Completed
Pull Request — master (#22)
by
unknown
53s
created

GroupMemberPermissionTests.test_rank_demote_ok()   A

Complexity

Conditions 1

Size

Total Lines 3

Duplication

Lines 0
Ratio 0 %
Metric Value
cc 1
dl 0
loc 3
rs 10
1
import json
2
3
from django.core import mail
4
5
from rest_framework import status
6
from rest_framework.test import APITestCase
7
8
from sigma_core.models.user import User
9
from sigma_core.models.group import Group
10
from sigma_core.models.group_member import GroupMember
11
from sigma_core.serializers.user import DetailedUserSerializer as UserSerializer
12
from sigma_core.tests.factories import UserFactory, AdminUserFactory, GroupFactory, GroupMemberFactory
13
14
# Test /rank, /kick
15
class GroupMemberPermissionTests(APITestCase):
16
    @classmethod
17
    def setUpTestData(self):
18
        super().setUpTestData()
19
        self.member_rank_url = "/group-member/%d/rank/"
20
        self.member_url = "/group-member/%d/"
21
        self.users = UserFactory.create_batch(6)
22
        self.group = GroupFactory(req_rank_promote=3, req_rank_demote=4, req_rank_kick=5)
23
        self.mships = [
24
            None,
25
            GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=1),
26
            GroupMemberFactory(user=self.users[2], group=self.group, perm_rank=2),
27
            GroupMemberFactory(user=self.users[3], group=self.group, perm_rank=3),
28
            GroupMemberFactory(user=self.users[4], group=self.group, perm_rank=4),
29
            GroupMemberFactory(user=self.users[5], group=self.group, perm_rank=5)
30
        ]
31
32
    def try_rank(self, userId, targetId, newPermRank, expectedHttpResponseCode):
33
        if userId >= 0:
34
            self.client.force_authenticate(user=self.users[userId])
35
        response = self.client.put(self.member_rank_url % (self.mships[targetId].id), {"perm_rank": newPermRank})
36
        self.assertEqual(response.status_code, expectedHttpResponseCode)
37
38
    def try_delete(self, userId, targetId, expectedHttpResponseCode):
39
        if userId >= 0:
40
            self.client.force_authenticate(user=self.users[userId])
41
        response = self.client.delete(self.member_url % targetId)
42
        self.assertEqual(response.status_code, expectedHttpResponseCode)
43
44
    # /rank
45
    def test_rank_not_authed(self):
46
        self.try_rank(-1, 1, 4, status.HTTP_401_UNAUTHORIZED)
47
48
    def test_rank_not_group_member(self):
49
        self.try_rank(0, 1, 4, status.HTTP_404_NOT_FOUND)
50
51
    def test_rank_demote_no_permission(self):
52
        self.try_rank(1, 2, 1, status.HTTP_403_FORBIDDEN)
53
54
    def test_rank_demote_no_permission2(self):
55
        self.try_rank(3, 2, 1, status.HTTP_403_FORBIDDEN)
56
        self.assertEqual(GroupMember.objects.get(pk=self.mships[2].id).perm_rank, 2)
57
58
    def test_rank_promote_no_permission(self):
59
        self.try_rank(1, 1, 2, status.HTTP_403_FORBIDDEN)
60
61
    def test_rank_no_rank_change(self):
62
        self.try_rank(5, 1, 1, status.HTTP_400_BAD_REQUEST)
63
64
    def test_rank_not_a_number(self):
65
        self.try_rank(5, 1, "hi!", status.HTTP_400_BAD_REQUEST)
66
67
    def test_rank_set_rank_to_zero(self):
68
        self.try_rank(5, 1, 0, status.HTTP_400_BAD_REQUEST)
69
70
    def test_rank_bad_rank(self):
71
        self.try_rank(5, 1, -1, status.HTTP_400_BAD_REQUEST)
72
        self.try_rank(5, 1, Group.ADMINISTRATOR_RANK + 1, status.HTTP_400_BAD_REQUEST)
73
74
    def test_rank_too_high_rank(self):
75
        self.try_rank(5, 1, 5, status.HTTP_403_FORBIDDEN)
76
77
    def test_rank_promote_ok(self):
78
        self.try_rank(3, 1, 2, status.HTTP_200_OK)
79
        self.assertEqual(GroupMember.objects.get(pk=self.mships[1].id).perm_rank, 2)
80
81
    def test_rank_demote_ok(self):
82
        self.try_rank(5, 3, 2, status.HTTP_200_OK)
83
        self.assertEqual(GroupMember.objects.get(pk=self.mships[3].id).perm_rank, 2)
84
85
    # delete
86
    def test_delete_not_authed(self):
87
        self.try_delete(-1, 1, status.HTTP_401_UNAUTHORIZED)
88
89
    def test_delete_not_group_member(self):
90
        self.try_delete(0, 1, status.HTTP_404_NOT_FOUND)
91
92
    def test_delete_no_permission(self):
93
        self.try_delete(3, 2, status.HTTP_403_FORBIDDEN)
94
95
