Initial commit

spec/api/v2/admin/abilities_spec.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+describe API::V2::Admin::Abilities, type: :request do
+  include_context 'bearer authentication'
+
+  let!(:create_admin_permission) do
+    create :permission,
+           role: 'admin'
+  end
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member'
+  end
+
+  describe 'GET /api/v2/admin/abilities' do
+    context 'superadmin user' do
+      let(:test_user) { create(:user, email: 'example@gmail.com', role: 'admin') }
+      it 'get all roles and permissions' do
+        get '/api/v2/admin/abilities', headers: auth_header
+        result = JSON.parse(response.body)
+        expect(response).to be_successful
+        expect(result).to eq(
+          'read' => %w[Level APIKey Permission],
+          'manage' => %w[User Activity Profile Label]
+        )
+      end
+    end
+
+    context 'member user' do
+      let(:test_user) { create(:user, email: 'example@gmail.com', role: 'member') }
+      it 'get all roles and permissions' do
+        get '/api/v2/admin/abilities', headers: auth_header
+        result = JSON.parse(response.body)
+        expect(response).to be_successful
+        expect(result).to eq({})
+      end
+    end
+  end
+end

spec/api/v2/admin/activities_spec.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe API::V2::Admin::Activities do
+  include_context 'bearer authentication'
+
+  describe 'GET /api/v2/admin/activities' do
+    let!(:create_admin_permission) do
+      create :permission,
+             role: 'admin'
+    end
+    let!(:create_member_permission) do
+      create :permission,
+             role: 'member'
+    end
+    let(:do_request) { get '/api/v2/admin/activities', headers: auth_header }
+
+    context 'admin user' do
+      let!(:test_user) { create(:user, email: 'testa@gmail.com', role: 'admin') }
+      let!(:first_user) { create(:user, email: 'test1@gmail.com') }
+      let!(:second_user) { create(:user, email: 'test2@gmail.com') }
+
+      context 'user activities' do
+        let!(:create_actitivites) do
+          create(:activity, category: 'user', topic: 'session', action: 'login', user: first_user)
+          create(:activity, category: 'user', topic: 'session', action: 'login', user: second_user)
+          create(:activity, category: 'user', topic: 'otp', action: 'otp::enable', user: second_user)
+          create(:activity, category: 'admin', topic: 'otp', action: 'otp::enable', user: second_user)
+        end
+
+        it 'doesnt return admin activities' do
+          get '/api/v2/admin/activities', headers: auth_header
+          activities = JSON.parse(response.body)
+          expect(Activity.where(category: 'user').count).to eq activities.count
+          expect(Activity.all.count).not_to eq activities.count
+        end
+
+        it 'returns list of activities' do
+          get '/api/v2/admin/activities', headers: auth_header
+          activities = JSON.parse(response.body)
+          user_activites = Activity.where(category: 'user')
+          expect(user_activites.count).to eq activities.count
+          expect(user_activites.last.user_ip).to eq activities[0]['user_ip']
+          expect(user_activites.last.user_agent).to eq activities[0]['user_agent']
+          expect(user_activites.last.topic).to eq activities[0]['topic']
+          expect(user_activites.last.action).to eq activities[0]['action']
+          expect(user_activites.last.result).to eq activities[0]['result']
+          expect(user_activites.last.user.email).to eq activities[0]['user']['email']
+          expect(first_user.email).to eq activities[2]['user']['email']
+        end
+
+        it 'returns list of activities filtered by action' do
+          get '/api/v2/admin/activities', headers: auth_header, params: {action: 'login'}
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 2
+        end
+
+        it 'returns list of activities filtered by uid' do
+          get '/api/v2/admin/activities', headers: auth_header, params: {uid: first_user.uid}
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by email' do
+          get '/api/v2/admin/activities', headers: auth_header, params: {email: first_user.email}
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by topic' do
+          get '/api/v2/admin/activities', headers: auth_header, params: {topic: 'otp'}
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by action and  uid' do
