matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

API updates

Browse Source 
- Move all generic API classes definitions to the rest_api.generics
module.
- Update API status code on insufficient access for the apps:
indexes, parsing, documents, metadata, ocr, permission,
user management.
- Update API tests.

Signed-off-by: Roberto Rosario <roberto.rosario@mayan-edms.com>
This commit is contained in:
Roberto Rosario
2019-10-28 00:01:11 -04:00
parent c79a974746
commit deb363ee16
31 changed files with 232 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mayan/apps/user_management/tests/test_api.py
+94 -64
View File
@@ -14,10 +14,14 @@ from ..permissions import (
permission_user_edit, permission_user_view
)
from .mixins import GroupAPITestMixin, GroupTestMixin, UserAPITestMixin
from .mixins import (
GroupAPIViewTestMixin, GroupTestMixin, UserAPIViewTestMixin
)
class GroupAPITestCase(GroupAPITestMixin, GroupTestMixin, BaseAPITestCase):
class GroupAPITestCase(
GroupAPIViewTestMixin, GroupTestMixin, BaseAPITestCase
):
def test_group_create_no_permission(self):
group_count = Group.objects.count()
@@ -41,8 +45,7 @@ class GroupAPITestCase(GroupAPITestMixin, GroupTestMixin, BaseAPITestCase):
group_count = Group.objects.count()
response = self._request_test_group_delete_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.assertEqual(Group.objects.count(), group_count)
@@ -64,7 +67,7 @@ class GroupAPITestCase(GroupAPITestMixin, GroupTestMixin, BaseAPITestCase):
group_name = self.test_group.name
response = self._request_test_group_edit_patch_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.test_group.refresh_from_db()
self.assertEqual(self.test_group.name, group_name)
@@ -90,7 +93,7 @@ class GroupAPITestCase(GroupAPITestMixin, GroupTestMixin, BaseAPITestCase):
group_name = self.test_group.name
response = self._request_test_group_edit_put_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.test_group.refresh_from_db()
self.assertEqual(self.test_group.name, group_name)
@@ -111,7 +114,7 @@ class GroupAPITestCase(GroupAPITestMixin, GroupTestMixin, BaseAPITestCase):
self.assertNotEqual(self.test_group.name, group_name)
class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
class UserAPIViewTestCase(UserAPIViewTestMixin, BaseAPITestCase):
def test_user_create_api_view_no_permission(self):
user_count = get_user_model().objects.count()
@@ -136,7 +139,7 @@ class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
user_count = get_user_model().objects.count()
response = self._request_test_user_delete_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.assertEqual(get_user_model().objects.count(), user_count)
@@ -159,7 +162,7 @@ class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
user_username = self.test_user.username
response = self._request_test_user_edit_patch_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.test_user.refresh_from_db()
self.assertEqual(self.test_user.username, user_username)
@@ -167,7 +170,9 @@ class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
def test_user_edit_patch_api_view_with_access(self):
self._create_test_user()
self.grant_access(obj=self.test_user, permission=permission_user_edit)
self.grant_access(
obj=self.test_user, permission=permission_user_edit
)
user_username = self.test_user.username
response = self._request_test_user_edit_patch_api_view()
@@ -182,7 +187,7 @@ class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
user_username = self.test_user.username
response = self._request_test_user_edit_put_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.test_user.refresh_from_db()
self.assertEqual(self.test_user.username, user_username)
@@ -190,7 +195,9 @@ class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
def test_user_edit_put_api_view_with_access(self):
self._create_test_user()
self.grant_access(obj=self.test_user, permission=permission_user_edit)
self.grant_access(
obj=self.test_user, permission=permission_user_edit
)
user_username = self.test_user.username
response = self._request_test_user_edit_put_api_view()
@@ -199,8 +206,58 @@ class UserAPITestCase(UserAPITestMixin, BaseAPITestCase):
self.test_user.refresh_from_db()
self.assertNotEqual(self.test_user.username, user_username)
def test_user_login_api_view(self):
self._create_test_user()
class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
self.assertTrue(
self.login(
username=self.test_user.username,
password=self.test_user.cleartext_password
)
)
def test_user_password_change_api_view_no_access(self):
self._create_test_user()
response = self._request_test_user_password_change_api_view()
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.assertFalse(
self.login(
