diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb index 96d767d38..1e21f6770 100644 --- a/app/controllers/api/v1/registrant/domains_controller.rb +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -5,7 +5,20 @@ module Api module Registrant class DomainsController < BaseController def index - @domains = associated_domains(current_user) + limit = params[:limit] || 200 + offset = params[:offset] || 0 + + if limit.to_i > 200 || limit.to_i < 1 + render(json: { errors: [{ limit: ['parameter is out of range'] }] }, + status: :bad_request) && return + end + + if offset.to_i.negative? + render(json: { errors: [{ offset: ['parameter is out of range'] }] }, + status: :bad_request) && return + end + + @domains = associated_domains(current_user).limit(limit).offset(offset) render json: @domains end @@ -16,7 +29,7 @@ module Api if @domain render json: @domain else - render json: { errors: ["Domain not found"] }, status: :not_found + render json: { errors: ['Domain not found'] }, status: :not_found end end @@ -27,7 +40,7 @@ module Api BusinessRegistryCache.fetch_associated_domains(ident, country_code) rescue Soap::Arireg::NotAvailableError => error - Rails.logger.fatal("[EXCEPTION] #{error.to_s}") + Rails.logger.fatal("[EXCEPTION] #{error}") user.domains end end diff --git a/test/integration/api/registrant/registrant_api_domains_test.rb b/test/integration/api/registrant/registrant_api_domains_test.rb index c892f088b..3e966b192 100644 --- a/test/integration/api/registrant/registrant_api_domains_test.rb +++ b/test/integration/api/registrant/registrant_api_domains_test.rb @@ -47,6 +47,35 @@ class RegistrantApiDomainsTest < ActionDispatch::IntegrationTest assert(array_of_domain_names.include?('hospital.test')) end + def test_root_accepts_limit_and_offset_parameters + get '/api/v1/registrant/domains', { 'limit' => 2, 'offset' => 0 }, @auth_headers + response_json = JSON.parse(response.body, symbolize_names: true) + + assert_equal(200, response.status) + assert_equal(2, response_json.count) + + get '/api/v1/registrant/domains', {}, @auth_headers + response_json = JSON.parse(response.body, symbolize_names: true) + + assert_equal(5, response_json.count) + end + + def test_root_does_not_accept_limit_higher_than_200 + get '/api/v1/registrant/domains', { 'limit' => 400, 'offset' => 0 }, @auth_headers + + assert_equal(400, response.status) + response_json = JSON.parse(response.body, symbolize_names: true) + assert_equal({ errors: [{ limit: ['parameter is out of range'] }] }, response_json) + end + + def test_root_does_not_accept_offset_lower_than_0 + get '/api/v1/registrant/domains', { 'limit' => 200, 'offset' => "-10" }, @auth_headers + + assert_equal(400, response.status) + response_json = JSON.parse(response.body, symbolize_names: true) + assert_equal({ errors: [{ offset: ['parameter is out of range'] }] }, response_json) + end + def test_root_returns_401_without_authorization get '/api/v1/registrant/domains', {}, {} assert_equal(401, response.status) @@ -55,6 +84,14 @@ class RegistrantApiDomainsTest < ActionDispatch::IntegrationTest assert_equal({ errors: ['Not authorized'] }, json_body) end + def test_details_returns_401_without_authorization + get '/api/v1/registrant/domains/5edda1a5-3548-41ee-8b65-6d60daf85a37', {}, {} + assert_equal(401, response.status) + json_body = JSON.parse(response.body, symbolize_names: true) + + assert_equal({ errors: ['Not authorized'] }, json_body) + end + private def auth_token