[add] initial commit

spec/factories/clients.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :client do
+    name { random_string }
+    name_id { Faker::Internet.base64(length: 8, padding: false) }
+    api_key_hash { bcrypt_fake_hash }
+    description { Faker::String.random(length: 0..200) }
+    perm_r { Faker::Boolean.boolean }
+    perm_w { Faker::Boolean.boolean }
+    perm_x { false } # dont want to create random admin accounts
+    public_ip { Faker::Boolean.boolean }
+    ipv4 { empty_or_fake(Faker::Internet.public_ip_v4_address) }
+  end
+  # premade clients
+  # NOTE: api key and hash are hardcoded to speed up testing
+  factory :admin, class: 'Client' do
+    name { 'admin' }
+    name_id { 'd5d40cd9' }
+    # api_key { 'e2s1BsQEqmSE5MqyHYbDBVxGr/KY4BYIV5QkdjiCOF0=' }
+    api_key_hash { '$2y$08$peZ67RvHVjBmfhUkE8tBtexMRka9w4CPBk7dJfSp5VM4HMWxX8p/y' }
+    description { 'e2s1BsQEqmSE5MqyHYbDBVxGr/KY4BYIV5QkdjiCOF0=' } # misusing description to access api key in rspec
+    perm_r { true }
+    perm_w { true }
+    perm_x { true }
+    public_ip { false }
+    ipv4 { '' }
+  end
+  factory :public, class: 'Client' do
+    name { 'public_client.com.' }
+    name_id { '23acfa41' }
+    # api_key { 'Tn32gdYAlo1yY6RerRtwCO8KNrqFbh9m0ijyHPDqQJs=' }
+    api_key_hash { '$2y$08$2AMXQs/VQMIxyJBLeBr1vOiSX2NnEPE7RHberXMUD2B8uNx/SpGX2' }
+    description { 'Public Account' }
+    perm_r { false }
+    perm_w { true }
+    perm_x { false }
+    public_ip { true }
+    ipv4 { '153.25.33.4' }
+  end
+  factory :read, class: 'Client' do
+    name { 'read_client' }
+    name_id { '438fc1d4' }
+    # api_key { 'E1JtENz4PMLlFQzM63PyWjVIk1PunZPieYueYdM8I34=' }
+    api_key_hash { '$2y$08$a0v8JSbnHdKPqzqoZEg0qO1KHmt5TCiJSz.ICUl/MztuRw6vuNzJm' }
+    description { 'E1JtENz4PMLlFQzM63PyWjVIk1PunZPieYueYdM8I34=' } # misusing description to access api key in rspec
+    perm_r { true }
+    perm_w { false }
+    perm_x { false }
+    public_ip { false }
+    ipv4 { '' }
+  end
+  factory :write, class: 'Client' do
+    name { 'write_client' }
+    name_id { '7490d4ea' }
+    # api_key { 'Ll8XPUfDfKs5WHuY0Is/MKC8Lv3ysEgQOUc+Ya3HcuY=' }
+    api_key_hash { '$2y$08$qoo/wj5eytLQzl6bYLpPyuERdoPizOqkaq/EPIT4R8c8CADfwIQ7C' }
+    description { 'Ll8XPUfDfKs5WHuY0Is/MKC8Lv3ysEgQOUc+Ya3HcuY=' } # misusing description to access api key in rspec
+    perm_r { false }
+    perm_w { true }
+    perm_x { false }
+    public_ip { false }
+    ipv4 { '44.2.55.12' }
+  end
+end

spec/models/client_spec.rb

@@ -0,0 +1,7 @@
+require 'rails_helper'
+
+RSpec.describe Client, type: :model do
+  it { should validate_presence_of(:name) }
+  it { should validate_presence_of(:name_id) }
+  it { should validate_presence_of(:api_key_hash) }
+end

spec/rails_helper.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+# This file is copied to spec/ when you run 'rails generate rspec:install'
+require 'spec_helper'
+
+ENV['RAILS_ENV'] ||= 'test'
+require File.expand_path('../config/environment', __dir__)
+# Prevent database truncation if the environment is production
+abort('The Rails environment is running in production mode!') if Rails.env.production?