+          get '/api/v2/admin/activities', headers: auth_header, params: {topic: 'session', action: 'login', uid: second_user.uid}
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+      end
+
+      context 'admin activities' do
+        let!(:create_actitivites) do
+          create(:activity, topic: 'session', action: 'login', user: first_user, category: 'admin', target_uid: second_user.uid)
+          create(:activity, topic: 'session', action: 'login', user: second_user, category: 'admin')
+          create(:activity, topic: 'otp', action: 'otp::enable', user: second_user, category: 'admin', target_uid: second_user.uid)
+        end
+
+        it 'returns list of activities' do
+          get '/api/v2/admin/activities/admin', headers: auth_header
+          activities = JSON.parse(response.body)
+
+          expect(Activity.count).to eq activities.count
+          expect(Activity.third.user_ip).to eq activities[0]['user_ip']
+          expect(Activity.third.user_agent).to eq activities[0]['user_agent']
+          expect(Activity.third.topic).to eq activities[0]['topic']
+          expect(Activity.third.action).to eq activities[0]['action']
+          expect(Activity.third.result).to eq activities[0]['result']
+          expect(Activity.third.user.email).to eq activities[0]['admin']['email']
+          expect(Activity.third.target.email).to eq activities[0]['target']['email']
+          expect(Activity.first.user.email).to eq activities[2]['admin']['email']
+          expect(Activity.first.target.email).to eq activities[2]['target']['email']
+        end
+
+        it 'returns list of activities filtered by action' do
+          get '/api/v2/admin/activities/admin', headers: auth_header, params: { action: 'login' }
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 2
+        end
+
+        it 'returns list of activities filtered by uid' do
+          get '/api/v2/admin/activities/admin', headers: auth_header, params: { uid: first_user.uid }
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by email' do
+          get '/api/v2/admin/activities/admin', headers: auth_header, params: { email: first_user.email }
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by topic' do
+          get '/api/v2/admin/activities/admin', headers: auth_header, params: { topic: 'otp' }
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by action and  uid' do
+          get '/api/v2/admin/activities/admin', headers: auth_header, params: { topic: 'session', action: 'login', uid: second_user.uid }
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 1
+        end
+
+        it 'returns list of activities filtered by affected user' do
+          get '/api/v2/admin/activities/admin', headers: auth_header, params: { target_uid: second_user.uid }
+          activities = JSON.parse(response.body)
+          expect(activities.count).to eq 2
+        end
+      end
+    end
+  end
+end

spec/api/v2/admin/api_keys_spec.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+describe 'Api::V2::Admin::APIKeys' do
+  include_context 'bearer authentication'
+
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member'
+  end
+  let!(:create_superadmin_permission) do
+    create :permission,
+           role: 'superadmin'
+  end
+
+  describe 'GET /api/v2/admin/api_keys' do
+    let!(:test_user) { create(:user, otp: otp_enabled, role: 'superadmin') }
+    let(:otp_enabled) { true }
+    let!(:first_api_key) { create :api_key, key_holder_account: test_user }
+    let!(:second_api_key) { create :api_key, key_holder_account: test_user }
+    let(:expected_fields) do
+      {
+        kid: first_api_key.kid,
+        state: first_api_key.state,
+        scope: %w[trade]
+      }
+    end
+    let(:params) do
+      {
+        uid: test_user.uid
+      }
+    end
+    let(:do_request) { get "/api/v2/admin/api_keys", params: params, headers: auth_header }
+
+    context 'successful' do
+      it 'Returns api keys for selected account' do
+        do_request
+
+        expect(response.status).to eq(200)
+        expect(json_body.first.keys).to match_array %i[kid algorithm scope state created_at updated_at]
+        expect(json_body.first).to include(expected_fields)
+        expect(json_body.first).not_to include(:secret)
+      end
+
+      it 'Returns api keys for selected account in ASC order' do
+        params[:ordering] = 'asc'
+        params[:order_by] = 'id'
+        do_request
+
