Rspec testing API with rack protection

Question

I am trying to test my API with an rspec integration(request) test.

I go to my api endpoint at 0.0.0.0:3000/api/regions in a browser and it returns my data, I get a session id and looks like everything is working.

I am using rack protection in my API:

module Api
  class Root < Grape::API
     use Rack::Protection, instrumenter: ActiveSupport::Notifications
     use Rack::Protection::AuthenticityToken    
     prefix  'api'

     helpers do
        def warden
          request.env['warden']
        end
     end

     version 'v1', using: :header, vendor: 'vendor', strict: false do
        mount Resources::V1::Search => '/'
        mount Resources::V1::Regions => '/'
     end    

   end
end

The api resource:

module Resources
  module V1
    class Regions < Grape::API

      resource :regions do
        get do
          # Some code...
        end
      end
    end
  end
end

spec_helper.rb

[...]
RSpec.configure do |config|
  config.include FactoryGirl::Syntax::Methods

  config.include Rack::Test::Methods, type: :request
  config.include Module.new { def app; Api::Root; end }, type: :request

  config.include Warden::Test::Helpers

  # ## Mock Framework
  #
  # If you prefer to use mocha, flexmock or RR, uncomment the appropriate line:
  #
  # config.mock_with :mocha
  # config.mock_with :flexmock
  # config.mock_with :rr

  # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures
  config.fixture_path = "#{::Rails.root}/spec/fixtures"

  # If you're not using ActiveRecord, or you'd prefer not to run each of your
  # examples within a transaction, remove the following line or assign false
  # instead of true.
  config.use_transactional_fixtures = true

  # If true, the base class of anonymous controllers will be inferred
  # automatically. This will be the default behavior in future versions of
  # rspec-rails.
  config.infer_base_class_for_anonymous_controllers = false

  # Run specs in random order to surface order dependencies. If you find an
  # order dependency and want to debug it, you can fix the order by providing
  # the seed, which is printed after each run.
  #     --seed 1234
  config.order = "random"
end

Here is a test:

describe Resources::V1::Regions do
  describe 'GET /regions' do
    it 'returns some data' do
      get '/api/regions'
      [... expectations - doesn't get here...]
    end
  end
end

Here is the error:

 RuntimeError:
       you need to set up a session middleware *before* Rack::Protection::RemoteToken
     # ./spec/requests/api/region_spec.rb:6:in `block (3 levels) in <top (required)>'

Which comes from here: https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/base.rb#L85

So I need to add rack session middleware, right?

I add use Rack::Session::Cookie, secret: '...' to my api which gets me to request.env['warden'] being nil (another question another time).

Now, however, when I load the endpoint with the browser I get:

undefined method `each' for #<ActionDispatch::Request::Session:0x7f7bf9e521e0 not yet loaded>

which raises over here: https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L158

I suspect I don't need to use Rack::Session::Cookie, as something else is doing it when loaded by the server, but I need to add something for the tests to work. No idea what that something is.

Please let me know if you need any other info.

Versions:

grape (0.6.1)
rails (4.0.2)
rack-protection (1.5.2)
rspec (2.14.1)

score 0 · Accepted Answer · answered Mar 16 '14 at 17:56

I was solving this by adding a 'rack.session' hash to the 3rd argument of my request i.e get '/api/regions', {}, {'rack.session' => {}}

But I found a better way: https://github.com/heavysixer/grape-on-rack/pull/1 which adds sessions and solves the warden issue at the same time.

RSpec.configure do |config|
[...]
  rack_app = Module.new do 
    def app
      @app ||= Rack::Builder.new do
        use Rack::Session::Cookie
        Warden::Manager.serialize_into_session { |user| user.id }
        Warden::Manager.serialize_from_session { |id| User.get(id) }
        use Warden::Manager do |manager|
          manager.default_strategies :password, :basic
          # manager.failure_app = Acme::BadAuthentication
        end
        run Api::Root
      end
    end
  end

  config.include rack_app, type: :request
  end

Marking as answer unless anyone has anything better.

Rspec testing API with rack protection

1 Answers1