Merge pull request #2258 from openstax/bootstrap-data

jivey · web-flow · commit 0909266bf073 · 2021-02-01T12:10:26.000-08:00
serve bootstrap data from api endpoint vs html
diff --git a/app/controllers/api/v1/users_controller.rb b/app/controllers/api/v1/users_controller.rb
@@ -1,4 +1,5 @@
 class Api::V1::UsersController < Api::V1::ApiController
+
   resource_description do
     api_versions "v1"
     short_description 'Represents a user in the system'
@@ -22,6 +23,27 @@ def show
     end
   end
 
+
+  api :GET, '/bootstrap', 'Returns initial of data application needs to start up'
+  description <<-EOS
+    Includes user information, current courses, and terms of use.
+    #{json_schema(Api::V1::BootstrapDataRepresenter, include: :readable)}
+  EOS
+  def bootstrap
+    if current_human_user.nil? || current_human_user.is_anonymous?
+      head :forbidden
+    else
+      respond_with current_human_user,
+                   represent_with: Api::V1::BootstrapDataRepresenter,
+                   user_options: {
+                     tutor_api_url: api_root_url,
+                     flash: flash.to_hash,
+                     is_impersonating: session[:admin_user_id].present?
+                   }
+    end
+  end
+
+
   api :PUT, '/ui-settings', 'Save settings about the currently logged in user'
   description <<-EOS
     Saves the user interface settigs for the current user.
diff --git a/app/helpers/webview_helper.rb b/app/helpers/webview_helper.rb
diff --git a/app/views/layouts/webview.html.erb b/app/views/layouts/webview.html.erb
@@ -12,8 +12,6 @@
   <%= render 'webview/google_analytics' %>
 </head>
 <body>
-  <script id="tutor-boostrap-data" type="application/json"><%=raw json_escape bootstrap_data %></script>
   <%= yield %>
-
 </body>
 </html>
diff --git a/app/views/lms/pair.html.erb b/app/views/lms/pair.html.erb
@@ -9,7 +9,6 @@
   </head>
   <body>
     <div id="ox-root-view">
-      <script id="tutor-boostrap-data" type="application/json"><%=raw json_escape bootstrap_data %></script>
     </div>
   </body>
 </html>
diff --git a/config/routes.rb b/config/routes.rb
@@ -36,8 +36,10 @@
 
   # All API routes
   api :v1, default: true do
+
     resources :users, only: :index
     resource :user, only: :show do
+      get :bootstrap
       get :tasks
       put :ui_settings
       put :'tours/:tour_id', action: :record_tour_view
diff --git a/spec/requests/api/v1/users_controller_spec.rb b/spec/requests/api/v1/users_controller_spec.rb
@@ -46,6 +46,38 @@
     end
   end
 
+  context "#bootstrap" do
+    context "caller has an authorization token" do
+      it "should return an ok (200) code" do
+        api_get bootstrap_api_user_url, user_1_token
+        expect(response.code).to eq('200')
+        expect(response.body_as_hash).to(
+          match Api::V1::BootstrapDataRepresenter.new(user_1).to_hash(
+                  user_options: {
+                    tutor_api_url: api_root_url,
+                    flash: {},
+                    is_impersonating: false,
+                  }
+                ).deep_symbolize_keys
+        )
+      end
+    end
+
+    context "caller does not have an authorization token" do
+      it "should return a forbidden (403) code" do
+        api_get bootstrap_api_user_url, nil
+        expect(response.code).to eq('403')
+      end
+    end
+
+    context "caller has an application/client credentials authorization token" do
+      it "should return a forbidden (403) code" do
+        api_get bootstrap_api_user_url, userless_token
+        expect(response.code).to eq('403')
+      end
+    end
+  end
+
   context "#ui-settings" do
     it "saves to profile" do
       api_put ui_settings_api_user_url, user_1_token, params: {
diff --git a/spec/requests/webview_controller_spec.rb b/spec/requests/webview_controller_spec.rb
@@ -47,17 +47,6 @@
     context 'as a signed in user' do
       before { sign_in! registered_user }
 
-      it 'sets boostrap data in script tag' do
-        get "/#{SecureRandom.hex}", headers: headers
-        expect(response).to have_http_status(:success)
-        doc = Nokogiri::HTML(response.body)
-        data = ::JSON.parse(doc.css('body script#tutor-boostrap-data').inner_text)
-        expect(data).to include(
-          'courses'=> CollectCourseInfo[user: registered_user].as_json,
-          'user' => Api::V1::UserRepresenter.new(registered_user).as_json
-        )
-      end
-
       it 'has url to tutor js asset' do
         get "/#{SecureRandom.hex}", headers: headers
         expect(response.body).to include "src='#{OpenStax::Utilities::Assets.url_for('tutor.js')}'"
