Produits Entr'ouvert » Authentic 2

    url(

        r'^users/(?P<user_uuid>[\w+]*)/profiles/(?P<profile_type_slug>[^/]+)/$',

        api_views.user_profiles,

        name='a2-api-user-profiles',

    ),

from .custom_user.models import Profile, ProfileType, User

class ProfileSerializer(serializers.ModelSerializer):

    data = serializers.JSONField(binary=False)

    def create(self, validated_data):

        return Profile(**validated_data)

    def update(self, validated_data):

        # not supported yet

        pass

    class Meta:

        model = Profile

        fields = ('data',)

class UserProfilesAPI(ExceptionHandlerMixin, APIView):

    permission_classes = (permissions.IsAuthenticated,)

    serializer_class = ProfileSerializer

    def initial(self, request, *args, **kwargs):

        super().initial(request, *args, **kwargs)

        User = get_user_model()

        self.profile_type = get_object_or_404(ProfileType, slug=kwargs['profile_type_slug'])

        self.user = get_object_or_404(User, uuid=kwargs['user_uuid'])

    def get(self, request, *args, **kwargs):

        profile = get_object_or_404(Profile, user=self.user, profile_type=self.profile_type)

        if not request.user.has_perm('custom_user.view_profile', obj=profile):

            raise PermissionDenied('User not allowed to view user profiles')

        return Response(self.serializer_class(profile).data)

    def post(self, request, *args, **kwargs):

        if not request.user.has_perm('custom_user.create_profile'):

            raise PermissionDenied('User not allowed to create user profiles')

        serializer = self.serializer_class(data=request.data)

        if not serializer.is_valid():

            response = {'data': [], 'err': 1, 'err_desc': serializer.errors}

            return Response(response, status.HTTP_400_BAD_REQUEST)

        try:

            profile = Profile.objects.get(user=self.user, profile_type=self.profile_type)

        except Profile.DoesNotExist:

            profile = serializer.save()

            profile.profile_type = self.profile_type

            profile.user = self.user

            profile.save()  # fixme double db access

            request.journal.record(

                'user.profile.add',

                user=request.user,

                profile_type=self.profile_type,

                object_user=self.user,

                api=True,

            )

            return Response(

                {'result': 1, 'detail': _('Profile successfully assigned to user')}, status=status.HTTP_200_OK

            )

    def patch(self, request, *args, **kwargs):

        serializer = self.serializer_class(data=request.data)

        if not serializer.is_valid():

            response = {'data': [], 'err': 1, 'err_desc': serializer.errors}

            return Response(response, status.HTTP_400_BAD_REQUEST)

        profile = get_object_or_404(Profile, user=self.user, profile_type=self.profile_type)

        if not request.user.has_perm('custom_user.change_profile', obj=profile):

            raise PermissionDenied('User not allowed to change user profiles')

        profile.data = request.data.get('data', {})

        profile.save()

        request.journal.record(

            'user.profile.update',

            user=request.user,

            profile_type=self.profile_type,

            object_user=self.user,

            api=True,

        )

        return Response({'result': 1, 'detail': _('Profile successfully updated')}, status=status.HTTP_200_OK)

    def put(self, request, *args, **kwargs):

        return self.patch(request, *args, **kwargs)

    def delete(self, request, *args, **kwargs):

        profile = get_object_or_404(Profile, user=self.user, profile_type=self.profile_type)

        if not request.user.has_perm('custom_user.delete_profile', obj=profile):

            raise PermissionDenied('User not allowed to delete user profiles')

        request.journal.record(

            'user.profile.delete',

            user=request.user,

            profile_type=self.profile_type,

            object_user=self.user,

            api=True,

        )

        profile.delete()

        return Response(

            {'result': 1, 'detail': _('Profile successfully removed from user')}, status=status.HTTP_200_OK

        )

user_profiles = UserProfilesAPI.as_view()

from authentic2.custom_user.models import Profile, ProfileType

def test_user_profile_get(app, superuser):

    app.authorization = ('Basic', (superuser.username, superuser.username))

    user = User.objects.create(username='john.doe', email='john.doe@example.com', ou=get_default_ou())

    # wrong type

    resp = app.get('/api/users/%s/profiles/non-existant-slug/' % user.uuid, status=404)

    profile_type = ProfileType.objects.create(slug='one-type', name='One Type')

    # wrong user

    resp = app.get('/api/users/1234/profiles/one-type/', status=404)

    Profile.objects.create(profile_type=profile_type, user=user, data={'foo': 'bar'})

    resp = app.get('/api/users/%s/profiles/one-type/' % user.uuid)

    assert resp.json == {'data': {'foo': 'bar'}}

def test_user_profile_put(app, superuser):

    app.authorization = ('Basic', (superuser.username, superuser.username))

    user = User.objects.create(username='john.doe', email='john.doe@example.com', ou=get_default_ou())

    # wrong type

    resp = app.put('/api/users/%s/profiles/non-existant-slug/' % user.uuid, status=404)

    profile_type = ProfileType.objects.create(slug='one-type', name='One Type')

    # wrong user

    resp = app.put('/api/users/1234/profiles/one-type/', status=404)

    # missing profile

    resp = app.put_json(

        '/api/users/%s/profiles/one-type/' % user.uuid, params={'data': {'foo': 'bar'}}, status=404

    )

    Profile.objects.create(user=user, profile_type=profile_type, data={})

    resp = app.put_json('/api/users/%s/profiles/one-type/' % user.uuid, params={'data': {'foo': 'bar'}})

    assert resp.json == {'result': 1, 'detail': 'Profile successfully updated'}

    assert len(user.subprofiles.all()) == 1

    assert user.subprofiles.last().data == {'foo': 'bar'}

    # attempt at overwriting profile data

    resp = app.put_json('/api/users/%s/profiles/one-type/' % user.uuid, params={'data': {'baz': 'bob'}})

    # profile has been updated, no extra profile has been created

    assert resp.json == {'result': 1, 'detail': 'Profile successfully updated'}

    assert len(user.subprofiles.all()) == 1

    assert user.subprofiles.last().data == {'baz': 'bob'}

def test_user_profile_post(app, superuser):

    app.authorization = ('Basic', (superuser.username, superuser.username))

    user = User.objects.create(username='john.doe', email='john.doe@example.com', ou=get_default_ou())

    # wrong type

    resp = app.get('/api/users/%s/profiles/non-existant-slug/' % user.uuid, status=404)

    ProfileType.objects.create(slug='one-type', name='One Type')

    # wrong user

    resp = app.get('/api/users/1234/profiles/one-type/', status=404)

    assert len(user.subprofiles.all()) == 0

    resp = app.post_json('/api/users/%s/profiles/one-type/' % user.uuid, params={'data': {'baz': 'bob'}})

    assert resp.json == {'result': 1, 'detail': 'Profile successfully assigned to user'}

    assert len(user.subprofiles.all()) == 1

    assert user.subprofiles.last().data == {'baz': 'bob'}

def test_user_profile_delete(app, superuser):

    app.authorization = ('Basic', (superuser.username, superuser.username))

    user = User.objects.create(username='john.doe', email='john.doe@example.com', ou=get_default_ou())

    profile_type = ProfileType.objects.create(slug='one-type', name='One Type')

    Profile.objects.create(user=user, profile_type=profile_type)

    app.delete('/api/users/%s/profiles/non-existant-slug/' % user.uuid, status=404)

    app.delete('/api/users/%s/profiles/one-type/' % user.uuid)

    assert not Profile.objects.filter(user=user, profile_type=profile_type)

    app.delete('/api/users/%s/profiles/one-type/' % user.uuid, status=404)