Completed
Pull Request — master (#22)
by
unknown
01:03
created

test_rank_demote_no_permission2()   A

Complexity

Conditions 1

Size

Total Lines 3

Duplication

Lines 0
Ratio 0 %
Metric Value
cc 1
dl 0
loc 3
rs 10
1
import json
2
3
from django.core import mail
4
5
from rest_framework import status
6
from rest_framework.test import APITestCase
7
8
from sigma_core.models.user import User
9
from sigma_core.models.group import Group
10
from sigma_core.models.group_member import GroupMember
11
from sigma_core.serializers.user import DetailedUserSerializer as UserSerializer
12
from sigma_core.tests.factories import UserFactory, AdminUserFactory, GroupFactory, GroupMemberFactory
13
14
# Test /rank, /kick
15
class GroupMemberPermissionTests(APITestCase):
16
    @classmethod
17
    def setUpTestData(self):
18
        super().setUpTestData()
19
        self.member_rank_url = "/group-member/%d/rank/"
20
        self.member_url = "/group-member/%d/"
21
        self.users = UserFactory.create_batch(6)
22
        self.group = GroupFactory(req_rank_promote=3, req_rank_demote=4, req_rank_kick=5)
23
        self.mships = [
24
            None,
25
            GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=1),
26
            GroupMemberFactory(user=self.users[2], group=self.group, perm_rank=2),
27
            GroupMemberFactory(user=self.users[3], group=self.group, perm_rank=3),
28
            GroupMemberFactory(user=self.users[4], group=self.group, perm_rank=4),
29
            GroupMemberFactory(user=self.users[5], group=self.group, perm_rank=5)
30
        ]
31
32
    def try_rank(self, userId, targetId, newPermRank, expectedHttpResponseCode):
33
        """
34
        This function attempts to set $targetId membership rank to $newPermRank
35
        using $userId permissions
36
        PUT /group-member/{targetId}/rank with perm_rank=newPermRank
37
        """
38
        if userId >= 0:
39
            self.client.force_authenticate(user=self.users[userId])
40
        response = self.client.put(self.member_rank_url % (self.mships[targetId].id), {"perm_rank": newPermRank})
41
        self.assertEqual(response.status_code, expectedHttpResponseCode)
42
43
    def try_delete(self, userId, targetId, expectedHttpResponseCode):
44
        """
45
        This function attempts to remove $targetId membership from Group
46
        using $userId permissions
47
        DELETE /group-member/{targetId}/
48
        """
49
        if userId >= 0:
50
            self.client.force_authenticate(user=self.users[userId])
51
        response = self.client.delete(self.member_url % targetId)
52
        self.assertEqual(response.status_code, expectedHttpResponseCode)
53
54
    # /rank
55
    def test_rank_not_authed(self):
56
        self.try_rank(-1, 1, 4, status.HTTP_401_UNAUTHORIZED)
57
58
    def test_rank_not_group_member(self):
59
        self.try_rank(0, 1, 4, status.HTTP_404_NOT_FOUND)
60
61
    def test_rank_demote_no_permission(self):
62
        self.try_rank(1, 2, 1, status.HTTP_403_FORBIDDEN)
63
64
    def test_rank_demote_no_permission2(self):
65
        self.try_rank(3, 2, 1, status.HTTP_403_FORBIDDEN)
66
        self.assertEqual(GroupMember.objects.get(pk=self.mships[2].id).perm_rank, 2)
67
68
    def test_rank_promote_no_permission(self):
69
        self.try_rank(1, 1, 2, status.HTTP_403_FORBIDDEN)
70
71
    def test_rank_no_rank_change(self):
72
        self.try_rank(5, 1, 1, status.HTTP_400_BAD_REQUEST)
73
74
    def test_rank_not_a_number(self):
75
        self.try_rank(5, 1, "hi!", status.HTTP_400_BAD_REQUEST)
76
77
    def test_rank_set_rank_to_zero(self):
78
        self.try_rank(5, 1, 0, status.HTTP_400_BAD_REQUEST)
79
80
    def test_rank_bad_rank(self):
81
        self.try_rank(5, 1, -1, status.HTTP_400_BAD_REQUEST)
82
        self.try_rank(5, 1, Group.ADMINISTRATOR_RANK + 1, status.HTTP_400_BAD_REQUEST)
83
84
    def test_rank_too_high_rank(self):
85
        self.try_rank(5, 1, 5, status.HTTP_403_FORBIDDEN)
86
87
    def test_rank_promote_ok(self):
88
        self.try_rank(3, 1, 2, status.HTTP_200_OK)
89
        self.assertEqual(GroupMember.objects.get(pk=self.mships[1].id).perm_rank, 2)
90
91
    def test_rank_demote_ok(self):
92
        self.try_rank(5, 3, 2, status.HTTP_200_OK)
93
        self.assertEqual(GroupMember.objects.get(pk=self.mships[3].id).perm_rank, 2)
94
95
    # delete
96
    def test_delete_not_authed(self):
97
        self.try_delete(-1, 1, status.HTTP_401_UNAUTHORIZED)
