Redmine

  before_action :find_board, :only => [:index, :create, :new, :preview]

  before_action :find_topic, :only => [:replies, :create_reply]

  before_action :find_message, :only => [:show, :reply, :edit, :update, :destroy, :quote]

  before_action :authorize, :except => [:preview, :edit, :update, :destroy]

  accept_api_auth :index, :show, :create, :update, :destroy, :replies, :create_reply

  # List topics of a board

  def index

    @offset, @limit = api_offset_and_limit

    scope = @board.topics

    @message_count = scope.count

    @messages = scope.

      reorder(:sticky => :desc, :id => :desc).

      includes(:author, :parent, {:last_reply => :author}, {:board => :project}).

      limit(@limit).

      offset(@offset).

      to_a

    respond_to do |format|

      format.html {render_404}

      format.api {render :action => 'topics'}

    end

  end

    respond_to do |format|

      format.html do

        page = params[:page]

        # Find the page of the requested reply

        if params[:r] && page.nil?

          offset = @topic.children.where("#{Message.table_name}.id < ?", params[:r].to_i).count

          page = 1 + offset / REPLIES_PER_PAGE

        end

        @reply_count = @topic.children.count

        @reply_pages = Paginator.new @reply_count, REPLIES_PER_PAGE, page

        @replies =  @topic.children.

          includes(:author, :attachments, {:board => :project}).

          reorder("#{Message.table_name}.created_on ASC, #{Message.table_name}.id ASC").

          limit(@reply_pages.per_page).

          offset(@reply_pages.offset).

          to_a

        Message.preload_reaction_details(@replies)

        @reply = Message.new(:subject => "RE: #{@message.subject}")

        render :action => "show", :layout => false if request.xhr?

      end

      format.api

    end

  end

  # Create a new topic through the REST API

  def create

    @message = Message.new

    @message.author = User.current

    @message.board = @board

    @message.safe_attributes = params[:message]

    # Ignore board_id overrides from the request body for this scoped API.

    @message.board = @board

    @message.save_attachments(params[:attachments] || (params[:message] && params[:message][:uploads]))

    if @message.save

      call_hook(:controller_messages_new_after_save, {:params => params, :message => @message})

      render_attachment_warning_if_needed(@message)

      respond_to do |format|

        format.html {render_404}

        format.api do

          render(

            :action => 'show',

            :status => :created,

            :location => message_url(@message)

          )

        end

      end

    else

      respond_to do |format|

        format.html {render_404}

        format.api {render_validation_errors(@message)}

      end

    end

  # List replies of a topic

  def replies

    @offset, @limit = api_offset_and_limit

    scope = @topic.children

    @message_count = scope.count

    @messages = scope.

      includes(:author, :parent, {:last_reply => :author}, {:board => :project}).

      reorder("#{Message.table_name}.created_on ASC, #{Message.table_name}.id ASC").

      limit(@limit).

      offset(@offset).

      to_a

    respond_to do |format|

      format.html {render_404}

      format.api

    end

  end

  # Reply to a topic through the REST API

  def create_reply

    @reply = Message.new(:subject => "RE: #{@topic.subject}")

    @reply.author = User.current

    @reply.board = @board

    @reply.safe_attributes = params[:reply]

    # Ignore board_id overrides from the request body for this scoped API.

    @reply.board = @board

    @reply.save_attachments(params[:attachments] || (params[:reply] && params[:reply][:uploads]))

    @topic.children << @reply

    if @reply.new_record?

      respond_to do |format|

        format.html {render_404}

        format.api {render_validation_errors(@reply)}

      end

    else

      call_hook(:controller_messages_reply_after_save, {:params => params, :message => @reply})

      render_attachment_warning_if_needed(@reply)

      @message = @reply

      respond_to do |format|

        format.html {render_404}

        format.api do

          render(

            :action => 'show',

            :status => :created,

            :location => message_url(@reply)

          )

        end

      end

    end

  end

  def update

    (render_403; return false) unless @message.editable_by?(User.current)

    project = @message.project

    @message.safe_attributes = params[:message]

    unless project.boards.exists?(@message.board_id)

