darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-26 17:24:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

Stop users from editing/adding templates without the correct permission

Browse Source 
If sending SMS is disabled for a service, it should not be possible to
add or modify SMS templates. If a user tries to do this, they should see
a different page with a link to go back. The same thing should happen
with email templates.
This commit is contained in:
Katie Smith
2017-06-30 10:55:59 +01:00
parent 95f9d26e91
commit 42a8474415
6 changed files with 279 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
tests/app/main/views/test_templates.py
View File

@@ -266,6 +266,64 @@ def test_dont_show_preview_letter_templates_for_bad_filetype(
assert mock_get_service_template.called is False
@pytest.mark.parametrize('type_of_template', ['email', 'sms'])
def test_should_not_allow_creation_of_template_through_form_without_correct_permission(
logged_in_client,
service_one,
mocker,
type_of_template,
):
service_one['permissions'] = []
template_description = {'sms': 'text messages', 'email': 'emails'}
response = logged_in_client.post(url_for(
'.add_template_by_type',
service_id=service_one['id']),
data={'template_type': type_of_template},
follow_redirects=True)
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
assert response.status_code == 200
assert page.select('main p')[0].text.strip() == \
"Sending {} is an invitation‑only feature.".format(template_description[type_of_template])
assert page.select(".page-footer-back-link")[0].text == "Back to add new template"
assert page.select(".page-footer-back-link")[0]['href'] == url_for(
'.add_template_by_type',
service_id=service_one['id'],
template_id='0',
)
@pytest.mark.parametrize('type_of_template', ['email', 'sms'])
def test_should_not_allow_creation_of_a_template_without_correct_permission(
logged_in_client,
service_one,
mocker,
type_of_template,
):
service_one['permissions'] = []
template_description = {'sms': 'text messages', 'email': 'emails'}
response = logged_in_client.get(url_for(
'.add_service_template',
service_id=service_one['id'],
template_type=type_of_template),
follow_redirects=True)
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
assert response.status_code == 200
assert page.select('main p')[0].text.strip() == \
"Sending {} is an invitation‑only feature.".format(template_description[type_of_template])
assert page.select(".page-footer-back-link")[0].text == "Back to templates"
assert page.select(".page-footer-back-link")[0]['href'] == url_for(
'.choose_template',
service_id=service_one['id'],
template_id='0',
)
def test_should_redirect_when_saving_a_template(
logged_in_client,
active_user_with_permissions,
@@ -336,6 +394,32 @@ def test_should_edit_content_when_process_type_is_priority_not_platform_admin(
)
def test_should_not_allow_template_edits_without_correct_permission(
logged_in_client,
mock_get_service_template,
service_one,
fake_uuid,
):
template_id = fake_uuid
service_one['permissions'] = ['email']
response = logged_in_client.get(url_for(
'.edit_service_template',
service_id=service_one['id'],
template_id=template_id),
follow_redirects=True)
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
assert response.status_code == 200
assert page.select('main p')[0].text.strip() == "Sending text messages is an invitation‑only feature."
assert page.select(".page-footer-back-link")[0].text == "Back to the template"
assert page.select(".page-footer-back-link")[0]['href'] == url_for(
'.view_template',
service_id=service_one['id'],
template_id=template_id,
)
def test_should_403_when_edit_template_with_process_type_of_priority_for_non_platform_admin(
client,
active_user_with_permissions,