Python testutils.override_acl函数代码示例

    def test_field_display_json(self):
        """field is included in display json"""
        test_link = reverse('misago:api:user-details', kwargs={'pk': self.user.pk})

        response = self.client.get(test_link)
        self.assertEqual(
            response.json()['groups'],
            [
                {
                    'name': 'IP address',
                    'fields': [
                        {
                            'fieldname': 'join_ip',
                            'name': 'Join IP',
                            'text': '127.0.0.1',
                        },
                        {
                            'fieldname': 'last_ip',
                            'name': 'Last IP',
                            'text': '127.0.0.1',
                        },
                    ],
                },
            ]
        )

        # IP fields tests ACL before displaying
        override_acl(self.user, {
            'can_see_users_ips': 0
        })

        response = self.client.get(test_link)
        self.assertEqual(response.json()['groups'], [])

    def test_other_user(self):
        """api handles scenario when its other user looking at profile"""
        test_user = UserModel.objects.create_user('BobBoberson', '[email protected]', 'bob123456')

        api_link = reverse(
            'misago:api:user-edit-details',
            kwargs={
                'pk': test_user.pk,
            }
        )

        # moderator has permission to edit details
        override_acl(self.user, {
            'can_moderate_profile_details': True,
        })

        response = self.client.get(api_link)
        self.assertEqual(response.status_code, 200)

        # non-moderator has no permission to edit details
        override_acl(self.user, {
            'can_moderate_profile_details': False,
        })

        response = self.client.get(api_link)
        self.assertEqual(response.status_code, 403)

    def override_acl(self, acl=None):
        category_acl = self.user.acl['categories'][self.category.pk]
        category_acl.update({
            'can_see': 1,
            'can_browse': 1,
            'can_see_all_threads': 1,
            'can_see_own_threads': 0,
            'can_hide_threads': 0,
            'can_approve_content': 0,
            'can_edit_posts': 0,
            'can_hide_posts': 0,
            'can_hide_own_posts': 0,
            'can_close_threads': 0,
            'post_edit_time': 0,
            'can_hide_events': 0,
        })

        if acl:
            category_acl.update(acl)

        override_acl(self.user, {
            'categories': {
                self.category.pk: category_acl
            }
        })

    def test_no_permission(self):
        """api respects permission to search users"""
        override_acl(self.user, {'can_search_users': 0})

        response = self.client.get(self.api_link)
        self.assertEqual(response.status_code, 200)
        self.assertNotIn('users', [p['id'] for p in response.json()])

    def test_add_user_to_other_user_thread_moderator(self):
        """moderators can add users to other users threads"""
        ThreadParticipant.objects.set_owner(self.thread, self.other_user)

        self.thread.has_reported_posts = True
        self.thread.save()

        override_acl(self.user, {'can_moderate_private_threads': 1})

        self.patch(
            self.api_link, [
                {
                    'op': 'add',
                    'path': 'participants',
                    'value': self.user.username,
                },
            ]
        )

        # event was set on thread
        event = self.thread.post_set.order_by('id').last()
        self.assertTrue(event.is_event)
        self.assertTrue(event.event_type, 'entered_thread')

        # notification about new private thread wasn't send because we invited ourselves
        self.assertEqual(len(mail.outbox), 0)

    def test_category_moderation_queue_bypass(self):
        """bypass moderation queue due to user's acl"""
        override_acl(self.user, {'can_approve_content': 1})

        self.category.require_replies_approval = True
        self.category.save()

        response = self.client.post(
            self.api_link, data={
                'post': "Lorem ipsum dolor met!",
            }
        )
        self.assertEqual(response.status_code, 200)

        thread = Thread.objects.get(pk=self.thread.pk)
        self.assertFalse(thread.is_unapproved)
        self.assertFalse(thread.has_unapproved_posts)
        self.assertEqual(thread.replies, self.thread.replies + 1)

        post = self.user.post_set.all()[:1][0]
        self.assertFalse(post.is_unapproved)

        category = Category.objects.get(slug='first-category')
        self.assertEqual(category.threads, self.category.threads)
        self.assertEqual(category.posts, self.category.posts + 1)

    def test_no_permission(self):
        """api validates permission to search"""
        override_acl(self.user, {'can_search': 0})

        response = self.client.get(self.test_link)

        self.assertContains(response, "have permission to search site", status_code=403)

    def test_thread_visibility(self):
        """only participated threads are returned by private threads api"""
        visible = testutils.post_thread(category=self.category, poster=self.user)
        reported = testutils.post_thread(category=self.category, poster=self.user)

