UserTests.test_edit_is_superuser_no_permission() - Code Metrics - Inspection of "Add users to groups" - ProjetSigma/backend - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#17)

by Camille

created 2016-01-26 10:54 UTC

UserTests.test_edit_is_superuser_no_permission() A

↳ Parent: UserTests

Complexity

Conditions

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	6
CRAP Score	1

Metric	Value
cc	1
dl	0
loc	7
ccs	6
cts	6
cp	1
crap	1
rs	9.4285

import json

from django.core import mail

from rest_framework import status
from rest_framework.test import APITestCase, force_authenticate

from sigma_core.tests.factories import UserFactory, AdminUserFactory
from sigma_core.serializers.user import DetailedUserSerializer as UserSerializer


class UserTests(APITestCase):
    @classmethod
    def setUpTestData(self):
        super(UserTests, self).setUpTestData()

        self.user = UserFactory()
        self.user2 = UserFactory()
        self.admin_user = AdminUserFactory()

        serializer = UserSerializer(self.user)
        self.user_data = serializer.data
        self.user_url = '/user/%d/' % self.user.id

        self.users_list = [self.user, self.user2, self.admin_user]

        self.new_user_data = {'lastname': 'Doe', 'firstname': 'John', 'email': '[email protected]', 'password': 'password'}

#### List requests
    def test_get_users_list_unauthed(self):
        # Client not authenticated
        response = self.client.get('/user/')
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

    # def test_get_users_list_forbidden(self):
    #     # Client authenticated but has no permission
    #     self.client.force_authenticate(user=self.user)
    #     response = self.client.get('/user/')
    #     self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

    def test_get_users_list_ok(self):
        # Client has permissions
        self.client.force_authenticate(user=self.user)
        response = self.client.get('/user/')
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(len(response.data), len(self.users_list))

#### Get requests
    def test_get_user_unauthed(self):
        # Client is not authenticated
        response = self.client.get(self.user_url)
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

    # def test_get_user_forbidden(self):
    #     # Client authenticated but has no permission
    #     self.client.force_authenticate(user=self.user2)
    #     response = self.client.get(self.user_url)
    #     self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

    def test_get_user_ok(self):
        # Client has permissions
        self.client.force_authenticate(user=self.user)
        response = self.client.get(self.user_url)
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        response.data.pop('permissions', None) # Workaround because DRY rest permissions needs a request
        self.assertEqual(response.data, self.user_data)

#### "Get my data" requests
    def test_get_my_data_unauthed(self):
        # Client is not authenticated
        response = self.client.get('/user/me/')
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

    def test_get_my_data_ok(self):
        # Client is authenticated
        self.client.force_authenticate(user=self.user)
        response = self.client.get('/user/me/')
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(response.data['id'], self.user.id)

#### Create requests
    def test_create_user_unauthed(self):
        # Client is not authenticated
        response = self.client.post('/user/', self.new_user_data)
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

    def test_create_user_forbidden(self):
        # Client has no permission
        self.client.force_authenticate(user=self.user)
        response = self.client.post('/user/', self.new_user_data)
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

    def test_create_user_ok(self):
        # Client has permissions
        self.client.force_authenticate(user=self.admin_user)
        response = self.client.post('/user/', self.new_user_data)
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
        self.assertEqual(response.data['lastname'], self.new_user_data['lastname'])

#### Modification requests
    def test_edit_email_wrong_permission(self):
        # Client wants to change another user's email
        self.client.force_authenticate(user=self.user)
        user_data = UserSerializer(self.user2).data
        user_data['email'] = "[email protected]"
        response = self.client.put("/user/%d/" % self.user2.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

    def test_edit_is_superuser_no_permission(self):
        # Client can't set himself as administrator !
        self.client.force_authenticate(user=self.user)
        user_data = UserSerializer(self.user).data
        user_data['is_superuser'] = True
        response = self.client.put("/user/%d/" % self.user.id, user_data)
        self.assertFalse(self.user.is_superuser);

    def test_edit_email_nonvalid_email(self):
        # Client wants to change his email with a non valid value
        self.client.force_authenticate(user=self.user)
        user_data = self.user_data.copy()
        user_data['email'] = "ThisIsNotAnEmail"
        response = self.client.put("/user/%d/" % self.user.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)

    def test_edit_email_ok(self):