      @message.errors.add(:board_id, :invalid)

      respond_to do |format|

        format.html {render_404}

        format.api {render_validation_errors(@message)}

      end

      return

    end

    @message.save_attachments(params[:attachments] || (params[:message] && params[:message][:uploads]))

    if @message.save

      render_attachment_warning_if_needed(@message)

      respond_to do |format|

        format.html {render_404}

        format.api {render_api_ok}

      end

    else

      respond_to do |format|

        format.html {render_404}

        format.api {render_validation_errors(@message)}

      end

    end

  end

    respond_to do |format|

      format.html do

        flash[:notice] = l(:notice_successful_delete)

        if @message.parent

          redirect_to board_message_path(@board, @message.parent, :r => r)

        else

          redirect_to project_board_path(@project, @board)

        end

      end

      format.api {render_api_ok}

    if params[:board_id]

      return unless find_board

      @message = @board.messages.includes(:parent).find(params[:id])

    else

      @message = Message.visible.includes(:parent, :author, :attachments, {:board => :project}).find(params[:id])

      @board = @message.board

      @project = @board.project

    end

  def find_topic

    @topic = Message.visible.includes(:author, :parent, {:board => :project}).find(params[:topic_id])

    if @topic.parent

      render_404

      return false

    end

    @board = @topic.board

    @project = @board.project

  rescue ActiveRecord::RecordNotFound

    render_404

  end

  def render_api_message(message, api)

    api.id message.id

    api.project(:id => message.project.id, :name => message.project.name)

    api.board(:id => message.board_id, :name => message.board.name)

    api.parent(:id => message.parent_id, :subject => message.parent.subject) unless message.parent.nil?

    api.root(:id => message.root.id, :subject => message.root.subject)

    api.author(:id => message.author_id, :name => message.author.name) unless message.author.nil?

    api.subject message.subject

    api.content message.content

    api.replies_count message.replies_count

    render_api_message_last_reply(message.last_reply, api) unless message.last_reply.nil?

    api.locked message.locked?

    api.sticky message.sticky?

    api.created_on message.created_on

    api.updated_on message.updated_on

    if include_in_api_response?('attachments')

      api.array :attachments do

        message.attachments.each do |attachment|

          render_api_attachment(attachment, api)

        end

      end

    end

  end

  def render_api_message_last_reply(message, api)

    api.last_reply(:id => message.id) do

      api.author(:id => message.author_id, :name => message.author.name) unless message.author.nil?

      api.subject message.subject

      api.created_on message.created_on

    end

  end

api.array :replies, api_meta(:total_count => @message_count, :offset => @offset, :limit => @limit) do

  @messages.each do |message|

    api.reply do

      render_api_message(message, api)

    end

  end

end

api.message do

  render_api_message(@message, api)

end

api.array :topics, api_meta(:total_count => @message_count, :offset => @offset, :limit => @limit) do

  @messages.each do |message|

    api.topic do

      render_api_message(message, api)

    end

  end

end

  get 'boards/:board_id/topics.:format', :to => 'messages#index', :constraints => {:format => /xml|json/}

  post 'boards/:board_id/topics.:format', :to => 'messages#create', :constraints => {:format => /xml|json/}

  get 'messages/:topic_id/replies.:format', :to => 'messages#replies', :constraints => {:format => /xml|json/}

  post 'messages/:topic_id/replies.:format', :to => 'messages#create_reply', :constraints => {:format => /xml|json/}

  get 'messages/:id.:format', :to => 'messages#show', :as => 'message', :constraints => {:format => /xml|json/}

  put 'messages/:id.:format', :to => 'messages#update', :constraints => {:format => /xml|json/}

  patch 'messages/:id.:format', :to => 'messages#update', :constraints => {:format => /xml|json/}

  delete 'messages/:id.:format', :to => 'messages#destroy', :constraints => {:format => /xml|json/}

          map.permission :view_messages, {:boards => [:index, :show], :messages => [:index, :show, :replies]}, :read => true

          map.permission :add_messages, {:messages => [:new, :create, :reply, :create_reply, :quote], :attachments => :upload}

          map.permission :edit_messages, {:messages => [:edit, :update], :attachments => :upload}, :require => :member