+        expect(response.status).to eq(200)
+        expect(json_body.first.keys).to match_array %i[kid algorithm scope state created_at updated_at]
+        expect(json_body.first).to include(expected_fields)
+        expect(json_body.first).not_to include(:secret)
+      end
+
+      it 'Returns api keys for selected account in DESC order' do
+        params[:ordering] = 'desc'
+        params[:order_by] = 'id'
+        do_request
+
+        expect(response.status).to eq(200)
+        expect(json_body.first.keys).to match_array %i[kid algorithm scope state created_at updated_at]
+        expect(json_body.second).to include(expected_fields)
+        expect(json_body.second).not_to include(:secret)
+      end
+
+      it 'Returns empty array if no api keys exist for selected account' do
+        test_user.api_keys.delete_all
+
+        do_request
+        expect(response.status).to eq(200)
+        expect(json_body).to eq([])
+      end
+    end
+
+    context 'error' do
+      let(:params) do
+        {
+          uid: 'random'
+        }
+      end
+
+      it 'Returns error if user doesnt exist' do
+        do_request
+        expect(response.status).to eq(404)
+        expect(json_body.first).to include(:errors, ["admin.user.doesnt_exist"])
+      end
+
+      it 'Returns error if api key attribute doesnt exist' do
+        params[:uid] = test_user.uid
+        params[:order_by] = 'length'
+        do_request
+        expect(response.status).to eq(422)
+        expect(json_body.first).to include(:errors, ["api_keys.ordering.invalid_attribute"])
+      end
+
+      it 'Returns error if invalid ordering' do
+        params[:uid] = test_user.uid
+        params[:ordering] = 'res'
+        do_request
+        expect(response.status).to eq(422)
+        expect(json_body.first).to include(:errors, ["api_keys.ordering.invalid_ordering"])
+      end
+    end
+  end
+end

spec/api/v2/admin/levels_spec.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe API::V2::Admin::Levels do
+  include_context 'bearer authentication'
+  let!(:create_admin_permission) do
+    create :permission,
+           role: 'admin'
+  end
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member'
+  end
+  describe 'GET /api/v2/admin/levels' do
+    let(:do_request) { get '/api/v2/admin/levels', headers: auth_header }
+
+    context 'admin user' do
+      let(:test_user) { create(:user, role: 'admin') }
+
+      it 'returns levels' do
+        do_request
+
+        expect(response.status).to eq(200)
+
+        result = JSON.parse(response.body)
+
+        expect(result.length).to eq(Level.count)
+
+        result.each do |level|
+          expected_level = Level.find(level['id'])
+
+          expect(level['key']).to eq(expected_level.key)
+          expect(level['value']).to eq(expected_level.value)
+        end
+      end
+    end
+  end
+end

spec/api/v2/admin/metrics_spec.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe API::V2::Admin::Metrics do
+  include_context 'bearer authentication'
+  let!(:create_admin_permission) do
+    create :permission,
+           role: 'admin'
+  end
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member'
+  end
+  describe 'GET /api/v2/admin/users' do
+    let(:do_request) { get '/api/v2/admin/metrics', headers: auth_header }
+
+    context 'admin user' do
+      let(:test_user) { create(:user, role: 'admin') }
+
+      it 'returns empty hashes if no activity in database' do
+        do_request
+
+        expect(response.status).to eq(200)
+        expect(response.body).to eq("{\"signups\":{},\"sucessful_logins\":{},\"failed_logins\":{},\"pending_applications\":0}")
+
+        result = JSON.parse(response.body)
+        expect(result['signups']).to eq({})
+        expect(result['sucessful_logins']).to eq({})
+        expect(result['failed_logins']).to eq({})
+      end
+
+      context 'with data' do
+        let!(:login_activity) { create(:activity, action: 'login', result: 'succeed', topic: 'session', user: test_user) }
+        let!(:signup_activity) { create(:activity, action: 'signup', result: 'succeed', topic: 'account', user: test_user) }
+        let!(:failed_login_activity) { create(:activity, topic: 'session', action: 'login', result: 'failed', user: test_user) }
+
+        it 'returns data as expected' do
+          do_request
+
+          expect(response.status).to eq(200)
+          expect(JSON.parse(response.body)['failed_logins']).not_to eq({})
