Rewrite authorization mechanism: more flexibility

Author: DrTom

spec/features/media_stores_spec.rb

@@ -16,7 +16,6 @@
     end
 
     it_displays "authentication error"
-    it_displays "authorization error"
   end
 
   context "for an ordinary user" do
@@ -63,13 +62,13 @@
     end
 
     specify "page has links to users" do
-      expect(page).to have_link("0", href: "/media-service/stores/legacy-file-store/users/")      
-      expect(page).to have_link("0", href: "/media-service/stores/database/users/")      
+      expect(page).to have_link("0", href: "/media-service/stores/legacy-file-store/users/")
+      expect(page).to have_link("0", href: "/media-service/stores/database/users/")
     end
 
     specify "page has links to groups" do
-      expect(page).to have_link("0", href: "/media-service/stores/legacy-file-store/groups/")      
-      expect(page).to have_link("0", href: "/media-service/stores/database/groups/")      
+      expect(page).to have_link("0", href: "/media-service/stores/legacy-file-store/groups/")
+      expect(page).to have_link("0", href: "/media-service/stores/database/groups/")
     end
   end
 end

spec/features/settings_spec.rb

@@ -21,7 +21,6 @@
       end
 
       it_displays "authentication error"
-      it_displays "authorization error"
     end
 
     context "for an ordinary user" do

spec/features/shared/authorization_error.rb

@@ -7,7 +7,7 @@
     visit path
     within(".modal") do
       expect(page).to have_css(".modal-header", text: "Request ERROR 403")
-      expect(page).to have_css(".modal-body", text: "System-admin scope required")
+      expect(page.find(".modal-body")).to have_content("system-admin")
     end
   end
 end

spec/features/stores/groups_spec.rb

@@ -15,7 +15,6 @@
     end
 
     it_displays "authentication error"
-    it_displays "authorization error"
   end
 
   context "for an ordinary user" do

spec/features/stores/users_spec.rb

@@ -15,7 +15,6 @@
     end
 
     it_displays "authentication error"
-    it_displays "authorization error"
   end
 
   context "for an ordinary user" do

spec/features/uploads_spec.rb

@@ -14,8 +14,7 @@
     it "displays modal with authentication error" do
       visit path
       within(".modal") do
-        expect(page).to have_css(".modal-header", text: "Request ERROR 403")
-        expect(page).to have_css(".modal-body", text: "Sign-in required")
+        expect(page).to have_css(".modal-header", text: "Request ERROR 401")
       end
     end
 

spec/requests/authorization_spec.rb

@@ -1,4 +1,4 @@
-describe "Authorization" do
+describe "Authorization to settings" do
   context "with token" do
     let!(:settings) { create(:media_service_setting) }
     let(:request) { faraday_client_with_token.get("settings/") }
@@ -51,7 +51,7 @@
         end
 
         it "responds with error message" do
-          expect(response.body).to include("System-admin scope required")
+          expect(response.body).to include("")
         end
       end
 
@@ -62,11 +62,8 @@
           expect(response.status).to eq(403)
         end
 
-        it "responds with error message" do
-          expect(response.body).to include("System-admin scope required")
-        end
       end
-        
+
       context "for an user with system admin role" do
         let(:user) { create(:user, :with_system_admin_role) }
 

spec/requests/settings_spec.rb

@@ -1,3 +1,4 @@
+require 'requests/shared/authentication_error'
 require 'requests/shared/system_admin_error'
 
 describe "Resources" do
@@ -26,7 +27,7 @@
 
       # it_raises "authorization error"
       # include_examples "system admin access only"
-      it_raises "system admin error"
+      it_raises "authentication error"
     end
 
     context "for an ordinary user" do

spec/requests/shared/authentication_error.rb

@@ -0,0 +1,18 @@
+RSpec.configure do |c|
+  c.alias_it_should_behave_like_to :it_raises
+end
+
+shared_examples "authentication error" do
+  let(:api_token) do
+    create(:api_token, user: user, scope_write: true) if user
+  end
+  let(:user_token) { api_token&.token_hash }
+
+  it "responds with 401 Forbidden status" do
+    expect(response.status).to eq(401)
+  end
+
+  it "responds with error message" do
+    expect(response.body).to include("Unauthorized - Authentication/Sign-in required")
+  end
+end

spec/requests/shared/authorization_error.rb

@@ -13,6 +13,6 @@
   end
 
   it "responds with error message" do
-    expect(response.body).to include("Sign-in required")
+    expect(response.body).to include("Authorization requirements not satisfied")
   end
 end