test(api): check model permissions for organizations

!16 #15

app/access/mixin.py

@@ -4,6 +4,8 @@ from django.contrib.auth.models import Group
 from django.core.exceptions import PermissionDenied
 from django.utils.functional import cached_property
 
+
+
 from .models import Team
 
 
@@ -20,15 +22,26 @@ class OrganizationMixin():
 
         try:
 
-            self.get_queryset()
+            if hasattr(self, 'get_queryset'):
+                self.get_queryset()
 
-            self.get_object()
 
-            id = self.get_object().get_organization().id
+            if hasattr(self, 'get_object'):
+                self.get_object()
 
-            if self.get_object().is_global:
+                id = self.get_object().get_organization().id
 
-                id = 0
+                if self.get_object().is_global:
+
+                    id = 0
+
+            if hasattr(self, 'obj'):
+
+                id = self.obj.get_organization().id
+
+                if self.obj.is_global:
+
+                    id = 0
 
         except AttributeError:
 
@@ -117,7 +130,7 @@ class OrganizationMixin():
 
 
     # ToDo: Ensure that the group has access to item
-    def has_permission(self) -> bool:
+    def has_organization_permission(self) -> bool:
 
         has_permission = False
 
@@ -154,7 +167,7 @@ class OrganizationPermission(AccessMixin, OrganizationMixin):
 
         if hasattr(self, 'get_object'):
 
-            if not self.has_permission() and not request.user.is_superuser:
+            if not self.has_organization_permission() and not request.user.is_superuser:
                 raise PermissionDenied('You are not part of this organization')
 
         return super().dispatch(self.request, *args, **kwargs)

app/access/tests/organization/test_organizaiton_permission_api.py

@@ -1,32 +1,526 @@
-# from django.conf import settings
-# from django.shortcuts import reverse
-from django.test import TestCase, Client
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import AnonymousUser, User
+from django.contrib.contenttypes.models import ContentType
+from django.shortcuts import reverse
+from django.test import TestCase
+from rest_framework.test import APIClient as Client
 
 import pytest
 import unittest
 import requests
 
+from access.models import Organization, Team, TeamUsers, Permission
+
+class OrganizationPermissionsAPI(TestCase):
+
+    model = Organization
+
+    model_name = 'organization'
+    app_label = 'access'
+
+    @classmethod
+    def setUpTestData(self):
+        """Setup Test
+
+        1. Create an organization for user and item
+        . create an organization that is different to item
+        2. Create a device
+        3. create teams with each permission: view, add, change, delete
+        4. create a user per team
+        """
+
+        organization = Organization.objects.create(name='test_org')
+
+        self.organization = organization
+
+        different_organization = Organization.objects.create(name='test_different_organization')
 
 
-@pytest.mark.skip(reason="to be written")
-def test_organization_auth_view_api(user):
-    """ Check correct permission for view """
-    pass
+        self.item = organization
+
+        view_permissions = Permission.objects.get(
+                codename = 'view_' + self.model_name,
+                content_type = ContentType.objects.get(
+                    app_label = self.app_label,
+                    model = self.model_name,
+                )
+            )
+
+        view_team = Team.objects.create(
+            team_name = 'view_team',
+            organization = organization,
+        )
+
+        view_team.permissions.set([view_permissions])
 
 
-@pytest.mark.skip(reason="to be written")
-def test_organization_auth_add_api(user):
-    """ Check correct permission for add """
-    pass
+
+        add_permissions = Permission.objects.get(
+                codename = 'add_' + self.model_name,
+                content_type = ContentType.objects.get(
+                    app_label = self.app_label,
+                    model = self.model_name,
+                )
+            )
+
+        add_team = Team.objects.create(
+            team_name = 'add_team',
+            organization = organization,
+        )
+
+        add_team.permissions.set([add_permissions])
 