+          expect(JSON.parse(response.body)['sucessful_logins']).not_to eq({})
+          expect(JSON.parse(response.body)['signups']).not_to eq({})
+        end
+      end
+    end
+  end
+end

spec/api/v2/admin/permissions_spec.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+describe API::V2::Admin::Permissions do
+  include_context 'bearer authentication'
+
+  let!(:create_admin_permission) { create(:permission, role: 'superadmin', action: 'accept', verb: 'get') }
+  let!(:test_user) { create(:user, role: 'superadmin') }
+  let!(:create_member_permission) { create(:permission, role: 'member') }
+
+  describe 'GET /api/v2/admin/permissions' do
+    context 'successful response' do
+      it 'returns all permissions' do
+        get '/api/v2/admin/permissions', headers: auth_header
+
+        result = JSON.parse(response.body)
+        expect(response).to be_successful
+        expect(result.count).to eq(Permission.count)
+      end
+
+      it 'returns paginated permissions' do
+        get '/api/v2/admin/permissions', params: { limit: 1, page: 1 }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response).to be_successful
+        expect(response.headers.fetch('Total')).to eq '2'
+        expect(result.size).to eq 1
+        expect(result.first['role']).to eq 'superadmin'
+
+        get '/api/v2/admin/permissions', params: { limit: 1, page: 2 }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response).to be_successful
+        expect(response.headers.fetch('Total')).to eq '2'
+        expect(result.size).to eq 1
+        expect(result.first['role']).to eq 'member'
+      end
+    end
+  end
+
+  describe 'POST /api/v2/admin/permissions' do
+    context 'unsuccessful response' do
+      it 'returns error while invalid verb creating' do
+        post '/api/v2/admin/permissions', params: { role: 'admin', action: 'drop', verb: 'options', path: 'api/v2' }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response.code).to eq '422'
+        expect(result['errors']).to eq(['admin.permissions.invalid_verb'])
+      end
+
+      it 'returns error while invalid action creating' do
+        post '/api/v2/admin/permissions', params: { role: 'admin', action: 'delete', verb: 'put', path: 'api/v2' }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response.code).to eq '422'
+        expect(result['errors']).to eq(['admin.permissions.invalid_action'])
+      end
+
+      it 'returns error while invalid role creating' do
+        post '/api/v2/admin/permissions', params: { role: 'supertrader', action: 'accept', verb: 'put', path: 'api/v2' }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response.code).to eq '422'
+        expect(result['errors']).to eq(['admin.permission.role_doesnt_exist'])
+      end
+
+      it 'returns error while empty action creating' do
+        post '/api/v2/admin/permissions', params: { role: 'supertrader', action: '', verb: 'put', path: 'api/v2' }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response.code).to eq '422'
+        expect(result['errors']).to eq(['admin.permission.empty_action'])
+      end
+    end
+
+    context 'successful response' do
+      let(:do_request) { post '/api/v2/admin/permissions', params: { role: 'superadmin', action: 'accept', verb: 'put', path: 'api/v2/admin' }, headers: auth_header }
+      it 'creates new permission' do
+        expect { do_request }.to change { Permission.count }.by(1)
+        expect(response).to be_successful
+      end
+    end
+  end
+
+  describe 'DELETE /api/v2/admin/permissions' do
+    context 'successful response' do
+      let(:do_request) { delete '/api/v2/admin/permissions', params: { id: create_member_permission.id }, headers: auth_header }
+
+      it 'delete permission' do
+        expect { do_request }.to change { Permission.count }.by(-1)
+        expect(response).to be_successful
+      end
+    end
+
+    context 'unsuccessful response' do
+      it 'return error while permission doesnt exist' do
+        delete '/api/v2/admin/permissions', params: { id: 0 }, headers: auth_header
+        result = JSON.parse(response.body)
+        expect(response.code).to eq '404'
+        expect(result['errors']).to eq(['admin.permission.doesnt_exist'])
+      end
+    end
+  end
+
+  describe 'PUT /api/v2/admin/permissions' do
+    context 'successful response' do
+      let(:permission) { Permission.find_by(id: create_admin_permission.id) }
+
+      it 'returns updated path for permission' do
