darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-09 04:33:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4261 from alphagov/refactor-permissions-tests

Browse Source 
Refactor permissions tests
This commit is contained in:
Chris Hill-Scott
2022-06-06 16:05:04 +01:00
committed by GitHub
parent 3c25de3f85 30eebf3586
commit 1787f9f42f
1 changed files with 63 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files

216
tests/app/utils/test_user.py
View File

@@ -1,152 +1,85 @@
import pytest import pytest
from flask import request from flask import request
from werkzeug.exceptions import Forbidden, Unauthorized from werkzeug.exceptions import Forbidden
from app.main.views.index import index
from app.utils.user import user_has_permissions from app.utils.user import user_has_permissions
def _test_permissions( @pytest.mark.parametrize('permissions', (
pytest.param([
# Route has a permission which the user doesn’t have
'send_messages'
], marks=pytest.mark.xfail(raises=Forbidden)),
[
# Route has one of the permissions which the user has
'manage_service'
],
[
# Route has more than one of the permissions which the user has
'manage_templates', 'manage_service'
],
[
# Route has one of the permissions which the user has, and one they do not
'manage_service', 'send_messages',
],
[
# Route has no specific permissions required
],
))
def test_permissions(
client_request, client_request,
usr,
permissions, permissions,
will_succeed, api_user_active,
kwargs=None,
): ):
request.view_args.update({'service_id': 'foo'}) request.view_args.update({'service_id': 'foo'})
if usr:
client_request.login(usr)
decorator = user_has_permissions(*permissions, **(kwargs or {})) api_user_active['permissions'] = {'foo': ['manage_users', 'manage_templates', 'manage_settings']}
decorated_index = decorator(index) api_user_active['services'] = ['foo', 'bar']
if will_succeed: client_request.login(api_user_active)
decorated_index()
else: @user_has_permissions(*permissions)
try: def index():
response = decorated_index() pass
if not (
response.location.startswith('/sign-in?next=') and index()
response.status_code == 302
):
pytest.fail("Failed to throw a forbidden or unauthorised exception")
except (Forbidden, Unauthorized):
pass
def test_user_has_permissions_on_endpoint_fail( def test_restrict_admin_usage(
client_request,
mocker,
mock_get_service,
):
user = _user_with_permissions()
mocker.patch('app.user_api_client.get_user', return_value=user)
_test_permissions(
client_request,
user,
['send_messages'],
will_succeed=False)
def test_user_has_permissions_success(
client_request,
mocker,
):
user = _user_with_permissions()
mocker.patch('app.user_api_client.get_user', return_value=user)
_test_permissions(
client_request,
user,
['manage_service'],
will_succeed=True)
def test_user_has_permissions_or(
client_request,
mocker,
):
user = _user_with_permissions()
mocker.patch('app.user_api_client.get_user', return_value=user)
_test_permissions(
client_request,
user,
['send_messages', 'manage_service'],
will_succeed=True)
def test_user_has_permissions_multiple(
client_request,
mocker,
):
user = _user_with_permissions()
mocker.patch('app.user_api_client.get_user', return_value=user)
_test_permissions(
client_request,
user,
['manage_templates', 'manage_service'],
will_succeed=True)
def test_exact_permissions(
client_request,
mocker,
):
user = _user_with_permissions()
mocker.patch('app.user_api_client.get_user', return_value=user)
_test_permissions(
client_request,
user,
['manage_service', 'manage_templates'],
will_succeed=True)
def test_platform_admin_user_can_access_page_that_has_no_permissions(
client_request, client_request,
platform_admin_user, platform_admin_user,
mocker,
): ):
mocker.patch('app.user_api_client.get_user', return_value=platform_admin_user) request.view_args.update({'service_id': 'foo'})
_test_permissions( client_request.login(platform_admin_user)
client_request,
platform_admin_user, @user_has_permissions(restrict_admin_usage=True)
[], def index():
will_succeed=True) pass
with pytest.raises(Forbidden):
index()