+require 'rspec/rails'
+# Add additional requires below this line. Rails is not loaded until this point!
+require 'database_cleaner'
+
+# Requires supporting ruby files with custom matchers and macros, etc, in
+# spec/support/ and its subdirectories. Files matching `spec/**/*_spec.rb` are
+# run as spec files by default. This means that files in spec/support that end
+# in _spec.rb will both be required and run as specs, causing the specs to be
+# run twice. It is recommended that you do not name files matching this glob to
+# end with _spec.rb. You can configure this pattern with the --pattern
+# option on the command line or in ~/.rspec, .rspec or `.rspec-local`.
+#
+# The following line is provided for convenience purposes. It has the downside
+# of increasing the boot-up time by auto-requiring all files in the support
+# directory. Alternatively, in the individual `*_spec.rb` files, manually
+# require only the support files necessary.
+#
+Dir[Rails.root.join('spec', 'support', '**', '*.rb')].sort.each { |f| require f }
+
+Shoulda::Matchers.configure do |config|
+  config.integrate do |with|
+    with.library :rails
+    with.test_framework :rspec
+  end
+end
+
+# Checks for pending migrations and applies them before tests are run.
+# If you are not using ActiveRecord, you can remove these lines.
+begin
+  ActiveRecord::Migration.maintain_test_schema!
+rescue ActiveRecord::PendingMigrationError => e
+  puts e.to_s.strip
+  exit 1
+end
+RSpec.configure do |config|
+  # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures
+  config.fixture_path = "#{::Rails.root}/spec/fixtures"
+
+  # If you're not using ActiveRecord, or you'd prefer not to run each of your
+  # examples within a transaction, remove the following line or assign false
+  # instead of true.
+  config.use_transactional_fixtures = true
+
+  # You can uncomment this line to turn off ActiveRecord support entirely.
+  # config.use_active_record = false
+
+  # RSpec Rails can automatically mix in different behaviours to your tests
+  # based on their file location, for example enabling you to call `get` and
+  # `post` in specs under `spec/controllers`.
+  #
+  # You can disable this behaviour by removing the line below, and instead
+  # explicitly tag your specs with their type, e.g.:
+  #
+  #     RSpec.describe UsersController, type: :controller do
+  #       # ...
+  #     end
+  #
+  # The different available types are documented in the features, such as in
+  # https://relishapp.com/rspec/rspec-rails/docs
+  config.infer_spec_type_from_file_location!
+
+  # Filter lines from Rails gems in backtraces.
+  config.filter_rails_from_backtrace!
+  # arbitrary gems may also be filtered via:
+  # config.filter_gems_from_backtrace("gem name")
+  config.include RequestSpecHelper, type: :request
+end

spec/requests/clients_request_spec.rb

@@ -0,0 +1,576 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Clients', type: :request do
+  let!(:admin_client) { create(:admin) }
+  let!(:public_client) { create(:public) }
+  let!(:read_client) { create(:read) }
+  let!(:write_client) { create(:write) }
+  let!(:clients) { create_list(:client, 20) }
+  let(:random_client) { clients[Faker::Number.between(from: 0, to: clients.length - 1)] }
+  let(:valid_client) do
+    {
+      name: 'clientA',
+      description: 'Client across the river',
+      permission: 'rw',
+      public_ip: false
+    }
+  end
+  let(:valid_client_update) do
+    {
+      name: 'clientA',
+      permission: 'w',
+      public_ip: true
+    }
+  end
+  let(:random_client_update) do
+    {
+      name: random_client.name,
+      description: 'updated description',
+      public_ip: !random_client.public_ip # swap boolean
+    }
+  end
+  let(:admin_perm_update) do
+    {
+      name: admin_client.name,
+      public_ip: !admin_client.public_ip, # swap boolean
+      permission: 'rw'
+    }
+  end
+  let(:invalid_client_update) { { names: 'clientA' } }
+  let(:non_existing_client) { 'DOES_NOT_EXIST_123546' }
+
+  # admin
+  describe 'POST /admin/client' do
+
+    context 'when sending a valid update request' do
+      before { post '/admin/client', params: valid_client, headers: api_key_header(admin_client) }
+
+      it 'updates client from rw to w and returns 200' do
+        api_key = json_response['api_key']
+        post '/admin/client', params: valid_client_update, headers: api_key_header(admin_client)
+        expect(json_response).not_to be_empty
+        expect(json_response['api_key'].length).to eq 82
+        expect(json_response['api_key'].length).not_to eq api_key
+        expect(response).to have_http_status(200)
+        api_key = json_response['api_key']
+        client_name = json_response['name']
+        # check if request was parsed properly
+        get "/admin/clients/#{client_name}", headers: api_key_header(admin_client)
+        expect(json_response).not_to be_empty
+        expect(json_response['name']).to eq valid_client[:name]