        # Client wants to change his email and succeed in
        self.client.force_authenticate(user=self.user)
        user_data = self.user_data.copy()
        user_data['email'] = "[email protected]"
        response = self.client.put("/user/%d/" % self.user.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(response.data['email'], user_data['email'])
        # Guarantee that tests are independant
        self.user.email = self.user_data['email']
        self.user.save()

    def test_edit_profile_wrong_permission(self):
        # Client wants to change another user's phone number
        self.client.force_authenticate(user=self.user)
        user_data = UserSerializer(self.user2).data
        user_data['phone'] = "0123456789"
        response = self.client.put("/user/%d/" % self.user2.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

    def test_edit_profile_ok(self):

        # Client wants to change his phone number
        self.client.force_authenticate(user=self.user)
        user_data = self.user_data.copy()
        user_data['phone'] = "0123456789"
        response = self.client.put("/user/%d/" % self.user.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(response.data['phone'], user_data['phone'])
        # Guarantee that tests are independant
        self.user.phone = self.user_data['phone']
        self.user.save()

    def test_edit_lastname_wrong_permission(self):
        # Client wants to change his lastname
        self.client.force_authenticate(user=self.user)
        user_data = self.user_data.copy()
        user_data['lastname'] = "Daudet"
        response = self.client.put("/user/%d/" % self.user.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)

    def test_edit_lastname_ok(self):

        # Admin wants to change an user's lastname
        self.client.force_authenticate(user=self.admin_user)
        user_data = self.user_data.copy()
        user_data['lastname'] = "Daudet"
        response = self.client.put("/user/%d/" % self.user.id, user_data)
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(response.data['lastname'], user_data['lastname'])
        # Guarantee that tests are independant
        self.user.lastname = self.user_data['lastname']
        self.user.save()


#### "Change password" requests
    def test_change_pwd_wrong_pwd(self):
        # Client gives a wrong old password
        self.user.set_password('old_pwd')
        self.client.force_authenticate(user=self.user)
        response = self.client.put('/user/change_password/', {'old_password': 'wrong', 'password': 'new_pwd'})
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

    def test_change_pwd_no_pwd(self):
        # Client gives no new password
        self.user.set_password('old_pwd')
        self.client.force_authenticate(user=self.user)
        response = self.client.put('/user/change_password/', {'old_password': 'old_pwd', 'password': ''})
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)

    def test_change_pwd_ok(self):
        # Client successfully changes his password
        self.user.set_password('old_pwd')
        self.client.force_authenticate(user=self.user)
        response = self.client.put('/user/change_password/', {'old_password': 'old_pwd', 'password': 'new_strong_pwd'})
        self.assertEqual(response.status_code, status.HTTP_200_OK)

#### "Reset password" requests
    def test_reset_pwd_no_email(self):
        # Client gives no email
        response = self.client.post('/user/reset_password/', {'email': ''})
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)

    def test_reset_pwd_no_user(self):
        # Client's email is not found
        response = self.client.post('/user/reset_password/', {'email': '[email protected]'})
        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)

    def test_reset_pwd_ok(self):
        # Client successfully resets his password
        response = self.client.post('/user/reset_password/', {'email': self.user.email})
        self.assertEqual(response.status_code, status.HTTP_200_OK)
        self.assertEqual(len(mail.outbox), 1)
        from sigma_core.views.user import reset_mail
        self.assertEqual(mail.outbox[0].subject, reset_mail['subject'])