username=self.test_user.username,
password=self.test_user.cleartext_password
)
)
def test_user_password_change_api_view_with_access(self):
self._create_test_user()
self.grant_access(
obj=self.test_user, permission=permission_user_edit
)
response = self._request_test_user_password_change_api_view()
self.assertEqual(response.status_code, status.HTTP_200_OK)
self.assertTrue(
self.login(
username=self.test_user.username,
password=self.test_user.cleartext_password
)
)
class UserGroupAPIViewTestMixin(object):
def _create_test_user_with_test_group(self):
self._create_test_group()
self._create_test_user()
self.test_user.groups.add(self.test_group)
class UserGroupAPIViewTestCase(
UserGroupAPIViewTestMixin, GroupTestMixin, UserAPIViewTestMixin,
BaseAPITestCase
):
def test_user_create_with_group_api_view_no_permission(self):
self._create_test_group()
@@ -242,7 +299,9 @@ class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
self._create_test_user()
self._create_test_group()
self.grant_access(obj=self.test_user, permission=permission_user_edit)
self.grant_access(
obj=self.test_user, permission=permission_user_edit
)
user_group_count = self.test_user.groups.count()
@@ -256,7 +315,9 @@ class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
self._create_test_user()
self._create_test_group()
self.grant_access(obj=self.test_group, permission=permission_group_view)
self.grant_access(
obj=self.test_group, permission=permission_group_view
)
user_group_count = self.test_user.groups.count()
@@ -270,8 +331,12 @@ class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
self._create_test_user()
self._create_test_group()
self.grant_access(obj=self.test_user, permission=permission_user_edit)
self.grant_access(obj=self.test_group, permission=permission_group_view)
self.grant_access(
obj=self.test_user, permission=permission_user_edit
)
self.grant_access(
obj=self.test_group, permission=permission_group_view
)
user_group_count = self.test_user.groups.count()
@@ -281,11 +346,6 @@ class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
self.test_user.refresh_from_db()
self.assertEqual(self.test_user.groups.count(), user_group_count + 1)
def _create_test_user_with_test_group(self):
self._create_test_group()
self._create_test_user()
self.test_user.groups.add(self.test_group)
def test_user_group_list_no_access(self):
self._create_test_user_with_test_group()
@@ -295,7 +355,9 @@ class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
def test_user_group_list_with_user_access(self):
self._create_test_user_with_test_group()
self.grant_access(obj=self.test_user, permission=permission_user_view)
self.grant_access(
obj=self.test_user, permission=permission_user_view
)
response = self._request_test_user_group_list_api_view()
self.assertEqual(response.status_code, status.HTTP_200_OK)
self.assertEqual(response.data['count'], 0)
@@ -303,53 +365,21 @@ class UserGroupAPITestCase(GroupTestMixin, UserAPITestMixin, BaseAPITestCase):
def test_user_group_list_with_group_access(self):
self._create_test_user_with_test_group()
self.grant_access(obj=self.test_group, permission=permission_group_view)
self.grant_access(
obj=self.test_group, permission=permission_group_view
)
response = self._request_test_user_group_list_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
def test_user_group_list_with_full_access(self):
self._create_test_user_with_test_group()
self.grant_access(obj=self.test_user, permission=permission_user_view)
self.grant_access(obj=self.test_group, permission=permission_group_view)
self.grant_access(
obj=self.test_user, permission=permission_user_view
)
self.grant_access(
obj=self.test_group, permission=permission_group_view
)
response = self._request_test_user_group_list_api_view()
self.assertEqual(response.status_code, status.HTTP_200_OK)
self.assertEqual(response.data['count'], 1)
def test_user_login_api_view(self):
self._create_test_user()
self.assertTrue(
self.login(
username=self.test_user.username,
password=self.test_user.cleartext_password
)
)
def test_user_create_login_password_change_api_view_no_access(self):
self._create_test_user()
response = self._request_test_user_password_change_api_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertFalse(
self.login(
username=self.test_user.username,
password=self.test_user.cleartext_password
)
)
def test_user_create_login_password_change_api_view_with_access(self):
self._create_test_user()
self.grant_access(obj=self.test_user, permission=permission_user_edit)
response = self._request_test_user_password_change_api_view()
self.assertEqual(response.status_code, status.HTTP_200_OK)
self.assertTrue(
self.login(
username=self.test_user.username,
password=self.test_user.cleartext_password
)
)