+        expect(json_response['description']).to eq valid_client[:description]
+        expect(json_response['permission']).to eq valid_client_update[:permission]
+        expect(json_response['public_ip']).to eq valid_client_update[:public_ip]
+        expect(response).to have_http_status(200)
+        # test the new api_key write
+        put '/client', headers: api_key_header(nil, api_key)
+        expect(json_response).not_to be_empty
+        expect(response).to have_http_status(200)
+        # test the new api_key read
+        get "/clients/#{client_name}", headers: api_key_header(nil, api_key)
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when sending a valid request' do
+      before { post '/admin/client', params: valid_client, headers: api_key_header(admin_client) }
+
+      it 'creates client that can read/write and returns 201' do
+        expect(json_response).not_to be_empty
+        expect(json_response['name']).to eq valid_client[:name]
+        expect(json_response['api_key'].length).to eq 82
+        expect(response).to have_http_status(201)
+        api_key = json_response['api_key']
+        # check if request was parsed properly
+        get "/admin/clients/#{valid_client[:name]}", headers: api_key_header(admin_client)
+        expect(json_response).not_to be_empty
+        expect(json_response['name']).to eq valid_client[:name]
+        expect(json_response['description']).to eq valid_client[:description]
+        expect(json_response['permission']).to eq valid_client[:permission]
+        expect(json_response['public_ip']).to eq valid_client[:public_ip]
+        expect(response).to have_http_status(200)
+        # test the new client write
+        put '/client', headers: api_key_header(nil, api_key)
+        expect(json_response).not_to be_empty
+        expect(response).to have_http_status(200)
+        ipv4 = json_response['ipv4']
+        # test the new client read
+        get "/clients/#{valid_client[:name]}", headers: api_key_header(nil, api_key)
+        expect(json_response).not_to be_empty
+        expect(response).to have_http_status(200)
+        expect(json_response['ipv4']).to eq ipv4
+      end
+    end
+
+    context 'when sending a valid request without api_key' do
+      let!(:client_count) { Client.count }
+      before { post '/admin/client', params: valid_client }
+
+      it 'does not create client and returns status code 401' do
+        expect(client_count).to eq Client.count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when sending a valid request with non admin api_key' do
+      let!(:client_count) { Client.count }
+      before { post '/admin/client', params: valid_client, headers: api_key_header(read_client) }
+
+      it 'does not create client and returns status code 403' do
+        expect(client_count).to eq Client.count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when sending an invalid request' do
+      let!(:client_count) { Client.count }
+      before { post '/admin/client', params: invalid_client_update, headers: api_key_header(admin_client) }
+
+      it 'does not create client and returns status code 405' do
+        expect(client_count).to eq Client.count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(405)
+      end
+    end
+
+    context 'when sending a valid update request to remove last admin permission' do
+      before { post '/admin/client', params: admin_perm_update, headers: api_key_header(admin_client) }
+
+      it 'does not update admin and returns status code 406' do
+        expect(admin_client.reload.perm_x).to eq true
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(406)
+      end
+    end
+
+    context 'when sending a valid update request to remove non last admin permission' do
+      before do
+        post '/admin/client', params: { name: 'admin2', permission: 'x' }, headers: api_key_header(admin_client)
+        post '/admin/client', params: admin_perm_update, headers: api_key_header(admin_client)
+      end
+
+      it 'does update admin and returns status code 200' do
+        expect(admin_client.reload.perm_x).to eq false
+        expect(response.body).not_to be_empty
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
+
+  describe 'PUT /admin/client' do
+
+    context 'when sending a valid request' do
+      before do
+        put '/admin/client', params: random_client_update, headers: api_key_header(admin_client)
+        random_client.reload
+      end
+
+      it 'updates client and returns 200' do
+        expect(random_client.description).to eq random_client_update[:description]
+        expect(random_client.public_ip).to eq random_client_update[:public_ip]
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when sending a valid request without api_key' do
+      before do
+        put '/admin/client', params: random_client_update
+        random_client.reload
+      end
+
+      it 'does not update client and returns 401' do