        # hidden thread
        testutils.post_thread(category=self.category, poster=self.user)

        ThreadParticipant.objects.add_participants(visible, [self.user])

        reported.has_reported_posts = True
        reported.save()

        response = self.client.get(self.api_link)
        self.assertEqual(response.status_code, 200)

        response_json = response.json()
        self.assertEqual(response_json['count'], 1)
        self.assertEqual(response_json['results'][0]['id'], visible.id)

        # threads with reported posts will also show to moderators
        override_acl(self.user, {'can_moderate_private_threads': 1})

        response = self.client.get(self.api_link)
        self.assertEqual(response.status_code, 200)

        response_json = response.json()
        self.assertEqual(response_json['count'], 2)
        self.assertEqual(response_json['results'][0]['id'], reported.id)
        self.assertEqual(response_json['results'][1]['id'], visible.id)

    def test_cant_invite_followers_only(self):
        """api validates that you cant invite followers-only user to thread"""
        user_constant = UserModel.LIMIT_INVITES_TO_FOLLOWED
        self.other_user.limits_private_thread_invites_to = user_constant
        self.other_user.save()

        response = self.client.post(
            self.api_link,
            data={
                'to': [self.other_user.username],
                'title': "Lorem ipsum dolor met",
                'post': "Lorem ipsum dolor.",
            }
        )

        self.assertEqual(response.status_code, 400)
        self.assertEqual(
            response.json(), {
                'to': ["BobBoberson limits invitations to private threads to followed users."],
            }
        )

        # allow us to bypass following check
        override_acl(self.user, {'can_add_everyone_to_private_threads': 1})

        response = self.client.post(
            self.api_link,
            data={
                'to': [self.other_user.username],
                'title': "-----",
                'post': "Lorem ipsum dolor.",
            }
        )

        self.assertEqual(response.status_code, 400)
        self.assertEqual(
            response.json(), {
                'title': ["Thread title should contain alpha-numeric characters."],
            }
        )

        # make user follow us
        override_acl(self.user, {'can_add_everyone_to_private_threads': 0})
        self.other_user.follows.add(self.user)

        response = self.client.post(
            self.api_link,
            data={
                'to': [self.other_user.username],
                'title': "-----",
                'post': "Lorem ipsum dolor.",
            }
        )

        self.assertEqual(response.status_code, 400)
        self.assertEqual(
            response.json(), {
                'title': ["Thread title should contain alpha-numeric characters."],
            }
        )

    def test_participant_leave_thread(self):
        """
        leave thread view makes user leave thread
        """
        User = get_user_model()
        users = (
            User.objects.create_user("Bob", "[email protected]", "pass123"),
            User.objects.create_user("Dam", "[email protected]", "pass123"),
        )

        ThreadParticipant.objects.set_owner(self.thread, users[0])
        ThreadParticipant.objects.add_participant(self.thread, users[1])
        ThreadParticipant.objects.add_participant(self.thread, self.user)

        override_acl(self.user, {"can_use_private_threads": True, "can_moderate_private_threads": True})

        link = reverse(
            "misago:private_thread_leave", kwargs={"thread_id": self.thread.id, "thread_slug": self.thread.slug}
        )

        response = self.client.post(link, **self.ajax_header)
        self.assertEqual(response.status_code, 302)

        self.assertEqual(self.thread.threadparticipant_set.count(), 2)
        owner = self.thread.threadparticipant_set.get(is_owner=True)
        self.assertEqual(owner.user, users[0])

        for participants in self.thread.threadparticipant_set.all():
            self.assertIn(participants.user, users)

        Thread.objects.get(pk=self.thread.pk)
        with self.assertRaises(ThreadParticipant.DoesNotExist):
            self.thread.threadparticipant_set.get(user=self.user)

    def test_edit_participants(self):
        """edit participants view displays thread participants"""
        User = get_user_model()
        users = (
            User.objects.create_user("Bob", "[email protected]", "pass123"),
            User.objects.create_user("Dam", "[email protected]", "pass123"),
        )