+        put '/api/v2/admin/permissions', params: { id: create_admin_permission.id , path: 'api/v2/admin' }, headers: auth_header
+
+        expect(response).to be_successful
+        expect(permission.path).to eq 'api/v2/admin'
+      end
+
+      it 'returns updated verb for permission' do
+        put '/api/v2/admin/permissions', params: { id: create_admin_permission.id , verb: 'PUT' }, headers: auth_header
+
+        expect(response).to be_successful
+        expect(permission.verb).to eq 'PUT'
+      end
+
+      it 'returns updated fileds for permission' do
+        put '/api/v2/admin/permissions', params: { id: create_admin_permission.id , verb: 'POST', action: 'all', path: 'api/v2' }, headers: auth_header
+
+        expect(response).to be_successful
+        expect(permission.verb).to eq 'POST'
+        expect(permission.action).to eq 'ALL'
+        expect(permission.path).to eq 'api/v2'
+      end
+    end
+
+    context 'unsuccessful response' do
+      it 'return error while permission doesnt exist' do
+        put '/api/v2/admin/permissions', params: { id: 0, action: 'accept' }, headers: auth_header
+
+        result = JSON.parse(response.body)
+
+        expect(response.code).to eq '404'
+        expect(result['errors']).to eq(['admin.permission.doesnt_exist'])
+      end
+    end
+  end
+end

spec/api/v2/admin/profiles_spec.rb

@@ -0,0 +1,211 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+describe API::V2::Admin::Profiles do
+  include_context 'bearer authentication'
+
+  let!(:create_admin_permission) do
+    create :permission,
+           role: 'admin'
+    create :permission,
+           role: 'superadmin'
+  end
+
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member'
+  end
+  let!(:test_user) { create(:user, role: 'superadmin') }
+  let!(:profile1) { create(:profile) }
+  let!(:profile2) { create(:profile) }
+  let!(:profile3) { create(:profile) }
+  let!(:profile4) { create(:profile) }
+  let!(:profile5) { create(:profile) }
+
+  describe 'GET /api/v2/admin/profiles' do
+    context 'successful response' do
+      it 'returns all profiles' do
+        get '/api/v2/admin/profiles', headers: auth_header
+
+        result = JSON.parse(response.body)
+        expect(response).to be_successful
+
+        expect(result.count).to eq(Profile.count)
+        expect(result.first.keys).to match_array %w[first_name last_name dob address postcode city country state metadata created_at updated_at]
+      end
+
+      it 'returns paginated profiles' do
+        get '/api/v2/admin/profiles', params: { limit: 1, page: 1 }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response).to be_successful
+        expect(response.headers.fetch('Total')).to eq '5'
+        expect(result.size).to eq 1
+        expect(result.first['first_name']).to eq profile1.first_name
+        expect(result.first['last_name']).to eq profile1.last_name
+        expect(result.first['dob']).to eq profile1.dob.to_s
+
+        get '/api/v2/admin/profiles', params: { limit: 1, page: 2 }, headers: auth_header
+        result = JSON.parse(response.body)
+
+        expect(response).to be_successful
+        expect(response.headers.fetch('Total')).to eq '5'
+        expect(result.size).to eq 1
+        expect(result.first['first_name']).to eq profile2.first_name
+        expect(result.first['last_name']).to eq profile2.last_name
+        expect(result.first['dob']).to eq profile2.dob.to_s
+
+      end
+    end
+  end
+
+  describe 'POST /api/v2/admin/profiles' do
+    let(:user) { create :user }
+    let!(:request_params) do
+      {
+        last_name: Faker::Name.last_name,
+        first_name: Faker::Name.first_name,
+        dob: Faker::Date.birthday,
+        country: Faker::Address.country_code_long,
+        city: Faker::Address.city,
+        address: Faker::Address.street_address,
+        postcode: Faker::Address.zip_code
+      }
+    end
+
+    context 'successful response' do
+      it 'works correctly' do
+        expect { post '/api/v2/admin/profiles', params: request_params.merge(uid: user.uid), headers: auth_header }
+          .to change { Profile.count }.by(1)
+
+        expect(response.status).to eq(201)
+        expect(json_body.keys).to match_array %i[first_name last_name dob address postcode city country state metadata created_at updated_at]
+        expect(json_body[:first_name]).to eq Profile.last.first_name
+        expect(json_body[:last_name]).to eq Profile.last.last_name
