matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add event tests to document comments app

Browse Source 
Switch view to return an HTTP 404 on lack of authorization
instead of an HTTP 403.

Signed-off-by: Roberto Rosario <Roberto.Rosario@mayan-edms.com>
This commit is contained in:
Roberto Rosario
2018-12-30 16:05:37 -04:00
parent 45ceab024d
commit ffeb580c15
8 changed files with 161 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
mayan/apps/document_comments/tests/mixins.py Normal file
View File

@@ -0,0 +1,31 @@
from __future__ import unicode_literals
from ..models import Comment
from .literals import TEST_COMMENT_TEXT
class CommentsTestMixin(object):
def _create_comment(self, user=None):
self.test_comment = self.document.comments.create(
comment=TEST_COMMENT_TEXT,
user=user or self.user or self.admin_user
)
def _request_document_comment_add_view(self):
response = self.post(
viewname='comments:comment_add',
kwargs={'document_pk': self.document.pk},
data={'comment': TEST_COMMENT_TEXT}
)
self.test_comment = Comment.objects.filter(
document=self.document.pk
).first()
return response
def _request_document_comment_delete_view(self):
return self.post(
viewname='comments:comment_delete',
kwargs={'comment_pk': self.test_comment.pk},
)

68
mayan/apps/document_comments/tests/test_api.py
View File

@@ -12,102 +12,98 @@ from ..permissions import (
)
from .literals import TEST_COMMENT_TEXT
from .mixins import CommentsTestMixin
class CommentAPITestCase(DocumentTestMixin, BaseAPITestCase):
class CommentAPITestCase(CommentsTestMixin, DocumentTestMixin, BaseAPITestCase):
def setUp(self):
super(CommentAPITestCase, self).setUp()
self.login_user()
def _create_comment(self):
return self.document.comments.create(
comment=TEST_COMMENT_TEXT, user=self.admin_user
)
def _request_comment_create_view(self):
def _request_api_comment_create_view(self):
return self.post(
viewname='rest_api:comment-list', kwargs={'document_pk': self.document.pk},
data={
viewname='rest_api:comment-list',
kwargs={'document_pk': self.document.pk}, data={
'comment': TEST_COMMENT_TEXT
}
)
def test_comment_create_view_no_access(self):
response = self._request_comment_create_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
response = self._request_api_comment_create_view()
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.assertEqual(Comment.objects.count(), 0)
def test_comment_create_view_with_access(self):
self.grant_access(permission=permission_comment_create, obj=self.document)
response = self._request_comment_create_view()
response = self._request_api_comment_create_view()
self.assertEqual(response.status_code, status.HTTP_201_CREATED)
comment = Comment.objects.first()
self.assertEqual(Comment.objects.count(), 1)
self.assertEqual(response.data['id'], comment.pk)
def _request_comment_delete_view(self):
def _request_api_comment_delete_view(self):
return self.delete(
viewname='rest_api:comment-detail', kwargs={
'document_pk': self.document.pk,
'comment_pk': self.comment.pk
'comment_pk': self.test_comment.pk
}
)
def test_comment_delete_view_no_access(self):
self.comment = self._create_comment()
response = self._request_comment_delete_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self.assertTrue(self.comment in Comment.objects.all())
self._create_comment()
response = self._request_api_comment_delete_view()
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
self.assertTrue(self.test_comment in Comment.objects.all())
def test_comment_delete_view_with_access(self):
self.comment = self._create_comment()
self._create_comment()
self.grant_access(
permission=permission_comment_delete, obj=self.document
)
response = self._request_comment_delete_view()
response = self._request_api_comment_delete_view()
self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
self.assertFalse(self.comment in Comment.objects.all())
self.assertFalse(self.test_comment in Comment.objects.all())
def _request_comment_view(self):
def _request_api_comment_detail_view(self):
return self.get(
viewname='rest_api:comment-detail', kwargs={
'document_pk': self.document.pk,
'comment_pk': self.comment.pk
'comment_pk': self.test_comment.pk
}
)
def test_comment_detail_view_no_access(self):
self.comment = self._create_comment()
response = self._request_comment_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self._create_comment()
response = self._request_api_comment_detail_view()
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
def test_comment_detail_view_with_access(self):
self.comment = self._create_comment()
self._create_comment()
self.grant_access(
permission=permission_comment_view, obj=self.document
)
response = self._request_comment_view()
response = self._request_api_comment_detail_view()
self.assertEqual(response.status_code, status.HTTP_200_OK)
self.assertEqual(response.data['comment'], self.comment.comment)
self.assertEqual(response.data['comment'], self.test_comment.comment)
def _request_comment_list_view(self):
def _request_api_comment_list_view(self):
return self.get(
viewname='rest_api:comment-list',
kwargs={'document_pk': self.document.pk}
)
def test_comment_list_view_no_access(self):
self.comment = self._create_comment()
response = self._request_comment_list_view()
self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
self._create_comment()
response = self._request_api_comment_list_view()
self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
def test_comment_list_view_with_access(self):
self.comment = self._create_comment()
self._create_comment()
self.grant_access(
permission=permission_comment_view, obj=self.document
)
response = self._request_comment_list_view()
response = self._request_api_comment_list_view()
self.assertEqual(response.status_code, status.HTTP_200_OK)
self.assertEqual(
response.data['results'][0]['comment'], self.comment.comment
response.data['results'][0]['comment'], self.test_comment.comment
)

