Commit: dd64b9401ad41dc3c92aff955d7c5a56ab300952 - allura (git)

allura

Commit MetaInfo

• Revisión: dd64b9401ad41dc3c92aff955d7c5a56ab300952 (tree)
• Tiempo: 2012-07-11 13:58:37
• Autor: Dave Brondsema <dbrondsema@geek...>
• Commiter: Dave Brondsema

Log Message

[#4272] do "read" checks in the rest api ticket index

Cambiar Resumen

• modified: ForgeTracker/forgetracker/tests/functional/test_root.py
• modified: ForgeTracker/forgetracker/tracker_main.py

Diferencia incremental

--- a/ForgeTracker/forgetracker/tests/functional/test_root.py
+++ b/ForgeTracker/forgetracker/tests/functional/test_root.py
@@ -163,12 +163,21 @@ class TestFunctionalController(TrackerTestController):
         r = self.app.get('/p/test/bugs/search/?q=ticket', extra_environ=env)
         assert '1 results' in r
         assert 'Private Ticket' not in r
+        # ... or in search feed...
+        r = self.app.get('/p/test/bugs/search_feed?q=ticket', extra_environ=env)
+        assert 'Private Ticket' not in r
         # ...and can't get to the private ticket directly.
         r = self.app.get(ticket_view.request.url, extra_environ=env)
         assert 'Private Ticket' not in r
         # ... and it doesn't appear in the feed
         r = self.app.get('/p/test/bugs/feed.atom')
         assert 'Private Ticket' not in r
+        # ... or in the API ...
+        r = self.app.get('/rest/p/test/bugs/2/')
+        assert 'Private Ticket' not in r
+        assert '/auth/?return_to' in r.headers['Location']
+        r = self.app.get('/rest/p/test/bugs/')
+        assert 'Private Ticket' not in r
 
     @td.with_tool('test', 'Tickets', 'doc-bugs')
     def test_two_trackers(self):

--- a/ForgeTracker/forgetracker/tracker_main.py
+++ b/ForgeTracker/forgetracker/tracker_main.py
@@ -1304,10 +1304,14 @@ class RootRestController(BaseController):
         require_access(c.app, 'read')
 
     @expose('json:')
-    def index(self, **kw):
-        return dict(tickets=[
-            dict(ticket_num=t.ticket_num, summary=t.summary)
-            for t in TM.Ticket.query.find(dict(app_config_id=c.app.config._id)).sort('ticket_num') ])
+    def index(self, limit=100, page=0, **kw):
+        results = TM.Ticket.paged_query(c.app.config, c.user, query={},
+                                        limit=int(limit), page=int(page))
+        results['tickets'] = [dict(ticket_num=t.ticket_num, summary=t.summary)
+                              for t in results['tickets']]
+        results.pop('q', None)
+        results.pop('sort', None)
+        return results
 
     @expose()
     @h.vardec