    def test_delete_user_not_in_group(self):
96
        self.try_delete(4, 0, status.HTTP_404_NOT_FOUND)
97
98
    def test_delete_ok(self):
99
        self.try_delete(5, 1, status.HTTP_204_NO_CONTENT)
100
        self.assertFalse(GroupMember.objects.filter(pk=self.mships[1].id).exists())
101
102
class OpenGroupMemberCreationTests(APITestCase):
103
    @classmethod
104
    def setUpTestData(self):
105
        super(APITestCase, self).setUpTestData()
106
107
        # Routes
108
        self.members_url = "/group-member/"
109
        self.member_url = self.members_url + "%d/"
110
111
        # Group open to anyone
112
        self.group = GroupFactory()
113
        self.group.default_member_rank = 1
114
        self.group.save()
115
116
        # Users already in group
117
        self.users = [UserFactory()]
118
        # Associated GroupMember
119
        self.group_member1 = GroupMember(user=self.users[0], group=self.group, perm_rank=Group.ADMINISTRATOR_RANK)
120
121
        # Testing user
122
        self.user = UserFactory()
123
124
        # Misc
125
        self.new_membership_data = {"group": self.group.id, "user": self.user.id}
126
127
    def test_create_not_authed(self):
128
        self.client.force_authenticate(user=None)
129
        response = self.client.post(self.members_url, self.new_membership_data)
130
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
131
132
    def test_create_not_for_self(self):
133
        # Attempt to add somebody else to a group
134
        self.client.force_authenticate(user=self.users[0])
135
        response = self.client.post(self.members_url, self.new_membership_data)
136
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
137
138
    def test_create_success(self):
139
        # Succesful attempt to join an open group
140
        self.client.force_authenticate(user=self.user)
141
        response = self.client.post(self.members_url, self.new_membership_data)
142
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
143
        self.assertEqual(response.data['perm_rank'], self.group.default_member_rank)
144
145
146
class RequestGroupMemberCreationTests(APITestCase):
147
    @classmethod
148
    def setUpTestData(self):
149
        super(APITestCase, self).setUpTestData()
150
151
        # Routes
152
        self.members_url = "/group-member/"
153
        self.accept_join_requests_url = self.members_url + "%d/accept_join_request/"
154
155
        # Group with membership request
156
        self.group = GroupFactory(default_member_rank=0, req_rank_accept_join_requests=5)
157
158
        # Users already in group
159
        self.users = UserFactory.create_batch(3)
160
        # Associated GroupMember
161
        self.group_member1 = GroupMemberFactory(user=self.users[0], group=self.group, perm_rank=Group.ADMINISTRATOR_RANK) # can validate requests
162
        self.group_member2 = GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=1) # cannot validate requests
163
        self.group_member3 = GroupMemberFactory(user=self.users[2], group=self.group, perm_rank=0) # request to be validated
164
165
        # Testing user
166
        self.user = UserFactory()
167
168
        # Misc
169
        self.new_membership_data = {"group": self.group.id, "user": self.user.id}
170
171
    def test_create_not_authed(self):
172
        self.client.force_authenticate(user=None)
173
        response = self.client.post(self.members_url, self.new_membership_data)
174
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
175
176
    def test_create_success(self):
177
        # Succesful attempt to request group membership
178
        self.client.force_authenticate(user=self.user)
179
        response = self.client.post(self.members_url, self.new_membership_data)
180
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
181
        self.assertEqual(response.data['perm_rank'], self.group.default_member_rank)
182
183
    def test_validate_forbidden(self):
184
        # Attempt to validate a request but not enough permission
185
        self.client.force_authenticate(user=self.users[1])
186
        response = self.client.put(self.accept_join_requests_url % self.group_member3.id)
187
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
188
189
    def test_validate_success(self):
190