+        expect(json_body[:dob]).to eq Profile.last.dob.to_s
+        expect(json_body[:state]).to eq('submitted')
+        expect(json_body[:metadata]).to be_blank
+        expect(Profile.last.author).to eq(test_user.uid)
+      end
+    end
+  end
+
+  describe 'PUT /api/v2/admin/profiles' do
+    context 'successful response' do
+      let!(:member_with_profile) do
+        @member = create :user, role: 'member'
+        create(:profile, user_id: @member.id, state: 'submitted')
+      end
+
+      it 'returns profile' do
+        put '/api/v2/admin/profiles', params: { uid: @member.uid, state: 'verified' }, headers: auth_header
+
+        expect(response.status).to eq(200)
+        profile = @member.profiles.last
+        expect(profile).to be
+        expect(json_body.keys).to match_array %i[first_name last_name dob address postcode city country state metadata created_at updated_at]
+        expect(json_body[:first_name]).to eq profile.first_name
+        expect(json_body[:last_name]).to eq profile.last_name
+        expect(json_body[:dob]).to eq profile.dob.to_s
+        expect(json_body[:state]).to eq('verified')
+        expect(profile.state).to eq('verified')
+      end
+
+      let!(:superadmin_with_profile) do
+        @user = create :user, role: 'superadmin'
+        create(:profile, user_id: @user.id, state: 'submitted')
+      end
+
+      it 'return profiles when superadmin updates superadmin' do
+        test_user.update!(role: 'superadmin')
+        put '/api/v2/admin/profiles', params: { uid: @user.uid, state: 'verified' }, headers: auth_header
+
+        expect(response.status).to eq(200)
+        profile = @user.profiles.last
+        expect(profile).to be
+        expect(json_body.keys).to match_array %i[first_name last_name dob address postcode city country state metadata created_at updated_at]
+        expect(json_body[:first_name]).to eq profile.first_name
+        expect(json_body[:last_name]).to eq profile.last_name
+        expect(json_body[:dob]).to eq profile.dob.to_s
+        expect(json_body[:state]).to eq('verified')
+        expect(profile.state).to eq('verified')
+        expect(profile.metadata).to be_blank
+      end
+    end
+
+    context 'unsuccessful response' do
+      let!(:admin_test) { test_user.update(role: 'admin') }
+
+      let!(:superadmin_with_profile) do
+        @user = create :user, role: 'superadmin'
+        create(:profile, user_id: @user.id, state: 'submitted', author: test_user.uid)
+
+        @user_admin = create :user, role: 'admin'
+        create(:profile, user_id: @user_admin.id, state: 'submitted', author: test_user.uid)
+      end
+
+      it 'return error when non-superadmin user updates superadmin' do
+        put '/api/v2/admin/profiles', params: { uid: @user.uid, state: 'rejected' }, headers: auth_header
+
+        result = JSON.parse(response.body)
+        expect(response.code).to eq '422'
+        expect(result['errors']).to eq(['admin.profiles.superadmin_change'])
+      end
+
+      it 'return error when author is trying to approve himself' do
+        allow(Barong::App.config).to receive_messages(profile_double_verification: 'true')
+
+        put '/api/v2/admin/profiles', params: { uid: @user_admin.uid, state: 'rejected' }, headers: auth_header
+
+        result = JSON.parse(response.body)
+        expect(response.code).to eq '422'
+        expect(result['errors']).to eq(['admin.profiles.second_admin_approval'])
+      end
+
+      it 'renders an error when profile doesnt exist' do
+        put '/api/v2/admin/profiles', params: { uid: '0', state: 'rejected' }, headers: auth_header
+        expect_status.to eq(404)
+        expect_body.to eq(errors: ['admin.profiles.doesnt_exist_or_not_editable'])
+      end
+
+      it 'renders an error when profile is not editable' do
+        put '/api/v2/admin/profiles', params: { uid: profile3.user.uid, state: 'rejected' }, headers: auth_header
+        expect_status.to eq(404)
+        expect_body.to eq(errors: ['admin.profiles.doesnt_exist_or_not_editable'])
+      end
+    end
+
+    context 'user with different amount of profile fields' do
+      let!(:profile) { create(:profile, user: test_user, last_name: nil, first_name: nil, state: 'submitted') }
+
+      it 'returns partial updated profile' do
+        put '/api/v2/admin/profiles', params: { uid: test_user.uid, state: 'rejected' }, headers: auth_header
+
+        expect(response.status).to eq(200)
