add support for filtering with an array of bearer roles

Author: ezekg

app/models/token.rb

@@ -145,9 +145,9 @@ def actions = loaded? ? collect(&:action) : super
       type.blank? && id.blank? && role.blank?
 
     scope = all
-    scope = scope.for_bearer_type(type) if type.present?
-    scope = scope.for_bearer_id(id)     if id.present?
-    scope = scope.for_bearer_role(role) if role.present?
+    scope = scope.for_bearer_type(type)  if type.present?
+    scope = scope.for_bearer_id(id)      if id.present?
+    scope = scope.for_bearer_role(*role) if role.present?
 
     scope
   } do
@@ -173,12 +173,15 @@ def users        = for_bearer_type(:user)
     where(bearer_id: bearer_id)
   }
 
-  scope :for_bearer_role, -> role {
-    name = role.to_s.underscore
+  scope :for_bearer_role, -> *roles {
+    names = roles.map { it.to_s.underscore } # support multiple roles
+                 .compact_blank
+                 .uniq
+
     return none if
-      name.empty?
+      names.empty?
 
-    joins(<<~SQL.squish).where(roles: { name: })
+    joins(<<~SQL.squish).where(roles: { name: names })
       INNER JOIN roles
         ON roles.resource_type = tokens.bearer_type
        AND roles.resource_id   = tokens.bearer_id

features/api/v1/tokens/index.feature

@@ -100,6 +100,20 @@ Feature: List authentication tokens
     Then the response status should be "200"
     And the response body should be an array of 1 "token"
 
+  Scenario: Admin requests tokens for multiple roles
+    Given the current account is "test1"
+    And the current account has 3 "products"
+    And the current account has 1 "token" for each "product"
+    And the current account has 5 "users"
+    And the current account has 1 "token" for each "user"
+    And the current account has 2 "licenses"
+    And the current account has 1 "token" for each "license"
+    And I am an admin of account "test1"
+    And I use an authentication token
+    When I send a GET request to "/accounts/test1/tokens?bearer[role][]=license&bearer[role][]=user"
+    Then the response status should be "200"
+    And the response body should be an array of 7 "tokens"
+
   @ee
   Scenario: Isolated environment requests their tokens while authenticated
     Given the current account is "test1"

spec/models/token_spec.rb

@@ -230,6 +230,20 @@
       expect(tokens).to_not include license_token
     end
 
+    it 'should filter by bearer roles' do
+      admin_token   = create(:token, account:, bearer: create(:admin, account:))
+      user_token    = create(:token, account:, bearer: create(:user, account:))
+      product_token = create(:token, account:, bearer: create(:product, account:))
+      license_token = create(:token, account:, bearer: create(:license, account:))
+
+      tokens = described_class.for_bearer(role: %i[user license])
+
+      expect(tokens).to_not include admin_token
+      expect(tokens).to include user_token
+      expect(tokens).to_not include product_token
+      expect(tokens).to include license_token
+    end
+
     it 'should filter by bearer role' do
       admin_token   = create(:token, account:, bearer: create(:admin, account:))
       user_token    = create(:token, account:, bearer: create(:user, account:))