mayan-edms/mayan/apps/user_management/tests/test_views.py

from __future__ import unicode_literals

from django.contrib.auth import get_user_model
from django.contrib.auth.models import Group

from mayan.apps.common.tests import GenericViewTestCase
from mayan.apps.documents.tests import GenericDocumentViewTestCase
from mayan.apps.metadata.permissions import permission_document_metadata_edit
from mayan.apps.metadata.tests.mixins import MetadataTypeTestMixin

from ..permissions import (
    permission_group_create, permission_group_delete, permission_group_edit,
    permission_group_view, permission_user_create, permission_user_delete,
    permission_user_edit, permission_user_view
)

from .mixins import (
    GroupTestMixin, GroupViewTestMixin, UserTestMixin, UserViewTestMixin
)


class GroupViewsTestCase(GroupTestMixin, GroupViewTestMixin, UserTestMixin, GenericViewTestCase):
    def test_group_create_view_no_permission(self):
        group_count = Group.objects.count()

        response = self._request_test_group_create_view()
        self.assertEqual(response.status_code, 403)

        self.assertEqual(Group.objects.count(), group_count)

    def test_group_create_view_with_permission(self):
        self.grant_permission(permission=permission_group_create)

        group_count = Group.objects.count()

        response = self._request_test_group_create_view()
        self.assertEqual(response.status_code, 302)

        self.assertEqual(Group.objects.count(), group_count + 1)

    def test_group_delete_view_no_permission(self):
        self._create_test_group()

        group_count = Group.objects.count()

        response = self._request_test_group_delete_view()
        self.assertEqual(response.status_code, 404)

        self.assertEqual(Group.objects.count(), group_count)

    def test_group_delete_view_with_access(self):
        self._create_test_group()
        self.grant_access(
            obj=self.test_group, permission=permission_group_delete
        )

        group_count = Group.objects.count()

        response = self._request_test_group_delete_view()
        self.assertEqual(response.status_code, 302)

        self.assertEqual(Group.objects.count(), group_count - 1)

    def test_group_edit_view_no_permission(self):
        self._create_test_group()

        group_name = self.test_group.name

        response = self._request_test_group_edit_view()
        self.assertEqual(response.status_code, 404)

        self.test_group.refresh_from_db()
        self.assertEqual(self.test_group.name, group_name)

    def test_group_edit_view_with_access(self):
        self._create_test_group()
        self.grant_access(
            obj=self.test_group, permission=permission_group_edit
        )

        group_name = self.test_group.name

        response = self._request_test_group_edit_view()
        self.assertEqual(response.status_code, 302)

        self.test_group.refresh_from_db()
        self.assertNotEqual(self.test_group.name, group_name)

    def test_group_list_view_no_permission(self):
        self._create_test_group()

        response = self._request_test_group_list_view()
        self.assertNotContains(
            response=response, text=self.test_group.name, status_code=200
        )

    def test_group_list_view_with_permission(self):
        self._create_test_group()

        self.grant_access(
            obj=self.test_group, permission=permission_group_view
        )
        response = self._request_test_group_list_view()
        self.assertContains(
            response=response, text=self.test_group.name, status_code=200
        )

    def test_group_members_view_no_permission(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)

        response = self._request_test_group_members_view()
        self.assertEqual(response.status_code, 404)

    def test_group_members_view_with_group_access(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)
        self.grant_access(
            obj=self.test_group, permission=permission_group_edit
        )

        response = self._request_test_group_members_view()
        self.assertContains(
            response=response, text=self.test_group.name, status_code=200
        )
        self.assertNotContains(
            response=response, text=self.test_user.username, status_code=200
        )

    def test_group_members_view_with_user_access(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)
        self.grant_access(obj=self.test_user, permission=permission_user_edit)

        response = self._request_test_group_members_view()
        self.assertNotContains(
            response=response, text=self.test_group.name, status_code=404
        )

    def test_group_members_view_with_full_access(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)
        self.grant_access(
            obj=self.test_group, permission=permission_group_edit
        )
        self.grant_access(obj=self.test_user, permission=permission_user_edit)

        response = self._request_test_group_members_view()
        self.assertContains(
            response=response, text=self.test_user.username, status_code=200
        )
        self.assertContains(
            response=response, text=self.test_group.name, status_code=200
        )


class SuperUserViewTestCase(UserTestMixin, UserViewTestMixin, GenericViewTestCase):
    def setUp(self):
        super(SuperUserViewTestCase, self).setUp()
        self._create_test_superuser()

    def test_superuser_delete_view_with_access(self):
        superuser_count = get_user_model().objects.filter(is_superuser=True).count()
        self.grant_access(
            obj=self.test_superuser, permission=permission_user_delete
        )
        response = self._request_test_superuser_delete_view()
        self.assertEqual(response.status_code, 404)
        self.assertEqual(
            get_user_model().objects.filter(is_superuser=True).count(),
            superuser_count
        )

    def test_superuser_detail_view_with_access(self):
        self.grant_access(
            obj=self.test_superuser, permission=permission_user_view
        )
        response = self._request_test_superuser_detail_view()
        self.assertEqual(response.status_code, 404)