65
mayan/apps/document_comments/tests/test_events.py Normal file
View File

@@ -0,0 +1,65 @@
from __future__ import unicode_literals
from actstream.models import Action
from mayan.apps.documents.tests import GenericDocumentViewTestCase
from ..events import (
event_document_comment_created, event_document_comment_deleted
)
from ..permissions import permission_comment_create, permission_comment_delete
from .mixins import CommentsTestMixin
class CommentEventsTestCase(CommentsTestMixin, GenericDocumentViewTestCase):
def setUp(self):
super(CommentEventsTestCase, self).setUp()
self.login_user()
def test_comment_created_event_no_permissions(self):
Action.objects.all().delete()
response = self._request_document_comment_add_view()
self.assertEqual(response.status_code, 404)
self.assertEqual(Action.objects.count(), 0)
def test_comment_created_event_with_permissions(self):
Action.objects.all().delete()
self.grant_access(
obj=self.document, permission=permission_comment_create
)
response = self._request_document_comment_add_view()
self.assertEqual(response.status_code, 302)
event = Action.objects.first()
self.assertEqual(event.verb, event_document_comment_created.id)
self.assertEqual(event.action_object, self.document)
self.assertEqual(event.target, self.test_comment)
self.assertEqual(event.actor, self.user)
def test_comment_deleted_event_no_permissions(self):
self._create_comment()
Action.objects.all().delete()
response = self._request_document_comment_delete_view()
self.assertEqual(response.status_code, 404)
self.assertEqual(Action.objects.count(), 0)
def test_comment_deleted_event_with_access(self):
self._create_comment()
Action.objects.all().delete()
self.grant_access(
obj=self.document, permission=permission_comment_delete
)
response = self._request_document_comment_delete_view()
self.assertEqual(response.status_code, 302)
event = Action.objects.first()
self.assertEqual(event.verb, event_document_comment_deleted.id)
self.assertEqual(event.target, self.document)
self.assertEqual(event.actor, self.user)

16
mayan/apps/document_comments/tests/test_views.py
View File

@@ -8,20 +8,14 @@ from ..permissions import (
)
from .literals import TEST_COMMENT_TEXT
from .mixins import CommentsTestMixin
class CommentsViewsTestCase(GenericDocumentViewTestCase):
class CommentsViewsTestCase(CommentsTestMixin, GenericDocumentViewTestCase):
def setUp(self):
super(CommentsViewsTestCase, self).setUp()
self.login_user()
def _request_document_comment_add_view(self):
return self.post(
viewname='comments:comment_add',
kwargs={'document_pk': self.document.pk},
data={'comment': TEST_COMMENT_TEXT}
)
def test_document_comment_add_view_no_permission(self):
response = self._request_document_comment_add_view()
self.assertEqual(response.status_code, 404)
@@ -40,12 +34,6 @@ class CommentsViewsTestCase(GenericDocumentViewTestCase):
user=self.user, comment=TEST_COMMENT_TEXT
)
def _request_document_comment_delete_view(self):
return self.post(
viewname='comments:comment_delete',
kwargs={'comment_pk': self.test_comment.pk},
)
def test_document_comment_delete_view_no_permission(self):
self._create_test_comment()