Add unit test for ProjectController.projectEntitiesJson

services/web/app/coffee/Features/Project/ProjectController.coffee

@@ -154,21 +154,20 @@ module.exports = ProjectController =
 	projectEntitiesJson: (req, res, next) ->
 		user_id = AuthenticationController.getLoggedInUserId(req)
 		project_id = req.params.Project_id
-		AuthorizationManager.canUserReadProject user_id, project_id,
-			null, (err, canRead) ->
+		AuthorizationManager.canUserReadProject user_id, project_id, null, (err, canRead) ->
+			return next(err) if err?
+			return res.sendStatus(403) if !canRead
+			ProjectGetter.getProject project_id, (err, project) ->
 				return next(err) if err?
-				return res.status(403) if !canRead
-				ProjectGetter.getProject project_id, (err, project) ->
+				ProjectEntityHandler.getAllEntitiesFromProject project, (err, docs, files) ->
 					return next(err) if err?
-					ProjectEntityHandler.getAllEntitiesFromProject project, (err, docs, files) ->
-						return next(err) if err?
-						entities = docs.concat(files)
-							.sort (a, b) -> a.path > b.path  # Sort by path ascending
-							.map (e) -> {
-								path: e.path,
-								type: if e.doc? then 'doc' else 'file'
-							}
-						res.json({project_id: project_id, entities: entities})
+					entities = docs.concat(files)
+						.sort (a, b) -> a.path > b.path  # Sort by path ascending
+						.map (e) -> {
+							path: e.path,
+							type: if e.doc? then 'doc' else 'file'
+						}
+					res.json({project_id: project_id, entities: entities})
 
 	projectListPage: (req, res, next)->
 		timer = new metrics.Timer("project-list")

services/web/test/unit/coffee/Project/ProjectControllerTests.coffee

@@ -547,6 +547,54 @@ describe "ProjectController", ->
 				done()
 			@ProjectController.userProjectsJson @req, @res, @next
 
+	describe 'projectEntitiesJson', ->
+		beforeEach () ->
+			@AuthenticationController.getLoggedInUserId = sinon.stub().returns 'abc'
+			@req.params = {Project_id: 'abcd'}
+			@project = { _id: 'abcd' }
+			@docs = [
+				{path: '/things/b.txt', doc: true},
+				{path: '/main.tex', doc: true}
+			]
+			@files = [
+				{path: '/things/a.txt'}
+			]
+			@ProjectGetter.getProject = sinon.stub().callsArgWith(1, null, @project)
+			@ProjectEntityHandler.getAllEntitiesFromProject = sinon.stub().callsArgWith(1, null, @docs, @files)
+
+		describe 'when the user can access the project', ->
+			beforeEach () ->
+				@AuthorizationManager.canUserReadProject = sinon.stub().callsArgWith(3, null, true)
+
+			it 'should produce a list of entities', (done) ->
+				@res.json = (data) =>
+					expect(data).to.deep.equal {
+						project_id: 'abcd',
+						entities: [
+							{path: '/main.tex',     type: 'doc'},
+							{path: '/things/a.txt', type: 'file'},
+							{path: '/things/b.txt', type: 'doc'}
+						]
+					}
+					expect(@ProjectGetter.getProject.callCount).to.equal 1
+					expect(@ProjectEntityHandler.getAllEntitiesFromProject.callCount).to.equal 1
+					done()
+				@ProjectController.projectEntitiesJson @req, @res, @next
+
+		describe 'when the user cannot access the project', ->
+			beforeEach () ->
+				@AuthorizationManager.canUserReadProject = sinon.stub().callsArgWith(3, null, false)
+
+			it 'should send a 403 response', (done) ->
+				@res.json = sinon.stub()
+				@res.sendStatus = (code) =>
+					expect(code).to.equal 403
+					expect(@ProjectGetter.getProject.callCount).to.equal 0
+					expect(@ProjectEntityHandler.getAllEntitiesFromProject.callCount).to.equal 0
+					expect(@res.json.callCount).to.equal 0
+					done()
+				@ProjectController.projectEntitiesJson @req, @res, @next
+
 	describe '_isInPercentageRollout', ->
 		before ->
 			@ids = [