 
-@pytest.mark.skip(reason="to be written")
-def test_organization_auth_change_api(user):
-    """ Check correct permission for change """
-    pass
+
+        change_permissions = Permission.objects.get(
+                codename = 'change_' + self.model_name,
+                content_type = ContentType.objects.get(
+                    app_label = self.app_label,
+                    model = self.model_name,
+                )
+            )
+
+        change_team = Team.objects.create(
+            team_name = 'change_team',
+            organization = organization,
+        )
+
+        change_team.permissions.set([change_permissions])
 
 
-@pytest.mark.skip(reason="to be written")
-def test_organization_auth_delete_api(user):
-    """ Check correct permission for delete """
-    pass
+
+        delete_permissions = Permission.objects.get(
+                codename = 'delete_' + self.model_name,
+                content_type = ContentType.objects.get(
+                    app_label = self.app_label,
+                    model = self.model_name,
+                )
+            )
+
+        delete_team = Team.objects.create(
+            team_name = 'delete_team',
+            organization = organization,
+        )
+
+        delete_team.permissions.set([delete_permissions])
+
+
+        self.no_permissions_user = User.objects.create_user(username="test_no_permissions", password="password")
+
+
+        self.view_user = User.objects.create_user(username="test_user_view", password="password")
+        teamuser = TeamUsers.objects.create(
+            team = view_team,
+            user = self.view_user
+        )
+
+        self.add_user = User.objects.create_user(username="test_user_add", password="password")
+        teamuser = TeamUsers.objects.create(
+            team = add_team,
+            user = self.add_user
+        )
+
+        self.change_user = User.objects.create_user(username="test_user_change", password="password")
+        teamuser = TeamUsers.objects.create(
+            team = change_team,
+            user = self.change_user
+        )
+
+        self.delete_user = User.objects.create_user(username="test_user_delete", password="password")
+        teamuser = TeamUsers.objects.create(
+            team = delete_team,
+            user = self.delete_user
+        )
+
+
+        self.different_organization_user = User.objects.create_user(username="test_different_organization_user", password="password")
+
+
+        different_organization_team = Team.objects.create(
+            team_name = 'different_organization_team',
+            organization = different_organization,
+        )
+
+        different_organization_team.permissions.set([
+            view_permissions,
+            add_permissions,
+            change_permissions,
+            delete_permissions,
+        ])
+
+        TeamUsers.objects.create(
+            team = different_organization_team,
+            user = self.different_organization_user
+        )
+
+
+
+    def test_organization_auth_view_user_anon_denied_api(self):
+        """ Check correct permission for view
+
+        Attempt to view as anon user
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+        response = client.get(url)
+
+        assert response.status_code == 401
+
+
+    def test_organization_auth_view_no_permission_denied(self):
+        """ Check correct permission for view
+
+        Attempt to view with user missing permission
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.no_permissions_user)
+        response = client.get(url)
+
+        assert response.status_code == 403
+
+
+    def test_organization_auth_view_different_organizaiton_denied(self):
+        """ Check correct permission for view
+
+        Attempt to view with user from different organization
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.different_organization_user)
+        response = client.get(url)
+
+        assert response.status_code == 403
+
+
+    def test_organization_auth_view_has_permission(self):
+        """ Check correct permission for view
+
+        Attempt to view as user with view permission
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.view_user)
+        response = client.get(url)
+
+        assert response.status_code == 200
+
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_add_user_anon_denied(self):
+    #     """ Check correct permission for add 
+
+    #     Attempt to add as anon user
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_orgs')
+
+
+    #     response = client.post(url, data={'device': 'device'})
+
+    #     assert (
+    #         response.status_code == 302
+    #         or
+    #         response.status_code == 403
+    #     )
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_add_no_permission_denied(self):
+    #     """ Check correct permission for add
+
+    #     Attempt to add as user with no permissions
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_orgs')
+
+
+    #     client.force_login(self.no_permissions_user)
+    #     response = client.post(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_add_different_organization_denied(self):
+    #     """ Check correct permission for add
+
+    #     attempt to add as user from different organization
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_orgs')
+
+
+    #     client.force_login(self.different_organization_user)
+    #     response = client.post(url, data={'name': 'device', 'organization': self.organization.id})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_add_permission_view_denied(self):