+        profile = test_user.profiles.last
+        expect(profile).to be
+        expect(json_body.keys).to match_array %i[first_name last_name dob address postcode city country state metadata created_at updated_at]
+        expect(json_body[:first_name]).to eq profile.first_name
+        expect(json_body[:last_name]).to eq profile.last_name
+        expect(json_body[:dob]).to eq profile.dob.to_s
+        expect(json_body[:state]).to eq('rejected')
+        expect(profile.state).to eq('rejected')
+      end
+
+      it 'returns full updated profile' do
+        put '/api/v2/admin/profiles', params: { uid: test_user.uid, state: 'rejected' }, headers: auth_header
+
+        expect(response.status).to eq(200)
+        profile = test_user.profiles.last
+        expect(profile).to be
+        expect(json_body.keys).to match_array %i[first_name last_name dob address postcode city country state metadata created_at updated_at]
+        expect(json_body[:first_name]).to eq profile.first_name
+        expect(json_body[:last_name]).to eq profile.last_name
+        expect(json_body[:dob]).to eq profile.dob.to_s
+        expect(json_body[:state]).to eq('rejected')
+        expect(profile.state).to eq('rejected')
+        expect(profile.metadata).to be_blank
+      end
+    end
+  end
+end

spec/api/v2/admin/restrictions_spec.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+describe API::V2::Admin::Restrictions do
+  include_context 'bearer authentication'
+
+  before { create(:permission, role: 'superadmin') }
+  let!(:test_user) { create(:user, role: 'superadmin') }
+
+  describe 'GET /api/v2/admin/restrictions' do
+    before do
+      create(:restriction, scope: 'ip', value: '0.0.0.1', category: 'blacklist', updated_at: 1.days.ago)
+      create(:restriction, scope: 'ip', value: '0.0.0.0', category: 'blacklist', updated_at: 3.days.ago)
+      create(:restriction, scope: 'ip_subnet', value: '1.2.3.4/24', category: 'blacklist', updated_at: 3.days.ago)
+    end
+
+    context 'successful response' do
+      it 'returns all restrictions' do
+        get '/api/v2/admin/restrictions', headers: auth_header
+
+        expect(response).to be_successful
+        expect(json_body.count).to eq(Restriction.count)
+      end
+
+      it 'filters by scope' do
+        get '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'ip' }
+
+        expect(json_body.length).to eq Restriction.where(scope: 'ip').count
+        expect(json_body.map { |r| r[:scope] }).to all eq 'ip'
+      end
+
+      it 'filters by category' do
+        get '/api/v2/admin/restrictions', headers: auth_header, params: { category: 'blacklist' }
+
+        expect(json_body.length).to eq Restriction.where(category: 'blacklist').count
+        expect(json_body.map { |r| r[:category] }).to all eq 'blacklist'
+      end
+
+      it 'filters with date range' do
+        get '/api/v2/admin/restrictions', headers: auth_header, params: { from: 2.days.ago.to_i, range: 'updated' }
+
+        expected = Restriction.where("updated_at >= ?", 2.days.ago)
+        expect(json_body.map { |r| r[:id] }).to match_array expected.map(&:id)
+      end
+
+      it 'returns paginated restrictions' do
+        get '/api/v2/admin/restrictions', headers: auth_header, params: { limit: 1 }
+        result = json_body
+
+        expect(response).to be_successful
+        expect(response.headers.fetch('Total')).to eq '3'
+        expect(result.size).to eq 1
+      end
+    end
+  end
+
+  describe 'POST /api/v2/admin/whitelink' do
+    context 'with default expire time' do
+      it 'create a whitelink token' do
+        post '/api/v2/admin/restrictions/whitelink', headers: auth_header
+
+        expect(response).to be_successful
+        expect(json_body[:whitelink_token]).not_to be nil
+      end
+    end
+
+    context 'with custom expire time' do
+      it 'create a whitelink token' do
+        post '/api/v2/admin/restrictions/whitelink', headers: auth_header, params: { expire_time: 30 }
+
+        expect(response).to be_successful
+        expect(json_body[:whitelink_token]).not_to be nil
+      end
+
+      it 'returns error if expire time too big' do
+        post '/api/v2/admin/restrictions/whitelink', headers: auth_header, params: { expire_time: 31 }
+
+        expect(response.status).to eq 422
+        expect(json_body[:whitelink_token]).to be nil
+        expect(json_body[:errors]).to include "invalid_expire"
+      end
+    end
+  end
