Then I should see "The account information was updated."
 
+  Scenario: Read-only extra fields are ignored on update
+    Given I log in as "bob" on foo.3scale.localhost
+    And provider "foo.3scale.localhost" has the field "non_editable" for accounts as editable
+    Then I go to the account edit page
+    And provider "foo.3scale.localhost" has the field "non_editable" for accounts as read only
+    And the form is submitted with:
+      | Required field | value  |
+      | False field    |        |
+      | Choices field  |      3 |
+      | Non editable   | edited |
+    Then I should see "The account information was updated."
+    Then I should not see "Non editable"
 
   Scenario: Viewing account with extra fields
     #TODO ugly table change this

features/step_definitions/provider_steps.rb

@@ -61,6 +61,12 @@ def import_simple_layout(provider)
   a.save!
 end
 
+Given "{provider} has the field {string} for {field_definition_target} as {read_only_status}" do |provider, name, target, read_only|
+  a = provider.fields_definitions.by_target(target).find { |fd| fd.name == name }
+  a.read_only = read_only
+  a.save!
+end
+
 Given "{provider} allows to change account plan {change_plan_permission}" do |provider, plan_permission|
   provider.set_change_account_plan_permission! plan_permission
 end

features/support/parameter_types.rb

@@ -469,3 +469,14 @@ def find_metric(metrics, name)
   regexp: /(.*)/,
   transformer: ->(selector) { selector_for(selector) }
 )
+
+ParameterType(
+  name: 'read_only_status',
+  regexp: /(editable|read only)/,
+  transformer: ->(value) do
+    {
+      'editable' => false,
+      'read only' => true,
+    }[value]
+  end
+)

test/integration/developer_portal/base_controller_test.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+module DeveloperPortal
+  class BaseControllerTest < ActionDispatch::IntegrationTest
+
+    class FilterReadOnlyParamsTest < BaseControllerTest
+      class TestController < DeveloperPortal::BaseController
+        skip_before_action :login_required
+
+        def create
+          render plain: filter_readonly_params(params[:user], User)
+        end
+      end
+
+      test 'filters out read-only fields' do
+        account = FactoryBot.create(:simple_provider)
+        ro_fields = FactoryBot.create_list(:fields_definition, 2, account:, read_only: true)
+        editable_fields = FactoryBot.create_list(:fields_definition, 3, account:)
+
+        ro_params = fields_to_hash(ro_fields)
+        editable_params = fields_to_hash(editable_fields)
+
+        TestController.any_instance.expects(:site_account).at_least_once.returns(account)
+
+        with_test_routes do
+          post '/test/create', params: { user: {**ro_params, **editable_params} }
+
+          assert_response :success
+          assert_equal editable_params.to_s, response.body
+        end
+      end
+    end
+
+    private
+
+    def fields_to_hash(fields)
+      fields.each_with_object({}) { |fd, p| p[fd.name]=SecureRandom.hex }
+    end
+
+    def with_test_routes
+      Rails.application.routes.draw do
+        post '/test/create' => 'developer_portal/base_controller_test/filter_read_only_params_test/test#create'
+      end
+      yield
+    ensure
+      Rails.application.routes_reloader.reload!
+    end
+  end
+end

test/unit/developer_portal/base_controller_test.rb

@@ -0,0 +1,25 @@
+require 'test_helper'
+
+module DeveloperPortal
+  class BaseControllerTest < ActiveSupport::TestCase
+
+    class TestController < DeveloperPortal::BaseController; end
+
+    class FilterReadOnlyParamsTest < BaseControllerTest
+
+      test 'filters out read-only fields' do
+        account = FactoryBot.create(:simple_provider)
+        ro_fields = FactoryBot.create_list(:fields_definition, 2, account:, read_only: true)
+        FactoryBot.create_list(:fields_definition, 3, account:)
+        params = account.fields_definitions.each_with_object({}) { |fd, p| p[fd.name]=SecureRandom.hex }
+        TestController.any_instance.expects(:site_account).returns(account)
+
+        result = TestController.new.send(:filter_readonly_params, params, User)
+
+        assert_equal 3, result.size
+        assert_not_includes result, ro_fields.map(&:name)
+      end
+
+    end
+  end
+end