Correct openapi ignore mode to filter schemas

Also rename openapi-mode options

* follow-acl -> follow-privileges
* ignore-acl -> ignore-privileges

test/Feature/IgnoreAclOpenApiSpec.hs

@@ -1,4 +1,4 @@
-module Feature.IgnoreAclOpenApiSpec where
+module Feature.IgnorePrivOpenApiSpec where
 
 import Control.Lens ((^?))
 
@@ -32,6 +32,17 @@ spec = describe "OpenAPI Ignore ACL" $ do
 
       liftIO $ tableTag `shouldBe` Just [aesonQQ|"authors_only"|]
 
+    it "only includes tables that belong to another schema if the Accept-Profile header is used" $ do
+      r1 <- simpleBody <$> get "/"
+      let tableKey1 = r1 ^? key "paths" . key "/children"
+
+      liftIO $ tableKey1 `shouldBe` Nothing
+
+      r2 <- simpleBody <$> request methodGet "/" [("Accept-Profile", "v1")] ""
+      let tableKey2 = r2 ^? key "paths" . key "/children"
+
+      liftIO $ tableKey2 `shouldNotBe` Nothing
+
   describe "RPC" $ do
 
     it "includes privileged function even if user does not have permission" $ do
@@ -41,3 +52,14 @@ spec = describe "OpenAPI Ignore ACL" $ do
                     . nth 0
 
       liftIO $ funcTag `shouldBe` Just [aesonQQ|"(rpc) privileged_hello"|]
+
+    it "only includes functions that belong to another schema if the Accept-Profile header is used" $ do
+      r1 <- simpleBody <$> get "/"
+      let funcKey1 = r1 ^? key "paths" . key "/rpc/get_parents_below"
+
+      liftIO $ funcKey1 `shouldBe` Nothing
+
+      r2 <- simpleBody <$> request methodGet "/" [("Accept-Profile", "v1")] ""
+      let funcKey2 = r2 ^? key "paths" . key "/rpc/get_parents_below"
+
+      liftIO $ funcKey2 `shouldNotBe` Nothing

test/Feature/IgnorePrivOpenApiSpec.hs

@@ -0,0 +1,65 @@
+module Feature.IgnorePrivOpenApiSpec where
+
+import Control.Lens ((^?))
+
+import Data.Aeson.Lens
+import Data.Aeson.QQ
+
+import Network.HTTP.Types
+import Network.Wai        (Application)
+import Network.Wai.Test   (SResponse (..))
+
+import Test.Hspec     hiding (pendingWith)
+import Test.Hspec.Wai
+
+import Protolude  hiding (get)
+import SpecHelper
+
+spec :: SpecWith ((), Application)
+spec = describe "OpenAPI Ignore Privileges" $ do
+  it "root path returns a valid openapi spec" $ do
+    validateOpenApiResponse [("Accept", "application/openapi+json")]
+    request methodHead "/" (acceptHdrs "application/openapi+json") ""
+      `shouldRespondWith` "" { matchStatus  = 200 }
+
+  describe "table" $ do
+
+    it "includes privileged table even if user does not have permission" $ do
+      r <- simpleBody <$> get "/"
+      let tableTag = r ^? key "paths" . key "/authors_only"
+                     . key "post" . key "tags"
+                     . nth 0
+
+      liftIO $ tableTag `shouldBe` Just [aesonQQ|"authors_only"|]
+
+    it "only includes tables that belong to another schema if the Accept-Profile header is used" $ do
+      r1 <- simpleBody <$> get "/"
+      let tableKey1 = r1 ^? key "paths" . key "/children"
+
+      liftIO $ tableKey1 `shouldBe` Nothing
+
+      r2 <- simpleBody <$> request methodGet "/" [("Accept-Profile", "v1")] ""
+      let tableKey2 = r2 ^? key "paths" . key "/children"
+
+      liftIO $ tableKey2 `shouldNotBe` Nothing
+
+  describe "RPC" $ do
+
+    it "includes privileged function even if user does not have permission" $ do
+      r <- simpleBody <$> get "/"
+      let funcTag = r ^? key "paths" . key "/rpc/privileged_hello"
+                    . key "post" . key "tags"
+                    . nth 0
+
+      liftIO $ funcTag `shouldBe` Just [aesonQQ|"(rpc) privileged_hello"|]
+
+    it "only includes functions that belong to another schema if the Accept-Profile header is used" $ do
+      r1 <- simpleBody <$> get "/"
+      let funcKey1 = r1 ^? key "paths" . key "/rpc/get_parents_below"
+
+      liftIO $ funcKey1 `shouldBe` Nothing
+
+      r2 <- simpleBody <$> request methodGet "/" [("Accept-Profile", "v1")] ""
+      let funcKey2 = r2 ^? key "paths" . key "/rpc/get_parents_below"
+
+      liftIO $ funcKey2 `shouldNotBe` Nothing