+    #     """ Check correct permission for add
+
+    #     Attempt to add a user with view permission
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_orgs')
+
+
+    #     client.force_login(self.view_user)
+    #     response = client.post(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_add_has_permission(self):
+    #     """ Check correct permission for add 
+
+    #     Attempt to add as user with no permission
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_orgs')
+
+
+    #     client.force_login(self.add_user)
+    #     response = client.post(url, data={'device': 'device', 'organization': self.organization.id})
+
+    #     assert response.status_code == 200
+
+
+
+    def test_organization_auth_change_user_anon_denied(self):
+        """ Check correct permission for change
+
+        Attempt to change as anon
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        response = client.patch(url, data={'device': 'device'})
+
+        assert response.status_code == 401
+
+
+    def test_organization_auth_change_no_permission_denied(self):
+        """ Ensure permission view cant make change
+
+        Attempt to make change as user without permissions
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.no_permissions_user)
+        response = client.patch(url, data={'device': 'device'})
+
+        assert response.status_code == 403
+
+
+    def test_organization_auth_change_different_organization_denied(self):
+        """ Ensure permission view cant make change
+
+        Attempt to make change as user from different organization
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.different_organization_user)
+        response = client.patch(url, data={'device': 'device'})
+
+        assert response.status_code == 403
+
+
+    def test_organization_auth_change_permission_view_denied(self):
+        """ Ensure permission view cant make change
+
+        Attempt to make change as user with view permission
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.view_user)
+        response = client.patch(url, data={'device': 'device'})
+
+        assert response.status_code == 403
+
+
+    def test_organization_auth_change_permission_add_denied(self):
+        """ Ensure permission view cant make change
+
+        Attempt to make change as user with add permission
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.add_user)
+        response = client.patch(url, data={'device': 'device'})
+
+        assert response.status_code == 403
+
+
+    def test_organization_auth_change_has_permission(self):
+        """ Check correct permission for change
+
+        Make change with user who has change permission
+        """
+
+        client = Client()
+        url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+        client.force_login(self.change_user)
+        response = client.patch(url, data={'device': 'device'})
+
+        assert response.status_code == 200
+
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_user_anon_denied(self):
+    #     """ Check correct permission for delete
+
+    #     Attempt to delete item as anon user
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_orgs', kwargs={'pk': self.item.id})
+
+
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert (
+    #         response.status_code == 302
+    #         or
+    #         response.status_code == 403
+    #     )
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_no_permission_denied(self):
+    #     """ Check correct permission for delete
+
+    #     Attempt to delete as user with no permissons
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+    #     client.force_login(self.no_permissions_user)
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_different_organization_denied(self):
+    #     """ Check correct permission for delete
+
+    #     Attempt to delete as user from different organization
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+    #     client.force_login(self.different_organization_user)
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_permission_view_denied(self):
+    #     """ Check correct permission for delete
+
+    #     Attempt to delete as user with veiw permission only
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+    #     client.force_login(self.view_user)
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_permission_add_denied(self):
+    #     """ Check correct permission for delete
+
+    #     Attempt to delete as user with add permission only
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+    #     client.force_login(self.add_user)
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_permission_change_denied(self):
+    #     """ Check correct permission for delete
+
+    #     Attempt to delete as user with change permission only
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+    #     client.force_login(self.change_user)
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert response.status_code == 403
+
+
+    # @pytest.mark.skip(reason="currently only able to add via admin interface")
+    # def test_organization_auth_delete_has_permission(self):
+    #     """ Check correct permission for delete
+
+    #     Delete item as user with delete permission
+    #     """
+
+    #     client = Client()
+    #     url = reverse('API:_api_organization', kwargs={'pk': self.item.id})
+
+
+    #     client.force_login(self.delete_user)
+    #     response = client.delete(url, data={'device': 'device'})
+
+    #     assert response.status_code == 302 and response.url == reverse('API:_api_orgs')