98
99
    def test_delete_not_group_member(self):
100
        self.try_delete(0, 1, status.HTTP_404_NOT_FOUND)
101
102
    def test_delete_no_permission(self):
103
        self.try_delete(3, 2, status.HTTP_403_FORBIDDEN)
104
105
    def test_delete_user_not_in_group(self):
106
        self.try_delete(4, 0, status.HTTP_404_NOT_FOUND)
107
108
    def test_delete_ok(self):
109
        self.try_delete(5, 1, status.HTTP_204_NO_CONTENT)
110
        self.assertFalse(GroupMember.objects.filter(pk=self.mships[1].id).exists())
111
112
class OpenGroupMemberCreationTests(APITestCase):
113
    @classmethod
114
    def setUpTestData(self):
115
        super(APITestCase, self).setUpTestData()
116
117
        # Routes
118
        self.members_url = "/group-member/"
119
        self.member_url = self.members_url + "%d/"
120
121
        # Group open to anyone
122
        self.group = GroupFactory()
123
        self.group.default_member_rank = 1
124
        self.group.save()
125
126
        # Users already in group
127
        self.users = [UserFactory()]
128
        # Associated GroupMember
129
        self.group_member1 = GroupMember(user=self.users[0], group=self.group, perm_rank=Group.ADMINISTRATOR_RANK)
130
131
        # Testing user
132
        self.user = UserFactory()
133
134
        # Misc
135
        self.new_membership_data = {"group": self.group.id, "user": self.user.id}
136
137
    def test_create_not_authed(self):
138
        self.client.force_authenticate(user=None)
139
        response = self.client.post(self.members_url, self.new_membership_data)
140
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
141
142
    def test_create_not_for_self(self):
143
        # Attempt to add somebody else to a group
144
        self.client.force_authenticate(user=self.users[0])
145
        response = self.client.post(self.members_url, self.new_membership_data)
146
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
147
148
    def test_create_success(self):
149
        # Succesful attempt to join an open group
150
        self.client.force_authenticate(user=self.user)
151
        response = self.client.post(self.members_url, self.new_membership_data)
152
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
153
        self.assertEqual(response.data['perm_rank'], self.group.default_member_rank)
154
155
156
class RequestGroupMemberCreationTests(APITestCase):
157
    @classmethod
158
    def setUpTestData(self):
159
        super(APITestCase, self).setUpTestData()
160
161
        # Routes
162
        self.members_url = "/group-member/"
163
        self.accept_join_requests_url = self.members_url + "%d/accept_join_request/"
164
165
        # Group with membership request
166
        self.group = GroupFactory(default_member_rank=0, req_rank_accept_join_requests=5)
167
168
        # Users already in group
169
        self.users = UserFactory.create_batch(3)
170
        # Associated GroupMember
171
        self.group_member1 = GroupMemberFactory(user=self.users[0], group=self.group, perm_rank=Group.ADMINISTRATOR_RANK) # can validate requests
172
        self.group_member2 = GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=1) # cannot validate requests
173
        self.group_member3 = GroupMemberFactory(user=self.users[2], group=self.group, perm_rank=0) # request to be validated
174
175
        # Testing user
176
        self.user = UserFactory()
177
178
        # Misc
179
        self.new_membership_data = {"group": self.group.id, "user": self.user.id}
180
181
    def test_create_not_authed(self):
182
        self.client.force_authenticate(user=None)
183
        response = self.client.post(self.members_url, self.new_membership_data)
184
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
185
186
    def test_create_success(self):
187
        # Succesful attempt to request group membership
188
        self.client.force_authenticate(user=self.user)
189
        response = self.client.post(self.members_url, self.new_membership_data)
190
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
191
        self.assertEqual(response.data['perm_rank'], self.group.default_member_rank)
192
193
    def test_validate_forbidden(self):
194
        # Attempt to validate a request but not enough permission
195
        self.client.force_authenticate(user=self.users[1])
196
        response = self.client.put(self.accept_join_requests_url % self.group_member3.id)
197