+
+  describe 'POST /api/v2/admin/restrictions' do
+    it 'creates new restriction' do
+      expect {
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'ip', value: '127.0.0.0', category: 'blacklist' }
+      }.to change { Restriction.count }.by(1)
+
+      expect(response).to be_successful
+    end
+
+    it 'creates new restriction with code' do
+      expect {
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'ip', value: '127.0.0.0', category: 'blacklist', code: 522 }
+      }.to change { Restriction.count }.by(1)
+
+      expect(response).to be_successful
+    end
+
+    it 'creates new whitelist restriction' do
+      expect {
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'ip', value: '127.0.0.0', category: 'whitelist' }
+      }.to change { Restriction.count }.by(1)
+
+      expect(response).to be_successful
+    end
+
+    it 'creates new maintenance restriction' do
+      expect {
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'ip', value: '127.0.0.0', category: 'maintenance' }
+      }.to change { Restriction.count }.by(1)
+
+      expect(response).to be_successful
+    end
+
+    context 'validation' do
+      it 'scope and state' do
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'office', value: '127.0.0.0', state: 'running' }
+
+        expect(json_body[:errors]).to include "admin.restriction.invalid_scope"
+        expect(json_body[:errors]).to include "admin.restriction.invalid_state"
+      end
+
+      it 'value' do
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'ip', value: '127.a.b.c', category: 'blacklist' }
+
+        expect(json_body[:errors]).to include "value.invalid"
+      end
+
+      it 'category' do
+        post '/api/v2/admin/restrictions', headers: auth_header, params: { scope: 'country', value: 'Ukraine', category: 'allow' }
+
+        expect(json_body[:errors]).to include "admin.restriction.invalid_category"
+      end
+    end
+  end
+
+  describe 'PUT /api/v2/admin/restrictions' do
+    let!(:restriction) { create(:restriction, scope: 'ip', value: '127.0.0.1', category: 'blacklist') }
+
+    it 'updates state' do
+      expect {
+        put '/api/v2/admin/restrictions', headers: auth_header, params: { id: restriction.id, state: 'disabled' }
+      }.to change { restriction.reload.state }.to('disabled')
+    end
+
+    it 'updates value' do
+      expect {
+        put '/api/v2/admin/restrictions', headers: auth_header, params: { id: restriction.id, value: '192.168.0.1' }
+      }.to change { restriction.reload.value }.to('192.168.0.1')
+    end
+
+    it 'does not change scope if value becomes invalid' do
+      expect {
+        put '/api/v2/admin/restrictions', headers: auth_header, params: { id: restriction.id, scope: 'ip_subnet' }
+      }.not_to change { restriction.reload.scope }
+    end
+
+    it 'validates value' do
+      put '/api/v2/admin/restrictions', headers: auth_header, params: { id: restriction.id, value: '192.168.0.abc' }
+
+      expect(response).not_to be_successful
+    end
+
+    it 'updates scope' do
+      expect {
+        put '/api/v2/admin/restrictions', headers: auth_header, params: { id: restriction.id, scope: 'ip_subnet', value: '192.168.0.1/24' }
+      }.to change { restriction.reload.scope }.to('ip_subnet').and change { restriction.reload.value }.to '192.168.0.1/24'
+    end
+
+    it 'updates category' do
+      expect {
+        put '/api/v2/admin/restrictions', headers: auth_header, params: { id: restriction.id, category: 'whitelist' }
+      }.to change { restriction.reload.category }.to('whitelist')
+    end
+  end
+
+  describe 'DELETE /api/v2/admin/restrictions' do
+    let!(:restriction) { create(:restriction, scope: 'ip', value: '127.0.0.1', category: 'blacklist') }
+
+    context 'successful response' do
+      let(:do_request) { delete '/api/v2/admin/restrictions', params: { id: restriction.id }, headers: auth_header }
+
+      it 'delete restriction' do
+        expect { do_request }.to change { Restriction.count }.by(-1)
+        expect(response).to be_successful
+      end
+    end
+
+    context 'unsuccessful response' do
+      it 'return error while restriction doesnt exist' do
+        delete '/api/v2/admin/restrictions', headers: auth_header, params: { id: 0 }
+
+        result = JSON.parse(response.body)
+        expect(response.code).to eq '404'
+        expect(result['errors']).to eq(['admin.restriction.doesnt_exist'])
+      end
+    end
+  end
+end