add specs

app/controllers/api/accounts_controller.rb

@@ -0,0 +1,5 @@
+class Api::AccountsController < Api::ApiController
+  def show
+    render jsonapi: current_user.accounts
+  end
+end

app/serializers/serializable_account.rb

@@ -0,0 +1,21 @@
+class SerializableAccount < JSONAPI::Serializable::Resource
+  type "account"
+
+  attributes :name
+
+  attribute :users do
+    @object.users.map do |user|
+      if user.avatar.attached?
+        avatar = Rails.application.routes.url_helpers.rails_blob_url(user.avatar, host: AppHost.new.domain_with_port)
+      else
+        avatar = nil
+      end
+      {
+        email: user.email,
+        name: user.full_name,
+        role: user.account_auths.map(&:role).compact.join(", "),
+        avatar: avatar
+      }
+    end
+  end
+end

config/routes.rb

@@ -171,6 +171,7 @@ Rails.application.routes.draw do
         post 'user_token' => 'user_token#create'
         post 'users' => 'users#create'
         resource :profiles, only: [:show]
+        resource :accounts, only: [:show]
         resources :projects, only: [:index] do
           resources :broadcasts, only: [:index, :show, :update]
           RELEASES.each do |release|

spec/controllers/api/accounts_controller_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::AccountsController, type: :controller do
+  let(:current_user) { create(:user, first_name: 'Current') }
+  let(:new_acc) { create(:account, name: 'New Acc') }
+  let(:different_user) { create(:user, first_name: 'Different') }
+  let(:new_auth) { create(:account_auth, account: new_acc, user: different_user)}
+
+  describe '#show' do
+    it 'responds with accounts info for the current user' do
+      sign_in_to_api(current_user)
+
+      get :show
+
+      expect(response).to be_successful
+
+      current_user.accounts.each do |acc|
+        expect(response.body).to have_content acc.name
+
+        acc.users.each do |user|
+          expect(response.body).to have_content user.full_name
+          expect(response.body).to have_content user.email
+        end
+      end
+    end
+
+    it 'does not include other users accounts' do
+      different_user.update(account_auths: [new_auth])
+
+      sign_in_to_api(current_user)
+
+      get :show
+
+      expect(response).to be_successful
+
+      different_user.accounts.each do |acc|
+        expect(response.body).not_to have_content acc.name
+
+        acc.users.each do |user|
+          expect(response.body).not_to have_content user.full_name
+          expect(response.body).not_to have_content user.email
+        end
+      end
+    end
+  end
+end