+        expect(random_client.description).not_to eq random_client_update[:description]
+        expect(random_client.public_ip).not_to eq random_client_update[:public_ip]
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when sending a valid request with non admin api_key' do
+      before do
+        put '/admin/client', params: random_client_update, headers: api_key_header(write_client)
+        random_client.reload
+      end
+
+      it 'does not update client and returns 403' do
+        expect(random_client.description).not_to eq random_client_update[:description]
+        expect(random_client.public_ip).not_to eq random_client_update[:public_ip]
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when sending a valid request for non existing client' do
+      before do
+        random_client_update[:name] = non_existing_client
+        put '/admin/client', params: random_client_update, headers: api_key_header(admin_client)
+        random_client.reload
+      end
+
+      it 'does not update client and returns 404' do
+        expect(random_client.description).not_to eq random_client_update[:description]
+        expect(random_client.public_ip).not_to eq random_client_update[:public_ip]
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'when sending an invalid valid request' do
+      before { put '/admin/client', params: invalid_client_update, headers: api_key_header(admin_client) }
+
+      it 'returns 405' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(405)
+      end
+    end
+
+    context 'when sending a valid valid request to remove last admin permission' do
+      before do
+        put '/admin/client', params: admin_perm_update, headers: api_key_header(admin_client)
+        admin_client.reload
+      end
+
+      it 'does not update admin and returns 406' do
+        expect(admin_client.perm_x).to eq true
+        expect(admin_client.public_ip).to_not eq admin_perm_update[:public_ip]
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(406)
+      end
+    end
+
+    context 'when sending a valid update request to remove non last admin permission' do
+      before do
+        put '/admin/client', params: { name: random_client.name, permission: 'x' },
+                             headers: api_key_header(admin_client)
+        put '/admin/client', params: admin_perm_update, headers: api_key_header(admin_client)
+      end
+
+      it 'does update admin and returns status code 200' do
+        expect(admin_client.reload.perm_x).to eq false
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
+
+  describe 'GET /admin/clients' do
+
+    context 'when requesting all clients' do
+      before { get '/admin/clients', headers: api_key_header(admin_client) }
+      it 'returns list of all clients and status code 200' do
+        expect(list_equals_db?(json_response)).to eq true
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when requesting  all clients with no api_key' do
+      before { get '/admin/clients' }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when requesting all clients with write api_key' do
+      before { get '/admin/clients', headers: api_key_header(write_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when requesting all clients with read api_key' do
+      before { get '/admin/clients', headers: api_key_header(read_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+  end
+
+  describe 'GET /admin/clients/:name' do
+
+    context 'when requesting random_client.name client with admin api_key' do
+      before { get "/admin/clients/#{random_client.name}", headers: api_key_header(admin_client) }
+      it 'returns info and status code 200' do
+        expect(json_response['name']).to eq random_client.name
+        expect(json_response['description']).to eq random_client.description
+        expect(json_response['permission']).to eq parse_permission(random_client.perm_r, random_client.perm_w,
+                                                                   random_client.perm_x)
+        expect(json_response['public_ip']).to eq random_client.public_ip
+        expect(json_response['ipv4']).to eq random_client.ipv4
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when requesting random client with no api_key' do
+      before { get "/admin/clients/#{random_client.name}" }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when requesting random client with write api_key' do
+      before { get "/admin/clients/#{random_client.name}", headers: api_key_header(write_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when requesting random client with read api_key' do
+      before { get "/admin/clients/#{random_client.name}", headers: api_key_header(read_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when requesting non existing client' do
+      before { get "/admin/clients/#{non_existing_client}", headers: api_key_header(admin_client) }
