Skip to content

Commit e363b38

Browse files
mboersmamboersma
committed
Updated permissions tests.
1 parent 85954c0 commit e363b38

3 files changed

Lines changed: 128 additions & 4 deletions

File tree

‎.coveragerc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ omit =
33
*/venv/*
44
*/virtualenv/*
55
api/__init__.py
6+
api/tests/*
67
client/__init__.py
78
client/models.py
89
client/tests/__init__.py

‎api/tests/test_perm.py‎

Lines changed: 126 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ def test_first_signup(self):
2121
self.assertEqual(response.status_code, 201)
2222
self.assertTrue(response.data['is_superuser'])
2323
# register a second user
24-
username, password = 'second', 'password'
24+
username, password = 'seconduser', 'password'
2525
email = 'autotest@deis.io'
2626
submit = {
2727
'username': username,
@@ -50,6 +50,86 @@ def test_list(self):
5050
self.assertEqual(len(response.data['results']), 1)
5151
self.assertEqual(response.data['results'][0]['username'], 'firstuser')
5252
self.assertTrue(response.data['results'][0]['is_superuser'])
53+
# register a non-superuser
54+
submit = {
55+
'username': 'seconduser',
56+
'password': 'password',
57+
'email': 'autotest@deis.io',
58+
}
59+
url = '/api/auth/register'
60+
response = self.client.post(url, json.dumps(submit), content_type='application/json')
61+
self.assertEqual(response.status_code, 201)
62+
self.assertFalse(response.data['is_superuser'])
63+
self.assertTrue(
64+
self.client.login(username='seconduser', password='password'))
65+
response = self.client.get('/api/admin/perms', content_type='application/json')
66+
self.assertEqual(response.status_code, 403)
67+
self.assertIn('You do not have permission', response.data['detail'])
68+
69+
def test_create(self):
70+
submit = {
71+
'username': 'one',
72+
'password': 'password',
73+
'email': 'autotest@deis.io',
74+
}
75+
url = '/api/auth/register'
76+
response = self.client.post(url, json.dumps(submit), content_type='application/json')
77+
self.assertEqual(response.status_code, 201)
78+
self.assertTrue(response.data['is_superuser'])
79+
submit = {
80+
'username': 'two',
81+
'password': 'password',
82+
'email': 'autotest@deis.io',
83+
}
84+
url = '/api/auth/register'
85+
response = self.client.post(url, json.dumps(submit), content_type='application/json')
86+
self.assertEqual(response.status_code, 201)
87+
self.assertFalse(response.data['is_superuser'])
88+
self.assertTrue(
89+
self.client.login(username='one', password='password'))
90+
# grant user 2 the superuser perm
91+
url = '/api/admin/perms'
92+
body = {'username': 'two'}
93+
response = self.client.post(url, json.dumps(body), content_type='application/json')
94+
self.assertEqual(response.status_code, 201)
95+
response = self.client.get(url)
96+
self.assertEqual(response.status_code, 200)
97+
self.assertEqual(len(response.data['results']), 2)
98+
self.assertIn('two', str(response.data['results']))
99+
100+
def test_delete(self):
101+
submit = {
102+
'username': 'uno',
103+
'password': 'password',
104+
'email': 'autotest@deis.io',
105+
}
106+
url = '/api/auth/register'
107+
response = self.client.post(url, json.dumps(submit), content_type='application/json')
108+
self.assertEqual(response.status_code, 201)
109+
self.assertTrue(response.data['is_superuser'])
110+
submit = {
111+
'username': 'dos',
112+
'password': 'password',
113+
'email': 'autotest@deis.io',
114+
}
115+
url = '/api/auth/register'
116+
response = self.client.post(url, json.dumps(submit), content_type='application/json')
117+
self.assertEqual(response.status_code, 201)
118+
self.assertFalse(response.data['is_superuser'])
119+
self.assertTrue(
120+
self.client.login(username='uno', password='password'))
121+
# grant user 2 the superuser perm
122+
url = '/api/admin/perms'
123+
body = {'username': 'dos'}
124+
response = self.client.post(url, json.dumps(body), content_type='application/json')
125+
self.assertEqual(response.status_code, 201)
126+
# revoke the superuser perm
127+
response = self.client.delete(url + '/dos')
128+
self.assertEqual(response.status_code, 204)
129+
response = self.client.get(url)
130+
self.assertEqual(response.status_code, 200)
131+
self.assertEqual(len(response.data['results']), 1)
132+
self.assertNotIn('two', str(response.data['results']))
53133