          map.permission :edit_own_messages, {:messages => [:edit, :update], :attachments => :upload}, :require => :loggedin

  def test_messages

    should_route 'GET /boards/1/topics' => 'messages#index', :board_id => '1'

    should_route 'POST /boards/1/topics' => 'messages#create', :board_id => '1'

    should_route 'GET /messages/1/replies' => 'messages#replies', :topic_id => '1'

    should_route 'POST /messages/1/replies' => 'messages#create_reply', :topic_id => '1'

    should_route 'GET /messages/2' => 'messages#show', :id => '2'

    should_route 'PUT /messages/2' => 'messages#update', :id => '2'

    should_route 'DELETE /messages/2' => 'messages#destroy', :id => '2'

  end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../test_helper'

class Redmine::ApiTest::MessagesTest < Redmine::ApiTest::Base

  test "GET /boards/:board_id/topics.xml should return the board topics" do

    get '/boards/1/topics.xml', :headers => credentials('jsmith')

    assert_response :success

    assert_equal 'application/xml', @response.media_type

    assert_select 'topics[type=array] topic id', :text => '4'

    assert_select 'topics[type=array] topic parent', 0

  end

  test "POST /boards/:board_id/topics.xml should create a topic" do

    assert_difference 'Message.count' do

      post(

        '/boards/1/topics.xml',

        :params => {:message => {:subject => 'API topic', :content => 'API topic body'}},

        :headers => credentials('jsmith'))

    end

    message = Message.order(id: :desc).first

    assert_response :created

    assert_equal 'application/xml', @response.media_type

    assert_nil message.parent

    assert_equal 'API topic', message.subject

    assert_equal 'API topic body', message.content

    assert_equal Board.find(1), message.board

    assert_select 'message id', :text => message.id.to_s

  end

  test "POST /boards/:board_id/topics.xml should ignore board_id parameter" do

    assert_difference 'Message.count' do

      post(

        '/boards/1/topics.xml',

        :params => {

          :message => {

            :subject => 'API topic',

            :content => 'API topic body',

            :board_id => 2

          }

        },

        :headers => credentials('jsmith'))

    end

    assert_response :created

    assert_equal Board.find(1), Message.order(id: :desc).first.board

  end

  test "POST /boards/:board_id/topics.xml with attachment should create a topic with attachment" do

    token = xml_upload('File content', credentials('jsmith'))

    attachment = Attachment.find_by_token(token)

    assert_difference 'Message.count' do

      post(

        '/boards/1/topics.xml',

        :params => {

          :message => {

            :subject => 'API topic with attachment',

            :content => 'API topic body'

          },

          :attachments => [

            {

              :token => token,

              :filename => 'message.txt',

              :content_type => 'text/plain'

            }

          ]

        },

        :headers => credentials('jsmith'))

    end

    message = Message.order(id: :desc).first

    assert_response :created

    assert_equal attachment, message.attachments.first

    attachment.reload

    assert_equal 'message.txt', attachment.filename

    assert_equal 'text/plain', attachment.content_type

    assert_equal 2, attachment.author_id

  end

  test "POST /boards/:board_id/topics.xml with invalid parameters should return errors" do

    assert_no_difference 'Message.count' do

      post(

        '/boards/1/topics.xml',

        :params => {:message => {:subject => '', :content => 'API topic body'}},

        :headers => credentials('jsmith'))

    end

    assert_response :unprocessable_content

    assert_equal 'application/xml', @response.media_type

    assert_select 'errors error', :text => 'Subject cannot be blank'

  end

  test "GET /messages/:topic_id/replies.xml should return replies" do

    get '/messages/1/replies.xml', :headers => credentials('jsmith')

    assert_response :success

    assert_equal 'application/xml', @response.media_type

    assert_select 'replies[type=array] reply id', :text => '2'

    assert_select 'replies[type=array] reply parent[id="1"][subject="First post"]'

  end

  test "POST /messages/:topic_id/replies.xml should create a reply" do

    assert_difference 'Message.count' do

      post(

        '/messages/1/replies.xml',

        :params => {:reply => {:content => 'API reply body'}},

        :headers => credentials('jsmith'))

