API v1 financial_transactions endpoints (#627)

spec/api/v1/swagger_spec.rb

@@ -27,6 +27,32 @@ describe 'API v1', type: :apivore, order: :defined do
       it_handles_invalid_token_and_scope(:get, '/user')
     end
 
+    context 'financial_transactions' do
+      let(:api_scopes) { ['finance:user'] }
+      let(:other_user) { create :user, :ordergroup }
+      let!(:other_ft_1) { create :financial_transaction, ordergroup: other_user.ordergroup }
+
+      context 'without ordergroup' do
+        it { is_expected.to validate(:get, '/user/financial_transactions', 403, api_auth) }
+        it { is_expected.to validate(:get, '/user/financial_transactions/{id}', 403, api_auth({'id' => other_ft_1.id})) }
+      end
+
+      context 'with ordergroup' do
+        let(:user) { create :user, :ordergroup }
+        let!(:ft_1) { create :financial_transaction, ordergroup: user.ordergroup }
+        let!(:ft_2) { create :financial_transaction, ordergroup: user.ordergroup }
+        let!(:ft_3) { create :financial_transaction, ordergroup: user.ordergroup }
+
+        it { is_expected.to validate(:get, '/user/financial_transactions', 200, api_auth) }
+        it { is_expected.to validate(:get, '/user/financial_transactions/{id}', 200, api_auth({'id' => ft_2.id})) }
+        it { is_expected.to validate(:get, '/user/financial_transactions/{id}', 404, api_auth({'id' => other_ft_1.id})) }
+        it { is_expected.to validate(:get, '/user/financial_transactions/{id}', 404, api_auth({'id' => FinancialTransaction.last.id + 1})) }
+
+        it_handles_invalid_token_and_scope(:get, '/user/financial_transactions')
+        it_handles_invalid_token_and_scope(:get, '/user/financial_transactions/{id}', ->{ api_auth('id' => ft_2.id) })
+      end
+    end
+
     context 'config' do
       let(:api_scopes) { ['config:user'] }
 
@@ -42,6 +68,27 @@ describe 'API v1', type: :apivore, order: :defined do
 
       it_handles_invalid_token(:get, '/navigation')
     end
+
+    context 'financial_transactions' do
+      let(:api_scopes) { ['finance:read'] }
+      let(:user) { create(:user, :role_finance) }
+      let(:other_user) { create :user, :ordergroup }
+      let!(:ft_1) { create :financial_transaction, ordergroup: other_user.ordergroup }
+      let!(:ft_2) { create :financial_transaction, ordergroup: other_user.ordergroup }
+
+      it { is_expected.to validate(:get, '/financial_transactions', 200, api_auth) }
+      it { is_expected.to validate(:get, '/financial_transactions/{id}', 200, api_auth({'id' => ft_2.id})) }
+      it { is_expected.to validate(:get, '/financial_transactions/{id}', 404, api_auth({'id' => FinancialTransaction.last.id + 1})) }
+
+      context 'without role_finance' do
+        let(:user) { create(:user) }
+        it { is_expected.to validate(:get, '/financial_transactions', 403, api_auth) }
+        it { is_expected.to validate(:get, '/financial_transactions/{id}', 403, api_auth({'id' => ft_2.id})) }
+      end
+
+      it_handles_invalid_token_and_scope(:get, '/financial_transactions')
+      it_handles_invalid_token_and_scope(:get, '/financial_transactions/{id}', ->{ api_auth({'id' => ft_2.id}) })
+    end
   end
 
   # needs to be last context so it is always run at the end

spec/factories/financial_transaction.rb

@@ -0,0 +1,15 @@
+require 'factory_bot'
+
+FactoryBot.define do
+  factory :financial_transaction do
+    user
+    ordergroup
+    amount { rand(-99_999.00..99_999.00) }
+    note { Faker::Lorem.sentence }
+
+    # This builds a new type and class by default, while for normal financial
+    # transactions we'd use the default. This, however, is the easiest way to
+    # get the factory going. If you want equal types, specify it explicitly.
+    financial_transaction_type
+  end
+end