+      it 'returns status code 404' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  describe 'DELETE /admin/clients/:name' do
+
+    context 'when sending a valid request' do
+      let!(:client_count) { Client.count - 1 }
+      before { delete "/admin/clients/#{random_client.name}", headers: api_key_header(admin_client) }
+
+      it 'deletes client and returns 200' do
+        expect(Client.find_by(name: random_client.name)).to eq nil
+        expect(Client.count).to eq client_count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when sending a valid request without api_key' do
+      let!(:client_count) { Client.count }
+      before { delete "/admin/clients/#{random_client.name}" }
+
+      it 'does not delete client and returns 401' do
+        expect(Client.find_by(name: random_client.name)).to eq random_client
+        expect(Client.count).to eq client_count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when sending a valid request with non admin api_key' do
+      let!(:client_count) { Client.count }
+      before { delete "/admin/clients/#{random_client.name}", headers: api_key_header(read_client) }
+
+      it 'does not delete client and returns 403' do
+        expect(Client.find_by(name: random_client.name)).to eq random_client
+        expect(Client.count).to eq client_count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when sending a valid request for non existing client' do
+      let!(:client_count) { Client.count }
+      before { delete "/admin/clients/#{non_existing_client}", headers: api_key_header(admin_client) }
+
+      it 'does not delete client and returns 404' do
+        expect(Client.count).to eq client_count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'when sending a valid valid request to delete last admin' do
+      let!(:client_count) { Client.count }
+      before { delete "/admin/clients/#{admin_client.name}", headers: api_key_header(admin_client) }
+
+      it 'does not delete admin and returns 406' do
+        expect(Client.find_by(name: admin_client.name)).to eq admin_client
+        expect(Client.count).to eq client_count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(406)
+      end
+    end
+
+    context 'when sending a valid update request to delete non last admin' do
+      let!(:client_count) { Client.count - 1 }
+      before do
+        put '/admin/client', params: { name: random_client.name, permission: 'x' },
+                             headers: api_key_header(admin_client)
+        delete "/admin/clients/#{admin_client.name}", headers: api_key_header(admin_client)
+      end
+
+      it 'does delete admin and returns status code 200' do
+        expect(Client.find_by(name: admin_client.name)).to eq nil
+        expect(Client.count).to eq client_count
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
+
+  # client (write)
+  describe 'PUT /client' do
+
+    context 'when requesting with write api_key' do
+      before { put '/client', headers: api_key_header(write_client) }
+      it 'returns status code 200' do
+        expect(json_response['name']).to eq write_client.name
+        expect(json_response['ipv4']).to eq '127.0.0.1'
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when requesting with write api_key and body' do
+      before { put '/client', params: { ipv4: '99.55.66.2' }, headers: api_key_header(write_client) }
+      it 'returns status code 200' do
+        expect(json_response['name']).to eq write_client.name
+        expect(json_response['ipv4']).to eq '99.55.66.2'
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when requesting with no api_key' do
+      before { put '/client' }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when requesting with read api_key' do
+      before { put '/client', headers: api_key_header(read_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when requesting with api_key of non existing client' do
+      before do
+        write_client.delete
+        put '/client', headers: api_key_header(write_client)
+      end
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+  end
+
+  describe 'DELETE /client' do
+
+    context 'when requesting with write api_key' do
+      before { delete '/client', headers: api_key_header(write_client) }
+      it 'deletes ipv4 value and returns previous value with status code 200' do
+        expect(json_response['name']).to eq write_client.name
+        expect(json_response['ipv4']).to eq write_client.ipv4
+        expect(response).to have_http_status(200)
+        # check if deletion was successful
+        write_client.reload
+        expect(write_client.ipv4).to eq ''
+      end
+    end
+
+    context 'when requesting with no api_key' do
+      before { delete '/client' }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when requesting with read api_key' do
+      before { delete '/client', headers: api_key_header(read_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when requesting with write api_key and invalid ip body' do