#### Deletion requests


1	1	import json
2
3	1	from django.core import mail
4
5	1	from rest_framework import status
6	1	from rest_framework.test import APITestCase, force_authenticate
7
8	1	from sigma_core.tests.factories import UserFactory, AdminUserFactory
9	1	from sigma_core.serializers.user import DetailedUserSerializer as UserSerializer
10
11
12	1	class UserTests(APITestCase):
13	1	@classmethod
14		def setUpTestData(self):
15	1	super(UserTests, self).setUpTestData()
16
17	1	self.user = UserFactory()
18	1	self.user2 = UserFactory()
19	1	self.admin_user = AdminUserFactory()
20
21	1	serializer = UserSerializer(self.user)
22	1	self.user_data = serializer.data
23	1	self.user_url = '/user/%d/' % self.user.id
24
25	1	self.users_list = [self.user, self.user2, self.admin_user]
26
27	1	self.new_user_data = {'lastname': 'Doe', 'firstname': 'John', 'email': '[email protected]', 'password': 'password'}
28
29		#### List requests
30	1	def test_get_users_list_unauthed(self):
31		# Client not authenticated
32	1	response = self.client.get('/user/')
33	1	self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
34
35		# def test_get_users_list_forbidden(self):
36		# # Client authenticated but has no permission
37		# self.client.force_authenticate(user=self.user)
38		# response = self.client.get('/user/')
39		# self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
40
41	1	def test_get_users_list_ok(self):
42		# Client has permissions
43	1	self.client.force_authenticate(user=self.user)
44	1	response = self.client.get('/user/')
45	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
46	1	self.assertEqual(len(response.data), len(self.users_list))
47
48		#### Get requests
49	1	def test_get_user_unauthed(self):
50		# Client is not authenticated
51	1	response = self.client.get(self.user_url)
52	1	self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
53
54		# def test_get_user_forbidden(self):
55		# # Client authenticated but has no permission
56		# self.client.force_authenticate(user=self.user2)
57		# response = self.client.get(self.user_url)
58		# self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
59
60	1	def test_get_user_ok(self):
61		# Client has permissions
62	1	self.client.force_authenticate(user=self.user)
63	1	response = self.client.get(self.user_url)
64	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
65	1	response.data.pop('permissions', None) # Workaround because DRY rest permissions needs a request
66	1	self.assertEqual(response.data, self.user_data)
67
68		#### "Get my data" requests
69	1	def test_get_my_data_unauthed(self):
70		# Client is not authenticated
71	1	response = self.client.get('/user/me/')
72	1	self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
73
74	1	def test_get_my_data_ok(self):
75		# Client is authenticated
76	1	self.client.force_authenticate(user=self.user)
77	1	response = self.client.get('/user/me/')
78	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
79	1	self.assertEqual(response.data['id'], self.user.id)
80
81		#### Create requests
82	1	def test_create_user_unauthed(self):
83		# Client is not authenticated
84	1	response = self.client.post('/user/', self.new_user_data)
85	1	self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
86
87	1	def test_create_user_forbidden(self):
88		# Client has no permission
89	1	self.client.force_authenticate(user=self.user)
90	1	response = self.client.post('/user/', self.new_user_data)
91	1	self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
92
93	1	def test_create_user_ok(self):
94		# Client has permissions
95	1	self.client.force_authenticate(user=self.admin_user)
96	1	response = self.client.post('/user/', self.new_user_data)
97	1	self.assertEqual(response.status_code, status.HTTP_201_CREATED)
98	1	self.assertEqual(response.data['lastname'], self.new_user_data['lastname'])
99
100		#### Modification requests
101	1	def test_edit_email_wrong_permission(self):
102		# Client wants to change another user's email
103	1	self.client.force_authenticate(user=self.user)
104	1	user_data = UserSerializer(self.user2).data
105	1	user_data['email'] = "[email protected]"
106	1	response = self.client.put("/user/%d/" % self.user2.id, user_data)
107	1	self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
108
109	1	def test_edit_is_superuser_no_permission(self):
110		# Client can't set himself as administrator !
111	1	self.client.force_authenticate(user=self.user)
112	1	user_data = UserSerializer(self.user).data
113	1	user_data['is_superuser'] = True
114	1	response = self.client.put("/user/%d/" % self.user.id, user_data)
115	1	self.assertFalse(self.user.is_superuser);
116
117	1	def test_edit_email_nonvalid_email(self):
118		# Client wants to change his email with a non valid value
119	1	self.client.force_authenticate(user=self.user)
120	1	user_data = self.user_data.copy()
121	1	user_data['email'] = "ThisIsNotAnEmail"
122	1	response = self.client.put("/user/%d/" % self.user.id, user_data)
123	1	self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
124	1
125		def test_edit_email_ok(self):
