Projet

Général

Profil

0001-api-fix-access-permissions-13785.patch

Serghei Mihai (congés, retour 15/05), 28 octobre 2016 11:24

Télécharger (4,72 ko)

Voir les différences:

Subject: [PATCH] api: fix access permissions (#13785)

 corbo/settings.py |  7 +++++++
 tests/test_api.py | 35 ++++++++++++++++++++++++++---------
 2 files changed, 33 insertions(+), 9 deletions(-)
corbo/settings.py
154 154

  
155 155
MELLON_IDENTITY_PROVIDERS = []
156 156

  
157
if 'REST_FRAMEWORK' not in globals():
158
    REST_FRAMEWORK = {}
159

  
160
REST_FRAMEWORK['DEFAULT_PERMISSION_CLASSES'] = (
161
    'rest_framework.permissions.IsAuthenticated',
162
)
163

  
157 164
# default site
158 165
SITE_BASE_URL = 'http://localhost'
159 166

  
tests/test_api.py
5 5

  
6 6
from django.core.urlresolvers import reverse
7 7
from django.utils.http import urlencode
8
from django.contrib.auth import get_user_model
8 9

  
9 10
from corbo.models import Category, Announce, Broadcast, Subscription
10 11
from corbo.models import channel_choices
......
34 35
        announces.append(a)
35 36
    return announces
36 37

  
37

  
38
def test_get_newsletters(app, categories, announces):
39
    resp = app.get(reverse('newsletters'), status=200)
38
@pytest.fixture
39
def user():
40
    User = get_user_model()
41
    user = User.objects.create(username='john.doe',
42
            first_name=u'John', last_name=u'Doe', email='john.doe@example.net')
43
    user.set_password('password')
44
    user.save()
45
    return user
46

  
47

  
48
def test_get_newsletters(app, categories, announces, user):
49
    resp = app.get(reverse('newsletters'), status=403)
50
    app.authorization = ('Basic', ('john.doe', 'password'))
51
    resp = app.get(reverse('newsletters'))
40 52
    data = resp.json
41 53
    assert data['data']
42 54
    for category in data['data']:
......
47 59
        assert category['transports'] == [{'id': 'mailto', 'text': 'Email'}]
48 60

  
49 61

  
50
def test_get_subscriptions_by_email(app, categories, announces):
62
def test_get_subscriptions_by_email(app, categories, announces, user):
51 63
    resp = app.get(reverse('subscriptions'), status=403)
52 64
    foo = 'foo@example.com'
65
    resp = app.get(reverse('subscriptions'), {'email': foo}, status=403)
66
    app.authorization = ('Basic', ('john.doe', 'password'))
53 67
    for identifier, name in channel_choices[:1]:
54 68
        for category in categories:
55 69
            uri = '%s:%s' % (identifier, foo)
56 70
            subscription = Subscription.objects.create(identifier=uri,
57 71
                                category=category)
58
            resp = app.get(reverse('subscriptions'), {'email': foo}, status=200)
72
            resp = app.get(reverse('subscriptions'), {'email': foo})
59 73
            assert 'data' in resp.json
60 74
            data = resp.json['data']
61 75
            for d in data:
......
65 79
                    assert t['id'] == identifier
66 80

  
67 81

  
68
def test_update_subscriptions(app, categories, announces):
82
def test_update_subscriptions(app, categories, announces, user):
69 83
    params = urlencode({'email': 'foo@example.com',
70 84
                        'uuid': str(uuid4())})
85
    app.authorization = ('Basic', ('john.doe', 'password'))
71 86
    subscriptions_url = reverse('subscriptions') + '?' + params
72 87
    for category in categories:
73 88
        transports = []
......
79 94
                              'transports': transports}]
80 95
            resp = app.post_json(subscriptions_url , subscriptions)
81 96
            if resp.json['data']:
82
                resp = app.get(subscriptions_url, status=200)
97
                resp = app.get(subscriptions_url)
83 98
                print resp.json['data']
84 99
                for cat in resp.json['data']:
85 100
                    if cat['id'] == category_id:
......
87 102
                        assert sub_transports == transports
88 103

  
89 104

  
90
def test_delete_subscriptions(app, categories, announces):
105
def test_delete_subscriptions(app, categories, announces, user):
91 106
    params = urlencode({'email': 'foo@example.com', 'uuid': str(uuid4())})
92 107
    subscriptions_url = reverse('subscriptions') + '?' + params
108
    resp = app.delete(subscriptions_url, status=403)
109
    app.authorization = ('Basic', ('john.doe', 'password'))
93 110
    resp = app.delete(subscriptions_url)
94 111
    if resp.json['data']:
95
        resp = app.get(subscriptions_url, status=200)
112
        resp = app.get(subscriptions_url)
96 113
        assert resp.json['data'] == []
97
-