+      before { put '/client', params: { ipv4: '5.9.256.66' }, headers: api_key_header(write_client) }
+      it 'returns status code 406' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(406)
+      end
+    end
+  end
+
+  # client (read)
+  describe 'GET /clients/:name' do
+
+    context 'when requesting write client with read api_key' do
+      before { get "/clients/#{write_client.name}", headers: api_key_header(read_client) }
+      it 'returns status code 200' do
+        expect(json_response['name']).to eq write_client.name
+        expect(json_response['ipv4']).to eq write_client.ipv4
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when requesting write client with no api_key' do
+      before { get "/clients/#{write_client.name}" }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'request write client with write api_key' do
+      before { get "/clients/#{write_client.name}", headers: api_key_header(write_client) }
+      it 'returns status code 403' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'when requesting non existing client' do
+      before { get "/clients/#{non_existing_client}", headers: api_key_header(read_client) }
+      it 'returns status code 404' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  # public
+  describe 'GET /public/:name' do
+
+    context 'request public client' do
+      before { get "/public/#{public_client.name}" }
+      it 'returns status code 200' do
+        expect(json_response['name']).to eq public_client.name
+        expect(json_response['ipv4']).to eq public_client.ipv4
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'request non existing client' do
+      before { get "/public/#{non_existing_client}" }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'request non-public client' do
+      before { get "/public/#{write_client.name}" }
+      it 'returns status code 401' do
+        expect(response.body).to be_empty
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end

spec/spec_helper.rb

@@ -0,0 +1,96 @@
+# This file was generated by the `rails generate rspec:install` command. Conventionally, all
+# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
+# The generated `.rspec` file contains `--require spec_helper` which will cause
+# this file to always be loaded, without a need to explicitly require it in any
+# files.
+#
+# Given that it is always loaded, you are encouraged to keep this file as
+# light-weight as possible. Requiring heavyweight dependencies from this file
+# will add to the boot time of your test suite on EVERY test run, even for an
+# individual file that may not need all of that loaded. Instead, consider making
+# a separate helper file that requires the additional dependencies and performs
+# the additional setup, and require it from the spec files that actually need
+# it.
+#
+# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
+RSpec.configure do |config|
+  # rspec-expectations config goes here. You can use an alternate
+  # assertion/expectation library such as wrong or the stdlib/minitest
+  # assertions if you prefer.
+  config.expect_with :rspec do |expectations|
+    # This option will default to `true` in RSpec 4. It makes the `description`
+    # and `failure_message` of custom matchers include text for helper methods
+    # defined using `chain`, e.g.:
+    #     be_bigger_than(2).and_smaller_than(4).description
+    #     # => "be bigger than 2 and smaller than 4"
+    # ...rather than:
+    #     # => "be bigger than 2"
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  # rspec-mocks config goes here. You can use an alternate test double
+  # library (such as bogus or mocha) by changing the `mock_with` option here.
+  config.mock_with :rspec do |mocks|
+    # Prevents you from mocking or stubbing a method that does not exist on
+    # a real object. This is generally recommended, and will default to
+    # `true` in RSpec 4.
+    mocks.verify_partial_doubles = true
+  end
+
+  # This option will default to `:apply_to_host_groups` in RSpec 4 (and will
+  # have no way to turn it off -- the option exists only for backwards
+  # compatibility in RSpec 3). It causes shared context metadata to be
+  # inherited by the metadata hash of host groups and examples, rather than
+  # triggering implicit auto-inclusion in groups with matching metadata.
+  config.shared_context_metadata_behavior = :apply_to_host_groups
+
+# The settings below are suggested to provide a good initial experience
+# with RSpec, but feel free to customize to your heart's content.
+=begin
+  # This allows you to limit a spec run to individual examples or groups
+  # you care about by tagging them with `:focus` metadata. When nothing
+  # is tagged with `:focus`, all examples get run. RSpec also provides
+  # aliases for `it`, `describe`, and `context` that include `:focus`
+  # metadata: `fit`, `fdescribe` and `fcontext`, respectively.