        ThreadParticipant.objects.set_owner(self.thread, self.user)
        ThreadParticipant.objects.add_participant(self.thread, users[0])
        ThreadParticipant.objects.add_participant(self.thread, users[1])

        override_acl(self.user, {"can_use_private_threads": True, "can_moderate_private_threads": True})

        link = reverse(
            "misago:private_thread_edit_participants",
            kwargs={"thread_id": self.thread.id, "thread_slug": self.thread.slug},
        )

        response = self.client.get(link, **self.ajax_header)
        self.assertEqual(response.status_code, 200)

        owner_pos = response.content.find(self.user.get_absolute_url())
        for user in users:
            participant_pos = response.content.find(user.get_absolute_url())
            self.assertTrue(owner_pos < participant_pos)

    def test_user_ban(self):
        """user ban details page has no showstoppers"""
        override_acl(self.user, {
            'can_see_ban_details': 0,
        })

        User = get_user_model()
        test_user = User.objects.create_user("Bob", "[email protected]", 'pass.123')
        link_kwargs = {'user_slug': test_user.slug, 'user_id': test_user.pk}

        response = self.client.get(reverse('misago:user_ban',
                                           kwargs=link_kwargs))
        self.assertEqual(response.status_code, 404)

        override_acl(self.user, {
            'can_see_ban_details': 1,
        })

        Ban.objects.create(banned_value=test_user.username,
                           user_message="User m3ss4ge.",
                           staff_message="Staff m3ss4ge.")

        response = self.client.get(reverse('misago:user_ban',
                                           kwargs=link_kwargs))
        self.assertEqual(response.status_code, 200)
        self.assertIn('User m3ss4ge', response.content)
        self.assertIn('Staff m3ss4ge', response.content)

    def test_owner_add_participant(self):
        """owner can add participants"""
        User = get_user_model()
        users = (
            User.objects.create_user("Bob", "[email protected]", "pass123"),
            User.objects.create_user("Dam", "[email protected]", "pass123"),
        )

        ThreadParticipant.objects.set_owner(self.thread, self.user)
        ThreadParticipant.objects.add_participant(self.thread, users[0])

        override_acl(self.user, {"can_use_private_threads": True, "can_moderate_private_threads": True})

        link = reverse(
            "misago:private_thread_add_participants",
            kwargs={"thread_id": self.thread.id, "thread_slug": self.thread.slug},
        )

        response = self.client.post(link, data={"users": "Bob, Dam"}, **self.ajax_header)
        self.assertEqual(response.status_code, 200)

        self.assertEqual(self.thread.threadparticipant_set.count(), 3)
        for participant in self.thread.threadparticipant_set.all():
            if participant.is_owner:
                self.assertEqual(participant.user, self.user)
            else:
                self.assertIn(participant.user, users)

        Thread.objects.get(pk=self.thread.pk)
        self.thread.threadparticipant_set.get(user=self.user)

    def override_other_acl(self, acl):
        other_category_acl = self.user.acl_cache['categories'][self.category.pk].copy()
        other_category_acl.update({
            'can_see': 1,
            'can_browse': 1,
            'can_see_all_threads': 1,
            'can_see_own_threads': 0,
            'can_hide_threads': 0,
            'can_approve_content': 0,
        })
        other_category_acl.update(acl)

        categories_acl = self.user.acl_cache['categories']
        categories_acl[self.category_b.pk] = other_category_acl

        visible_categories = [self.category.pk]
        if other_category_acl['can_see']:
            visible_categories.append(self.category_b.pk)

        override_acl(
            self.user, {
                'visible_categories': visible_categories,
                'categories': categories_acl,
            }
        )

    def test_user_moderation_queue_bypass(self):
        """bypass moderation queue due to user's acl"""
        override_acl(self.user, {'can_approve_content': 1})

        self.override_acl({'require_threads_approval': 1})

        response = self.client.post(
            self.api_link,
            data={
                'category': self.category.pk,
                'title': "Hello, I am test thread!",
                'post': "Lorem ipsum dolor met!",
            }
        )
        self.assertEqual(response.status_code, 200)

        thread = self.user.thread_set.all()[:1][0]
        self.assertFalse(thread.is_unapproved)
        self.assertFalse(thread.has_unapproved_posts)

        post = self.user.post_set.all()[:1][0]
        self.assertFalse(post.is_unapproved)

        category = Category.objects.get(slug='first-category')
        self.assertEqual(category.threads, self.category.threads + 1)
        self.assertEqual(category.posts, self.category.posts + 1)
        self.assertEqual(category.last_thread_id, thread.id)