public function RestWSTestCase::testQuerying in RESTful Web Services 7.2

Tests resource querying.

File

./restws.test, line 383

RESTful web services tests.

Class

RestWSTestCase

@file RESTful web services tests.

Code

public function testQuerying() {
  $account = $this
    ->drupalCreateUser(array(
    'access content',
    'bypass node access',
    'access resource node',
  ));
  $this
    ->drupalLogin($account);
  $this
    ->createTerm('foo');
  $nodes = array();
  for ($i = 0; $i < 5; $i++) {
    $title = "node{$i}";
    $node = array(
      'title' => $title,
      'type' => 'article',
    );

    // Add tags to the nodes 0 and 3.
    if ($i % 3 == 0) {
      $node['field_tags'][LANGUAGE_NONE][]['tid'] = 1;
    }

    // Set a body and the format to full_html for nodes 0 and 4.
    if ($i % 4 == 0) {
      $node['body'] = array(
        LANGUAGE_NONE => array(
          array(
            'value' => l('foo', 'node'),
            'format' => 'full_html',
          ),
        ),
      );
    }
    $nodes[$i] = $this
      ->drupalCreateNode($node);
  }

  // Retrieve a list of nodes with json sorted by the title descending.
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'sort' => 'title',
    'direction' => 'DESC',
  ));
  $result_nodes = drupal_json_decode($result);

  // Start by checking if the last node created is the first in the result.
  $i = 4;
  foreach ($result_nodes['list'] as $key => $node) {
    $this
      ->assertEqual($nodes[$i]->title, $node['title'], "Node title {$key} was received correctly.");
    $i--;
  }
  $this
    ->assertResponse('200', 'HTTP response code is correct.');
  $this
    ->assertEqual(curl_getinfo($this->curlHandle, CURLINFO_CONTENT_TYPE), 'application/json', 'HTTP content type is correct.');

  // Retrieve a list of nodes with xml.
  $result = $this
    ->drupalGet('node', array(), array(
    'Accept: application/xml',
  ));
  $this
    ->assertRaw('<list>', 'XML has been generated.');
  for ($i = 0; $i < 5; $i++) {
    $this
      ->assertRaw("<title>node{$i}</title>", 'XML has been generated.');
  }

  // Query for a node with the title 'title1'.
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'title' => 'node1',
  ));
  $node = drupal_json_decode($result);
  $this
    ->assertEqual($node['list'][0]['title'], 'node1', 'Node title was received correctly.');

  // Query for nodes with the taxonomy term foo which has the tid 1.
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'field_tags' => '1',
  ));
  $nodes = drupal_json_decode($result);
  $this
    ->assertEqual($nodes['list'][0]['title'], 'node0', 'Right node title was received.');
  $this
    ->assertEqual($nodes['list'][0]['field_tags'][0]['id'], 1, 'Node has taxonomy term.');
  $this
    ->assertEqual($nodes['list'][1]['title'], 'node3', 'Right node title was received.');
  $this
    ->assertEqual($nodes['list'][1]['field_tags'][0]['id'], 1, 'Node has taxonomy term.');

  // Test paging and limiting.
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'limit' => 2,
    'page' => 0,
  ));
  $result_nodes = drupal_json_decode($result);
  $this
    ->assertTrue(count($result_nodes['list'] > 2), 'Only two elements where returned');
  $this
    ->assertTrue($result_nodes['self'] == url('node', array(
    'absolute' => TRUE,
    'query' => array(
      'limit' => 2,
      'page' => 0,
    ),
  )), 'Self link was generated');
  $this
    ->assertTrue($result_nodes['first'] == url('node', array(
    'absolute' => TRUE,
    'query' => array(
      'limit' => 2,
      'page' => 0,
    ),
  )), 'First link was generated');
  $this
    ->assertTrue($result_nodes['last'] == url('node', array(
    'absolute' => TRUE,
    'query' => array(
      'limit' => 2,
      'page' => 2,
    ),
  )), 'Last link was generated');
  $this
    ->assertTrue($result_nodes['next'] == url('node', array(
    'absolute' => TRUE,
    'query' => array(
      'limit' => 2,
      'page' => 1,
    ),
  )), 'Next link was generated');
  $this
    ->assertFalse(isset($result_nodes['prev']), 'Prev link was not generated');
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'limit' => 2,
    'page' => 2,
  ));
  $result_nodes = drupal_json_decode($result);
  $this
    ->assertFalse(isset($result_nodes['next']), 'Next link was not generated');
  $this
    ->assertTrue($result_nodes['prev'] == url('node', array(
    'absolute' => TRUE,
    'query' => array(
      'limit' => 2,
      'page' => 1,
    ),
  )), 'Prev link was generated');
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'limit' => 2,
    'page' => 5,
  ));
  $this
    ->assertResponse('404', 'HTTP response code is correct.');

  // Test meta control full.
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'full' => 0,
  ));
  $result_nodes = drupal_json_decode($result);
  foreach ($result_nodes['list'] as $node) {
    $this
      ->assertTrue($node['uri'] == restws_resource_uri('node', $node['id']), 'Rerence to node ' . $node['id'] . ' was received correctly.');
  }

  // Test field column queries.
  $result = $this
    ->httpRequest('node.json', 'GET', $account, array(
    'body[format]' => 'full_html',
  ));
  $result_nodes = drupal_json_decode($result);
  $this
    ->assertEqual($result_nodes['list'][0]['title'], 'node0', 'Right node title was received.');
  $this
    ->assertEqual($result_nodes['list'][0]['body']['format'], 'full_html', 'Node has body with full_html.');
  $this
    ->assertEqual($result_nodes['list'][1]['title'], 'node4', 'Right node title was received.');
  $this
    ->assertEqual($result_nodes['list'][1]['body']['format'], 'full_html', 'Node has body with full_html.');

  // Test SQL injection via order direction.
  $this
    ->httpRequest('node.json', 'GET', $account, array(
    'sort' => 'title',
    'direction' => 'ASC; DELETE FROM ' . $this->databasePrefix . 'node WHERE nid = 1; --',
  ));
  $node = node_load(1, NULL, TRUE);
  $this
    ->assertNotEqual($node, FALSE, 'Node has not been deleted through SQL injection.');
}