    def _request_test_user_detail_view(self):
        return self.get(
            viewname='user_management:user_details', kwargs={
                'pk': self.test_user.pk
            }
        )

    def test_superuser_normal_user_detail_view_with_access(self):
        self.grant_access(
            obj=self.test_superuser, permission=permission_user_view
        )

        self.test_user = self.test_superuser
        response = self._request_test_user_detail_view()
        self.assertEqual(response.status_code, 404)


class UserViewTestCase(UserTestMixin, UserViewTestMixin, GenericViewTestCase):
    def test_user_create_view_no_permission(self):
        user_count = get_user_model().objects.count()

        response = self._request_test_user_create_view()
        self.assertEqual(response.status_code, 403)

        self.assertEqual(get_user_model().objects.count(), user_count)

    def test_user_create_view_with_permission(self):
        self.grant_permission(permission=permission_user_create)

        user_count = get_user_model().objects.count()

        response = self._request_test_user_create_view()
        self.assertEqual(response.status_code, 302)

        self.assertEqual(get_user_model().objects.count(), user_count + 1)

    def test_user_delete_view_no_access(self):
        self._create_test_user()

        user_count = get_user_model().objects.count()

        response = self._request_test_user_delete_view()
        self.assertEqual(response.status_code, 404)

        self.assertEqual(get_user_model().objects.count(), user_count)

    def test_user_delete_view_with_access(self):
        self._create_test_user()

        user_count = get_user_model().objects.count()

        self.grant_access(obj=self.test_user, permission=permission_user_delete)

        response = self._request_test_user_delete_view()
        self.assertEqual(response.status_code, 302)

        self.assertEqual(get_user_model().objects.count(), user_count - 1)

    def test_user_multiple_delete_view_no_access(self):
        self._create_test_user()

        user_count = get_user_model().objects.count()

        response = self._request_test_user_delete_multiple_view()
        self.assertEqual(response.status_code, 404)

        self.assertEqual(get_user_model().objects.count(), user_count)

    def test_user_multiple_delete_view_with_access(self):
        self._create_test_user()

        user_count = get_user_model().objects.count()

        self.grant_access(obj=self.test_user, permission=permission_user_delete)

        response = self._request_test_user_delete_multiple_view()
        self.assertEqual(response.status_code, 302)

        self.assertEqual(get_user_model().objects.count(), user_count - 1)


class UserGroupViewTestCase(GroupTestMixin, UserTestMixin, UserViewTestMixin, GenericViewTestCase):
    def test_user_groups_view_no_permission(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)

        response = self._request_test_user_groups_view()
        self.assertEqual(response.status_code, 404)

    def test_user_groups_view_with_group_access(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)
        self.grant_access(
            obj=self.test_group, permission=permission_group_edit
        )

        response = self._request_test_user_groups_view()
        self.assertNotContains(
            response=response, text=self.test_user.username, status_code=404
        )

    def test_user_groups_view_with_user_access(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)
        self.grant_access(obj=self.test_user, permission=permission_user_edit)

        response = self._request_test_user_groups_view()
        self.assertContains(
            response=response, text=self.test_user.username, status_code=200
        )
        self.assertNotContains(
            response=response, text=self.test_group.name, status_code=200
        )

    def test_user_groups_view_with_full_access(self):
        self._create_test_user()
        self._create_test_group()
        self.test_user.groups.add(self.test_group)
        self.grant_access(
            obj=self.test_group, permission=permission_group_edit
        )
        self.grant_access(obj=self.test_user, permission=permission_user_edit)

        response = self._request_test_user_groups_view()
        self.assertContains(
            response=response, text=self.test_user.username, status_code=200
        )
        self.assertContains(
            response=response, text=self.test_group.name, status_code=200
        )


class MetadataLookupIntegrationTestCase(
    MetadataTypeTestMixin, GenericDocumentViewTestCase
):
    def setUp(self):
        super(MetadataLookupIntegrationTestCase, self).setUp()
        self._create_test_metadata_type()
        self.test_document_type.metadata.create(
            metadata_type=self.test_metadata_type
        )

    def test_user_list_lookup_render(self):
        self.test_metadata_type.lookup = '{{ users }}'
        self.test_metadata_type.save()
        self.test_document.metadata.create(
            metadata_type=self.test_metadata_type
        )
        self.grant_access(
            obj=self.test_document, permission=permission_document_metadata_edit
        )

        response = self.get(
            viewname='metadata:metadata_edit', kwargs={
                'pk': self.test_document.pk
            }
        )
        self.assertContains(
            response=response, text='<option value="{}">{}</option>'.format(
                self._test_case_user.username, self._test_case_user.username
            ), status_code=200
        )

    def test_group_list_lookup_render(self):
        self.test_metadata_type.lookup = '{{ groups }}'
        self.test_metadata_type.save()
        self.test_document.metadata.create(
            metadata_type=self.test_metadata_type
        )
        self.grant_access(
            obj=self.test_document, permission=permission_document_metadata_edit
        )

        response = self.get(
            viewname='metadata:metadata_edit', kwargs={
                'pk': self.test_document.pk
            }
        )

        self.assertContains(
            response=response, text='<option value="{}">{}</option>'.format(
                self._test_case_group.name, self._test_case_group.name
            ), status_code=200
        )