diff --git a/CHANGELOG.md b/CHANGELOG.md
index f06253a64b547aaf57b9299835ebf0d115b7a204..1c56c07408ae84457ad7eb58ff3ab29ab224aa76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,17 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## 1.1.11 - 04-02-2020
+## Changed
+- Form controller update route to verify if a user own the form #62 (Gianfranco)
+
+
## 1.1.10 - 03-02-2020
### Added
- Route to list forms #61 (Richard Heise)
-## Changed
-- List from FormQUeryBuilder now lists an user's forms
+## Changed
+- List from FormQueryBuilder now lists an user's forms
+
## 1.1.9 - 03-02-2020
### Added
@@ -16,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## Changed
- Delete route now has the token validation
+
## 1.1.8 - 30-01-2020
### Added
- Route to assign users to forms #60 (Richard Heise)
@@ -23,11 +30,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Route to write a form now has an extra stage in the waterfall
- This stage assigns the user to a form by ID
+
## 1.1.7 - 29-01-2020
### Added
- Function to assign users to forms #54 (Gianfranco)
- Assign added to userQueryBuilder file
+
## 1.1.6 - 24-01-2020
### Added
- Middleware to validate tokens #56 (Richard Heise)
@@ -36,6 +45,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## Changed
- Initial user tests are now on the form.spec.ts
+
## 1.1.5 - 22-01-2020
### Added
- SubForm class #57 (Gianfranco)
diff --git a/form-creator-database b/form-creator-database
index 137380601a83c9d305e1d5ac093aa4f868f042b4..6cd530d9f009f739a7f285efddae4d29377dad7c 160000
--- a/form-creator-database
+++ b/form-creator-database
@@ -1 +1 @@
-Subproject commit 137380601a83c9d305e1d5ac093aa4f868f042b4
+Subproject commit 6cd530d9f009f739a7f285efddae4d29377dad7c
diff --git a/package.json b/package.json
index c70479850c6d066bb460ec2ee119f60b7428445a..1d6b6095c0067c540d5607dc94f9b8704ea33675 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "form-creator-api",
- "version": "1.1.10",
+ "version": "1.1.11",
"description": "RESTful API used to manage and answer forms.",
"main": "index.js",
"scripts": {
diff --git a/src/api/controllers/form.spec.ts b/src/api/controllers/form.spec.ts
index fa1d93805dc4c8b9ead163a1b06db69d79c5e3ef..71bb21869573eee882df01ce9a3d580184c0d148 100644
--- a/src/api/controllers/form.spec.ts
+++ b/src/api/controllers/form.spec.ts
@@ -35,6 +35,7 @@ import { DbHandler } from "../../utils/dbHandler";
import { configs } from "../../utils/config";
import { Fixture } from "../../../test/fixture";
import { formScenario } from "../../../test/scenario";
+
before(function (done): void {
const fix: Fixture = new Fixture ();
@@ -57,7 +58,7 @@ export let testToken: string;
describe("Initial test User", () => {
it ("Should respond 200 when signing up a valid user", (done) => {
- request(server)
+ request(server)
.post("/user/signUp")
.send({
name: "Test_name"
@@ -266,4 +267,15 @@ describe("API data controller - form", () => {
.end(done);
});
+ it("should respond 500 when putting valid form update swap inputs when user dont own the form", (done) => {
+ request(server)
+ .put("/form/5")
+ .set("Authorization", "bearer " + testToken)
+ .send(formScenario.formToSwapInputs)
+ .expect(500)
+ .expect((res: any) => {
+ expect(res.body.message).to.be.equal(formScenario.msg2);
+ })
+ .end(done);
+ });
});
diff --git a/src/api/controllers/form.ts b/src/api/controllers/form.ts
index 7a45d10546bc53de4272e2011de3cc2b55357c1f..5990cc2f8d6d5ddfe0e97940444ec183caf94e26 100644
--- a/src/api/controllers/form.ts
+++ b/src/api/controllers/form.ts
@@ -128,6 +128,17 @@ export class FormCtrl {
return;
}
waterfall([
+ (callback: (err: Error) => void) => {
+ req.db.form.list(Object(req.userData).id, (err: Error, forms?: Form[]) => {
+ if (err) {
+ callback(err);
+ return;
+ }
+
+ const e: Error = new Error("User dont own this form.");
+ callback((forms.some((obj) => obj.id === Number(req.params.id))) ? null : e);
+ });
+ },
(callback: (err: Error, result?: FormUpdate) => void) => {
req.db.form.read(req.params.id, (err: Error, oldForm: Form) => {
if (err) {
diff --git a/src/api/controllers/user.spec.ts b/src/api/controllers/user.spec.ts
index 1f7145862fb8c82bd782e074a7dc17f3eda8134b..d8a88fe26d99c27635419efcede21b74514e52cb 100644
--- a/src/api/controllers/user.spec.ts
+++ b/src/api/controllers/user.spec.ts
@@ -191,7 +191,7 @@ describe ("API data controller", () => {
.expect(200)
.expect((res: any) => {
expect(res.body).to.be.an("array");
- let j: number = 4;
+ let j: number = 1;
for (const i of res.body) {
expect(i.id).to.be.eql(j++);
}
diff --git a/src/utils/formQueryBuilder.ts b/src/utils/formQueryBuilder.ts
index 578cc5e6e59240e17143151db067f28ffebda33c..7bf7f7416c9a0e15d564864b532f280b2aa8a0bb 100644
--- a/src/utils/formQueryBuilder.ts
+++ b/src/utils/formQueryBuilder.ts
@@ -97,7 +97,7 @@ export class FormQueryBuilder extends QueryBuilder {
private executeListForms(userId: number, cb: (err: Error, forms?: Form[]) => void) {
const queryString: string = "SELECT t1.id,t1.title,t1.description FROM form t1 \
INNER JOIN form_owner t2 ON (t1.id=t2.id_form \
- AND t2.id_user=$1)";
+ AND t2.id_user=$1);";
const query: QueryOptions = {
query: queryString
, parameters: [
diff --git a/test/scenario.ts b/test/scenario.ts
index 9ac5bdb57f470cbc57fc4d74532c30bf81909a53..ef05dce52feeb909bac60a47c36d5c3287583d2e 100644
--- a/test/scenario.ts
+++ b/test/scenario.ts
@@ -3155,6 +3155,8 @@ const formOptionsToUpdateMissingProperties: any = {
};
/** A message that is used in cases where the update is a success */
const successMsg = "Updated";
+/** A message that is used in cases where the update is unsuccess */
+const unsuccessMsg = "Could not update Form. Some error has ocurred. Check error property for details.";
/** ================================================== */
/** form testing Scenario */
@@ -3757,6 +3759,8 @@ export const formScenario = {
malformedUpdate : formOptionsToUpdateMissingProperties,
/** Successfuly updating message */
msg : successMsg,
+ /** Unsuccesfuly updating message */
+ msg2 : unsuccessMsg,
};