+  config.filter_run_when_matching :focus
+
+  # Allows RSpec to persist some state between runs in order to support
+  # the `--only-failures` and `--next-failure` CLI options. We recommend
+  # you configure your source control system to ignore this file.
+  config.example_status_persistence_file_path = "spec/examples.txt"
+
+  # Limits the available syntax to the non-monkey patched syntax that is
+  # recommended. For more details, see:
+  #   - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/
+  #   - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
+  #   - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode
+  config.disable_monkey_patching!
+
+  # Many RSpec users commonly either run the entire suite or an individual
+  # file, and it's useful to allow more verbose output when running an
+  # individual spec file.
+  if config.files_to_run.one?
+    # Use the documentation formatter for detailed output,
+    # unless a formatter has already been configured
+    # (e.g. via a command-line flag).
+    config.default_formatter = "doc"
+  end
+
+  # Print the 10 slowest examples and example groups at the
+  # end of the spec run, to help surface which specs are running
+  # particularly slow.
+  config.profile_examples = 10
+
+  # Run specs in random order to surface order dependencies. If you find an
+  # order dependency and want to debug it, you can fix the order by providing
+  # the seed, which is printed after each run.
+  #     --seed 1234
+  config.order = :random
+
+  # Seed global randomization in this process using the `--seed` CLI option.
+  # Setting this allows you to use `--seed` to deterministically reproduce
+  # test failures related to randomization by passing the same `--seed` value
+  # as the one that triggered the failure.
+  Kernel.srand config.seed
+=end
+end

spec/support/factory_bot.rb

@@ -0,0 +1,3 @@
+RSpec.configure do |config|
+  config.include FactoryBot::Syntax::Methods
+end

spec/support/factory_clients_helper.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+def bcrypt_fake_hash
+  # bcrypt output is defined as follows:
+  # $<id>$<cost>$<salt><digest>
+  # with <salt> and <digest> being base64 encoded with the following alphabet:
+  # ./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
+  bcrypt_alphabet = [
+    %w[. /],
+    Array('A'..'Z'),
+    Array('a'..'z'),
+    Array('0'..'9')
+  ].flatten
+  id = "2#{Faker::Base.sample(%w[a x y], 1).join}"
+  cost = format('%02d', Faker::Number.between(from: 4, to: 99))
+  salt = Faker::Base.sample(bcrypt_alphabet, 22).join
+  digest = Faker::Base.sample(bcrypt_alphabet, 31).join
+  "$#{id}$#{cost}$#{salt}#{digest}"
+end
+
+def nil_or_fake(fake)
+  Faker::Boolean.boolean ? fake : nil
+end
+
+def empty_or_fake(fake)
+  Faker::Boolean.boolean ? fake : ''
+end
+
+# custom alphabet for name
+def random_string
+  alphabet = [
+    %w[. _ - @],
+    Array('A'..'Z'),
+    Array('a'..'z'),
+    Array('0'..'9')
+  ].flatten
+  Faker::Base.sample(alphabet, 20).join[0, Faker::Number.between(from: 3, to: 19)]
+end

spec/support/request_spec_helper.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module RequestSpecHelper
+  def json_response
+    JSON.parse(response.body)
+  end
+
+  def api_key_header(client, api_key = nil)
+    api_key ||= [RynDNS::Application::API_KEY_PREFIX, client.name_id, client.description].join('.')
+    { RynDNS::Application::API_KEY_HEADER =>
+        api_key }
+  end
+
+  def parse_permission(perm_r, perm_w, perm_x)
+    "#{'r' if perm_r}#{'w' if perm_w}#{'x' if perm_x}"
+  end
+
+  def list_equals_db?(client_list)
+    return false unless Client.count == client_list.count
+
+    client_list.each do |client|
+      db_client = Client.find_by name: client[:name.to_s]
+      return false unless db_client.description == client[:description.to_s] &&
+                          db_client.permission == client[:permission.to_s] &&
+                          db_client.public_ip == client[:public_ip.to_s] &&
+                          db_client.ipv4 == client[:ipv4.to_s]
+    end
+    true
+  end
+
+end