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
198
199
    def test_validate_success(self):
200
        # Succesful attempt to validate a request
201
        self.client.force_authenticate(user=self.users[0])
202
        response = self.client.put(self.accept_join_requests_url % self.group_member3.id)
203
        self.assertEqual(response.status_code, status.HTTP_200_OK)
204
        self.assertEqual(response.data['perm_rank'], 1)
205
206
207
class InvitationGroupMemberCreationTests(APITestCase):
208
    @classmethod
209
    def setUpTestData(self):
210
        super(APITestCase, self).setUpTestData()
211
212
        # Routes
213
        self.members_url = "/group-member/"
214
215
        # Group with invitation only
216
        self.group = GroupFactory(req_rank_invite=5, default_member_rank=-1, visibility=Group.VIS_PRIVATE)
217
218
        # Testing user
219
        self.users = UserFactory.create_batch(2)
220
        self.memberships = [
221
            None,
222
            GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=self.group.req_rank_invite)
223
        ]
224
225
        # Misc
226
        self.new_membership_data = {"group": self.group.id, "user": self.users[0].id}
227
228
    def test_create_not_authed(self):
229
        self.client.force_authenticate(user=None)
230
        response = self.client.post(self.members_url, self.new_membership_data)
231
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
232
233
    def test_create_forbidden(self):
234
        # Can't join this Group
235
        self.client.force_authenticate(user=self.users[0])
236
        response = self.client.post(self.members_url, self.new_membership_data)
237
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
238
239
    def test_create_already_group_member(self):
240
        self.client.force_authenticate(user=self.users[1])
241
        response = self.client.post(self.members_url, self.new_membership_data)
242
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
243
244
    def test_create_self_forbidden(self):
245
        self.client.force_authenticate(user=self.users[1])
246
        response = self.client.post(self.members_url, self.new_membership_data)
247
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
248
249
250
class InvitationGroupMemberInvitationWorkflowTests(APITestCase):
251
    @classmethod
252
    def setUpTestData(self):
253
        super(APITestCase, self).setUpTestData()
254
255
        # Routes
256
        self.members_url = "/group-member/"
257
        self.group_invite_url = "/group/%d/invite/";
258
        self.group_invite_accept_url = "/group/%d/invite_accept/";
259
260
        # Group with invitation only
261
        self.group = GroupFactory(req_rank_invite=5, default_member_rank=-1)
262
263
        # Testing user
264
        self.users = UserFactory.create_batch(2)
265
        self.memberships = [
266
            None,
267
            GroupMemberFactory(user=self.users[1], group=self.group, perm_rank=self.group.req_rank_invite)
268
        ]
269
270
    def test_invite_not_authed(self):
271
        self.client.force_authenticate(user=None)
272
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[0].id} )
273
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
274
275
    def test_invite_forbidden(self):
276
        # Attempt to get group membership
277
        self.client.force_authenticate(user=self.users[0])
278
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[0].id} )
279
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
280
281
    def test_invite_already_group_member(self):
282
        # Attempt to get group membership
283
        self.client.force_authenticate(user=self.users[1])
284
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[1].id} )
285
        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
286
287
    def test_invite_ok(self):
288
        # User0 invites User1 to group
289
        self.client.force_authenticate(user=self.users[1])
290
        response = self.client.put(self.group_invite_url % (self.group.id), {"user": self.users[0].id} )
291
        self.assertEqual(response.status_code, status.HTTP_200_OK)
292
293
    def test_invite_accept(self):
294
        self.test_invite_ok()
295
        self.client.force_authenticate(user=self.users[0])
296
        response = self.client.post(self.members_url, {"user": self.users[0].id, "group": self.group.id})
297
        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
298