From b1227f25b9cf350800b9a4142b068cc58cc5dcb0 Mon Sep 17 00:00:00 2001
From: Skander Mzali <skanderm@gmail.com>
Date: Wed, 17 Jan 2024 13:22:58 -0800
Subject: [PATCH] Fix sending submissions as signed-out listener, add automated
 test against regressions

---
 server/lib/orcasite/radio/candidate.ex        |  4 +-
 server/lib/orcasite/radio/detection.ex        |  4 +-
 server/lib/orcasite/radio/feed.ex             |  2 +-
 .../test/orcasite_web/graphql/radio_test.exs  | 72 +++++++++++++++++++
 ui/src/graphql/generated/index.ts             | 15 ++++
 .../graphql/mutations/submitDetection.graphql |  7 ++
 6 files changed, 99 insertions(+), 5 deletions(-)
 create mode 100644 server/test/orcasite_web/graphql/radio_test.exs

diff --git a/server/lib/orcasite/radio/candidate.ex b/server/lib/orcasite/radio/candidate.ex
index 95751ed4..ec7a5ad5 100644
--- a/server/lib/orcasite/radio/candidate.ex
+++ b/server/lib/orcasite/radio/candidate.ex
@@ -47,11 +47,11 @@ defmodule Orcasite.Radio.Candidate do
       authorize_if always()
     end
 
-    policy action_type(:read) do
+    bypass action_type(:read) do
       authorize_if always()
     end
 
-    policy action_type(:create) do
+    bypass action_type(:create) do
       authorize_if always()
     end
 
diff --git a/server/lib/orcasite/radio/detection.ex b/server/lib/orcasite/radio/detection.ex
index 9de20e7d..db51f95e 100644
--- a/server/lib/orcasite/radio/detection.ex
+++ b/server/lib/orcasite/radio/detection.ex
@@ -56,11 +56,11 @@ defmodule Orcasite.Radio.Detection do
       authorize_if always()
     end
 
-    policy action_type(:read) do
+    bypass action_type(:read) do
       authorize_if always()
     end
 
-    policy action_type(:create) do
+    bypass action_type(:create) do
       authorize_if always()
     end
 
diff --git a/server/lib/orcasite/radio/feed.ex b/server/lib/orcasite/radio/feed.ex
index 377de63c..b4d02f5a 100644
--- a/server/lib/orcasite/radio/feed.ex
+++ b/server/lib/orcasite/radio/feed.ex
@@ -61,7 +61,7 @@ defmodule Orcasite.Radio.Feed do
       authorize_if always()
     end
 
-    policy action_type(:read) do
+    bypass action_type(:read) do
       authorize_if always()
     end
   end
diff --git a/server/test/orcasite_web/graphql/radio_test.exs b/server/test/orcasite_web/graphql/radio_test.exs
new file mode 100644
index 00000000..4c9cdde6
--- /dev/null
+++ b/server/test/orcasite_web/graphql/radio_test.exs
@@ -0,0 +1,72 @@
+defmodule OrcasiteWeb.RadioTest do
+  use OrcasiteWeb.ConnCase
+
+  setup do
+    feed =
+      Orcasite.Radio.Feed
+      |> Ash.Changeset.for_create(
+        :create,
+        %{
+          lat_lng_string: "48.5583362, -123.1735774",
+          name: "Orcasound Lab (Haro Strait)",
+          node_name: "rpi_orcasound_lab",
+          slug: "orcasound-lab"
+        }
+      )
+      |> Orcasite.Radio.create!()
+
+    [feed: feed]
+  end
+
+  test "unauthenticated listeners can submit a detection", %{conn: conn, feed: feed} do
+    conn =
+      conn
+      |> post("/graphql", %{
+        "query" => """
+          mutation submitDetection(
+            $feedId: String!
+            $playlistTimestamp: Int!
+            $playerOffset: Decimal!
+            $description: String!
+            $listenerCount: Int
+            $category: DetectionCategory!
+          ) {
+            submitDetection(
+              input: {
+                feedId: $feedId
+                playlistTimestamp: $playlistTimestamp
+                playerOffset: $playerOffset
+                listenerCount: $listenerCount
+                description: $description
+                category: $category
+                sendNotifications: false
+              }
+            ) {
+              result {
+                id
+              }
+              errors {
+                message
+                code
+                fields
+                shortMessage
+                vars
+              }
+            }
+          }
+        """,
+        "variables" => %{
+          "feedId" => feed.id,
+          "playlistTimestamp" => DateTime.to_unix(DateTime.utc_now()),
+          "playerOffset" => 5.54,
+          "description" => "Test detection",
+          "listenerCount" => 1,
+          "category" => "OTHER"
+        }
+      })
+
+    assert %{"data" => %{"submitDetection" => %{"errors" => [], "result" => %{"id" => id}}}} =
+             json_response(conn, 200)
+    assert "det_" <> _ = id
+  end
+end
diff --git a/ui/src/graphql/generated/index.ts b/ui/src/graphql/generated/index.ts
index f7c13a64..3227d585 100644
--- a/ui/src/graphql/generated/index.ts
+++ b/ui/src/graphql/generated/index.ts
@@ -1078,6 +1078,14 @@ export type SubmitDetectionMutation = {
   submitDetection?: {
     __typename?: "SubmitDetectionResult";
     result?: { __typename?: "Detection"; id: string } | null;
+    errors?: Array<{
+      __typename?: "MutationError";
+      message?: string | null;
+      code?: string | null;
+      fields?: Array<string | null> | null;
+      shortMessage?: string | null;
+      vars?: { [key: string]: any } | null;
+    } | null> | null;
   } | null;
 };
 
@@ -1694,6 +1702,13 @@ export const SubmitDetectionDocument = `
     result {
       id
     }
+    errors {
+      message
+      code
+      fields
+      shortMessage
+      vars
+    }
   }
 }
     `;
diff --git a/ui/src/graphql/mutations/submitDetection.graphql b/ui/src/graphql/mutations/submitDetection.graphql
index 98f39f51..8dd5231a 100644
--- a/ui/src/graphql/mutations/submitDetection.graphql
+++ b/ui/src/graphql/mutations/submitDetection.graphql
@@ -19,5 +19,12 @@ mutation submitDetection(
     result {
       id
     }
+    errors {
+      message
+      code
+      fields
+      shortMessage
+      vars
+    }
   }
 }