        # Succesful attempt to validate a request
191
        self.client.force_authenticate(user=self.users[0])
192
        response = self.client.put(self.accept_join_requests_url % self.group_member3.id)
193
        self.assertEqual(response.status_code, status.HTTP_200_OK)
194
        self.assertEqual(response.data['perm_rank'], 1)
195
196
197
class InvitationGroupMemberCreationTests(APITestCase):
198
    @classmethod
199
    def setUpTestData(self):
200
        super(APITestCase, self).setUpTestData()
201
202
        # Routes
203
        self.members_url = "/group-member/"
204
205
        # Group with invitation only
206
        self.group = GroupFactory(req_rank_invite=5, default_member_rank=-1, visibility=Group.VIS_PRIVATE)
207
208
        # Testing user
209
        self.users = UserFactory.create_batch(2)
210
        self.memberships = [
211
            None,
212
            GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=self.group.req_rank_invite)
213
        ]
214
215
        # Misc
216
        self.new_membership_data = {"group": self.group.id, "user": self.users[0].id}
217
218
    def test_create_not_authed(self):
219
        self.client.force_authenticate(user=None)
220
        response = self.client.post(self.members_url, self.new_membership_data)
221
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
222
223
    def test_create_forbidden(self):
224
        # Can't join this Group
225
        self.client.force_authenticate(user=self.users[0])
226
        response = self.client.post(self.members_url, self.new_membership_data)
227
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
228
229
    def test_create_already_group_member(self):
230
        self.client.force_authenticate(user=self.users[1])
231
        response = self.client.post(self.members_url, self.new_membership_data)
232
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
233
234
    def test_create_self_forbidden(self):
235
        self.client.force_authenticate(user=self.users[1])
236
        response = self.client.post(self.members_url, self.new_membership_data)
237
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
238
239
240
class InvitationGroupMemberInvitationWorkflowTests(APITestCase):
241
    @classmethod
242
    def setUpTestData(self):
243
        super(APITestCase, self).setUpTestData()
244
245
        # Routes
246
        self.members_url = "/group-member/"
247
        self.group_invite_url = "/group/%d/invite/";
248
        self.group_invite_accept_url = "/group/%d/invite_accept/";
249
250
        # Group with invitation only
251
        self.group = GroupFactory(req_rank_invite=5, default_member_rank=-1)
252
253
        # Testing user
254
        self.users = UserFactory.create_batch(2)
255
        self.memberships = [
256
            None,
257
            GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=self.group.req_rank_invite)
258
        ]
259
260
    def test_invite_not_authed(self):
261
        self.client.force_authenticate(user=None)
262
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[0].id} )
263
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
264
265
    def test_invite_forbidden(self):
266
        # Attempt to get group membership
267
        self.client.force_authenticate(user=self.users[0])
268
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[0].id} )
269
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
270
271
    def test_invite_already_group_member(self):
272
        # Attempt to get group membership
273
        self.client.force_authenticate(user=self.users[1])
274
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[1].id} )
275
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
276
277
    def test_invite_ok(self):
278
        # User0 invites User1 to group
279
        self.client.force_authenticate(user=self.users[1])
280
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[0].id} )
281
        self.assertEqual(response.status_code, status.HTTP_200_OK)
282
283
    def test_invite_accept(self):
284
        self.test_invite_ok()
285
        self.client.force_authenticate(user=self.users[0])
286
        response = self.client.post(self.members_url, {"user": self.users[0].id, "group": self.group.id})
287
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
288