54134

55135
class TestAppPerms(TestCase):
@@ -88,7 +168,37 @@ def test_create(self):
88168
# TODO: check that user 2 can git push the app
89169

90170
def test_delete(self):
91-
pass
171+
# give user 2 permission to user 1's app
172+
self.assertTrue(
173+
self.client.login(username='autotest-1', password='password'))
174+
response = self.client.get('/api/apps')
175+
app_id = response.data['results'][0]['id']
176+
url = "/api/apps/{}/perms".format(app_id)
177+
body = {'username': 'autotest-2'}
178+
response = self.client.post(url, json.dumps(body), content_type='application/json')
179+
self.assertEqual(response.status_code, 201)
180+
# check that user 2 can see the app
181+
self.assertTrue(
182+
self.client.login(username='autotest-2', password='password'))
183+
response = self.client.get('/api/apps')
184+
self.assertEqual(response.status_code, 200)
185+
self.assertEqual(len(response.data['results']), 1)
186+
# try to delete the permission as user 2
187+
url = "/api/apps/{}/perms/{}".format(app_id, 'autotest-2')
188+
response = self.client.delete(url, content_type='application/json')
189+
self.assertEqual(response.status_code, 403)
190+
self.assertIsNone(response.data)
191+
# delete permission to user 1's app
192+
self.assertTrue(
193+
self.client.login(username='autotest-1', password='password'))
194+
response = self.client.delete(url, content_type='application/json')
195+
self.assertEqual(response.status_code, 204)
196+
self.assertIsNone(response.data)
197+
# check that user 2 can't see any apps
198+
self.assertTrue(
199+
self.client.login(username='autotest-2', password='password'))
200+
response = self.client.get('/api/apps')
201+
self.assertEqual(len(response.data['results']), 0)
92202

93203
def test_list(self):
94204
# check that user 1 sees her lone app
@@ -208,4 +318,17 @@ def test_delete_errors(self):
208318
self.assertEqual(response.status_code, 404)
209319

210320
def test_list(self):
211-
pass
321+
# check that user 1 sees her lone formation
322+
response = self.client.get('/api/formations')
323+
self.assertEqual(response.status_code, 200)
324+
self.assertEqual(len(response.data['results']), 1)
325+
formation_id = response.data['results'][0]['id']
326+
# create a new object permission
327+
url = "/api/formations/{}/perms".format(formation_id)
328+
body = {'username': 'autotest-2'}
329+
response = self.client.post(url, json.dumps(body), content_type='application/json')
330+
self.assertEqual(response.status_code, 201)
331+
# list perms on the app
332+
response = self.client.get(
333+
"/api/formations/{}/perms".format(formation_id), content_type='application/json')
334+
self.assertEqual(response.data, {'users': ['autotest-2']})

‎api/views.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -382,7 +382,7 @@ def create(self, request, **kwargs):
382382
return Response(status=status.HTTP_201_CREATED)
383383

384384
def destroy(self, request, **kwargs):
385-
user = get_object_or_404(User, username=request.DATA['username'])
385+
user = get_object_or_404(User, username=kwargs['username'])
386386
user.is_superuser = user.is_staff = False
387387
user.save(update_fields=['is_superuser', 'is_staff'])
388388
return Response(status=status.HTTP_204_NO_CONTENT)

0 commit comments

Comments
 (0)