		0 ignored issues – show Duplication introduced 2015-12-22 18:12 UTC by Report Bug Copy Issue Report This code seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
126	1	# Client wants to change his email and succeed in
127	1	self.client.force_authenticate(user=self.user)
128		user_data = self.user_data.copy()
129	1	user_data['email'] = "[email protected]"
130		response = self.client.put("/user/%d/" % self.user.id, user_data)
131	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
132	1	self.assertEqual(response.data['email'], user_data['email'])
133	1	# Guarantee that tests are independant
134	1	self.user.email = self.user_data['email']
135	1	self.user.save()
136
137	1	def test_edit_profile_wrong_permission(self):
138		# Client wants to change another user's phone number
139	1	self.client.force_authenticate(user=self.user)
140	1	user_data = UserSerializer(self.user2).data
141	1	user_data['phone'] = "0123456789"
142	1	response = self.client.put("/user/%d/" % self.user2.id, user_data)
143	1	self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
144	1
145		def test_edit_profile_ok(self):
		0 ignored issues – show Duplication introduced 2015-12-22 18:12 UTC by Report Bug Copy Issue Report This code seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
146	1	# Client wants to change his phone number
147	1	self.client.force_authenticate(user=self.user)
148		user_data = self.user_data.copy()
149	1	user_data['phone'] = "0123456789"
150		response = self.client.put("/user/%d/" % self.user.id, user_data)
151	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
152	1	self.assertEqual(response.data['phone'], user_data['phone'])
153	1	# Guarantee that tests are independant
154	1	self.user.phone = self.user_data['phone']
155	1	self.user.save()
156
157	1	def test_edit_lastname_wrong_permission(self):
158		# Client wants to change his lastname
159	1	self.client.force_authenticate(user=self.user)
160	1	user_data = self.user_data.copy()
161	1	user_data['lastname'] = "Daudet"
162	1	response = self.client.put("/user/%d/" % self.user.id, user_data)
163	1	self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
164	1
165		def test_edit_lastname_ok(self):
		0 ignored issues – show Duplication introduced 2015-12-22 23:24 UTC by Report Bug Copy Issue Report This code seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
166	1	# Admin wants to change an user's lastname
167	1	self.client.force_authenticate(user=self.admin_user)
168		user_data = self.user_data.copy()
169		user_data['lastname'] = "Daudet"
170		response = self.client.put("/user/%d/" % self.user.id, user_data)
171	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
172		self.assertEqual(response.data['lastname'], user_data['lastname'])
173	1	# Guarantee that tests are independant
174	1	self.user.lastname = self.user_data['lastname']
175	1	self.user.save()
176	1
177
178	1	#### "Change password" requests
179		def test_change_pwd_wrong_pwd(self):
180	1	# Client gives a wrong old password
181	1	self.user.set_password('old_pwd')
182	1	self.client.force_authenticate(user=self.user)
183	1	response = self.client.put('/user/change_password/', {'old_password': 'wrong', 'password': 'new_pwd'})
184		self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
185	1
186		def test_change_pwd_no_pwd(self):
187	1	# Client gives no new password
188	1	self.user.set_password('old_pwd')
189	1	self.client.force_authenticate(user=self.user)
190	1	response = self.client.put('/user/change_password/', {'old_password': 'old_pwd', 'password': ''})
191		self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
192
193	1	def test_change_pwd_ok(self):
194		# Client successfully changes his password
195	1	self.user.set_password('old_pwd')
196	1	self.client.force_authenticate(user=self.user)
197		response = self.client.put('/user/change_password/', {'old_password': 'old_pwd', 'password': 'new_strong_pwd'})
198	1	self.assertEqual(response.status_code, status.HTTP_200_OK)
199
200	1	#### "Reset password" requests
201	1	def test_reset_pwd_no_email(self):
202		# Client gives no email
203	1	response = self.client.post('/user/reset_password/', {'email': ''})
204		self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
205	1
206	1	def test_reset_pwd_no_user(self):
207	1	# Client's email is not found
208	1	response = self.client.post('/user/reset_password/', {'email': '[email protected]'})
209	1	self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
210
211		def test_reset_pwd_ok(self):
212		# Client successfully resets his password
213		response = self.client.post('/user/reset_password/', {'email': self.user.email})
214		self.assertEqual(response.status_code, status.HTTP_200_OK)
215		self.assertEqual(len(mail.outbox), 1)
216		from sigma_core.views.user import reset_mail
217		self.assertEqual(mail.outbox[0].subject, reset_mail['subject'])
218
219		#### Deletion requests
220

ProjetSigma / backend

Pull Request — master (#17)

UserTests.test_edit_is_superuser_no_permission() A

Complexity

Size

Duplication

Code Coverage

Duplication Side-by-Side

Filter issues like