    end

    reply = Message.order(id: :desc).first

    assert_response :created

    assert_equal 'application/xml', @response.media_type

    assert_equal Message.find(1), reply.parent

    assert_equal 'RE: First post', reply.subject

    assert_equal 'API reply body', reply.content

    assert_select 'message id', :text => reply.id.to_s

  end

  test "POST /messages/:topic_id/replies.xml should ignore board_id parameter" do

    assert_difference 'Message.count' do

      post(

        '/messages/1/replies.xml',

        :params => {:reply => {:content => 'API reply body', :board_id => 2}},

        :headers => credentials('jsmith'))

    end

    reply = Message.order(id: :desc).first

    assert_response :created

    assert_equal Message.find(1), reply.parent

    assert_equal Board.find(1), reply.board

  end

  test "POST /messages/:topic_id/replies.xml to locked topic should return errors" do

    Message.find(1).update!(:locked => true)

    assert_no_difference 'Message.count' do

      post(

        '/messages/1/replies.xml',

        :params => {:reply => {:content => 'API reply body'}},

        :headers => credentials('jsmith'))

    end

    assert_response :unprocessable_content

    assert_equal 'application/xml', @response.media_type

    assert_select 'errors error', :text => 'Topic is locked'

  end

  test "POST /messages/:topic_id/replies without API format should not create a reply" do

    assert_no_difference 'Message.count' do

      post(

        '/messages/1/replies',

        :params => {:reply => {:content => 'HTML reply body'}},

        :headers => credentials('jsmith'))

    end

    assert_response :not_found

  end

  test "GET /messages/:id.xml should return a topic by message id" do

    get '/messages/1.xml', :headers => credentials('jsmith')

    assert_response :success

    assert_equal 'application/xml', @response.media_type

    assert_select 'message' do

      assert_select 'id', :text => '1'

      assert_select 'project[id="1"][name="eCookbook"]'

      assert_select 'board[id="1"][name="Help"]'

      assert_select 'root[id="1"][subject="First post"]'

      assert_select 'subject', :text => 'First post'

      assert_select 'replies_count', :text => '2'

    end

  end

  test "GET /messages/:id.xml should return a reply by message id" do

    get '/messages/2.xml', :headers => credentials('jsmith')

    assert_response :success

    assert_equal 'application/xml', @response.media_type

    assert_select 'message' do

      assert_select 'id', :text => '2'

      assert_select 'parent[id="1"][subject="First post"]'

      assert_select 'root[id="1"][subject="First post"]'

      assert_select 'subject', :text => 'First reply'

    end

  end

  test "GET /messages/:id.xml without permission should return 404" do

    get '/messages/7.xml'

    assert_response :not_found

  end

  test "PUT /messages/:id.xml should update a message" do

    put(

      '/messages/1.xml',

      :params => {:message => {:subject => 'Updated topic', :content => 'Updated topic body'}},

      :headers => credentials('jsmith'))

    assert_response :no_content

    assert_equal '', @response.body

    assert_equal 'Updated topic', Message.find(1).subject

    assert_equal 'Updated topic body', Message.find(1).content

  end

  test "PUT /messages/:id.xml should allow moving a message to a board in the same project" do

    put(

      '/messages/1.xml',

      :params => {:message => {:board_id => 2}},

      :headers => credentials('jsmith'))

    assert_response :no_content

    assert_equal Board.find(2), Message.find(1).board

  end

  test "PUT /messages/:id.xml should not move a message to a board in another project" do

    put(

      '/messages/1.xml',

      :params => {:message => {:board_id => 3}},

      :headers => credentials('jsmith'))

    assert_response :unprocessable_content

    assert_equal Board.find(1), Message.find(1).board

  end

  test "DELETE /messages/:id.xml should destroy a message" do

    assert_difference 'Message.count', -1 do

      delete '/messages/2.xml', :headers => credentials('jsmith')

    end

    assert_response :no_content

    assert_equal '', @response.body

    assert_nil Message.find_by_id(2)

  end

  test "DELETE /messages/:id without API format should not destroy a message" do

    assert_no_difference 'Message.count' do

      delete '/messages/2', :headers => credentials('jsmith')

    end

    assert_response :not_found

    assert Message.exists?(2)

  end

end