def test_platform_admin_user_can_not_access_page( def test_no_user_returns_redirect_to_sign_in(
client_request,
platform_admin_user,
mocker,
mock_get_service,
):
mocker.patch('app.user_api_client.get_user', return_value=platform_admin_user)
_test_permissions(
client_request,
platform_admin_user,
[],
will_succeed=False,
kwargs={'restrict_admin_usage': True})
def test_no_user_returns_401_unauth(
client_request client_request
): ):
client_request.logout() client_request.logout()
_test_permissions(
client_request, @user_has_permissions()
None, def index():
[], pass
will_succeed=False)
response = index()
assert response.status_code == 302
assert response.location.startswith('/sign-in?next=')
def test_user_has_permissions_for_organisation( def test_user_has_permissions_for_organisation(
client_request, client_request,
mocker, api_user_active,
): ):
user = _user_with_permissions() api_user_active['organisations'] = ['org_1', 'org_2']
user['organisations'] = ['org_1', 'org_2'] client_request.login(api_user_active)
mocker.patch('app.user_api_client.get_user', return_value=user)
client_request.login(user)
request.view_args = {'org_id': 'org_2'} request.view_args = {'org_id': 'org_2'}
@@ -160,10 +93,8 @@ def test_user_has_permissions_for_organisation(
def test_platform_admin_can_see_orgs_they_dont_have( def test_platform_admin_can_see_orgs_they_dont_have(
client_request, client_request,
platform_admin_user, platform_admin_user,
mocker,
): ):
platform_admin_user['organisations'] = [] platform_admin_user['organisations'] = []
mocker.patch('app.user_api_client.get_user', return_value=platform_admin_user)
client_request.login(platform_admin_user) client_request.login(platform_admin_user)
request.view_args = {'org_id': 'org_2'} request.view_args = {'org_id': 'org_2'}
@@ -178,9 +109,7 @@ def test_platform_admin_can_see_orgs_they_dont_have(
def test_cant_use_decorator_without_view_args( def test_cant_use_decorator_without_view_args(
client_request, client_request,
platform_admin_user, platform_admin_user,
mocker,
): ):
mocker.patch('app.user_api_client.get_user', return_value=platform_admin_user)
client_request.login(platform_admin_user) client_request.login(platform_admin_user)
request.view_args = {} request.view_args = {}
@@ -195,12 +124,10 @@ def test_cant_use_decorator_without_view_args(
def test_user_doesnt_have_permissions_for_organisation( def test_user_doesnt_have_permissions_for_organisation(
client_request, client_request,
mocker, api_user_active,
): ):
user = _user_with_permissions() api_user_active['organisations'] = ['org_1', 'org_2']
user['organisations'] = ['org_1', 'org_2'] client_request.login(api_user_active)
mocker.patch('app.user_api_client.get_user', return_value=user)
client_request.login(user)
request.view_args = {'org_id': 'org_3'} request.view_args = {'org_id': 'org_3'}
@@ -213,12 +140,12 @@ def test_user_doesnt_have_permissions_for_organisation(
def test_user_with_no_permissions_to_service_goes_to_templates( def test_user_with_no_permissions_to_service_goes_to_templates(
client_request, client_request,
mocker api_user_active,
): ):
user = _user_with_permissions() api_user_active['permissions'] = {'foo': ['manage_users', 'manage_templates', 'manage_settings']}
mocker.patch('app.user_api_client.get_user', return_value=user) api_user_active['services'] = ['foo', 'bar']
client_request.login(user) client_request.login(api_user_active)
request.view_args = {'service_id': 'bar'} request.view_args = {'service_id': 'bar'}
@user_has_permissions() @user_has_permissions()
@@ -226,20 +153,3 @@ def test_user_with_no_permissions_to_service_goes_to_templates(
pass pass
index() index()
def _user_with_permissions():
user_data = {'id': 999,
'name': 'Test User',
'password': 'somepassword',
'email_address': 'test@user.gov.uk',
'mobile_number': '+4412341234',
'state': 'active',
'failed_login_count': 0,
'permissions': {'foo': ['manage_users', 'manage_templates', 'manage_settings']},
'platform_admin': False,
'organisations': ['org_1', 'org_2'],
'services': ['foo', 'bar'],
'current_session_id': None,
}
return user_data