end
end
+ [:admin, :active].each do |token|
+ test "using '#{token}', get token details via 'current'" do
+ authorize_with token
+ get :current
+ assert_response 200
+ assert_equal json_response['scopes'], ['all']
+ end
+ end
+
[# anyone can look up the token they're currently using
[:admin, :admin, 200, 200, 1],
[:active, :active, 200, 200, 1],
api_client_authorizations(:active).api_token)
end
+ test "get current token using SystemRootToken" do
+ Rails.configuration.SystemRootToken = "xyzzy-systemroottoken"
+ authorize_with_token Rails.configuration.SystemRootToken
+ get :current
+ assert_response :success
+ assert_equal(Rails.configuration.SystemRootToken, json_response['api_token'])
+ assert_not_empty(json_response['uuid'])
+ end
+
+ [
+ :active_noscope,
+ :active_all_collections,
+ :active_userlist,
+ :foo_collection_sharing_token,
+ ].each do |auth|
+ test "#{auth} can get current token without the appropriate scope" do
+ authorize_with auth
+ get :current
+ assert_response :success
+ end
+ end
+
test "get current token, no auth" do
get :current
assert_response 401
end
+
+ # Tests regression #18801
+ test "select param is respected in 'show' response" do
+ authorize_with :active
+ get :show, params: {
+ id: api_client_authorizations(:active).uuid,
+ select: ["uuid"],
+ }
+ assert_response :success
+ assert_raises ActiveModel::MissingAttributeError do
+ assigns(:object).api_token
+ end
+ assert_nil json_response["expires_at"]
+ assert_nil json_response["api_token"]
+ assert_equal api_client_authorizations(:active).uuid, json_response["uuid"]
+ end
end