From 9958460ab3dea21738c44439e3ab28e8be1c52b1 Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Mon, 20 Jul 2020 09:27:46 +0100
Subject: [PATCH] Update tests for service permission

This commit makes the tests for the `broadcast` service permission more
robust by:
- adding coverage of endpoints that have been created since the test was
  first written
- checking that the endpoint also responds to a `post` request with a
  `403` (or `405` where it is a `get`-only endpoint)
---
 tests/app/main/views/test_broadcast.py | 61 +++++++++++++++++++++-----
 1 file changed, 51 insertions(+), 10 deletions(-)

diff --git a/tests/app/main/views/test_broadcast.py b/tests/app/main/views/test_broadcast.py
index 0d2395003..a99b6193d 100644
--- a/tests/app/main/views/test_broadcast.py
+++ b/tests/app/main/views/test_broadcast.py
@@ -10,25 +10,66 @@ from tests.conftest import SERVICE_ONE_ID, normalize_spaces
 sample_uuid = sample_uuid()
 
 
-@pytest.mark.parametrize('endpoint, extra_args', (
-    ('.broadcast_dashboard', {}),
-    ('.broadcast_dashboard_updates', {}),
-    ('.broadcast', {'template_id': sample_uuid}),
-    ('.preview_broadcast_areas', {'broadcast_message_id': sample_uuid}),
-    ('.choose_broadcast_library', {'broadcast_message_id': sample_uuid}),
-    ('.choose_broadcast_area', {'broadcast_message_id': sample_uuid, 'library_slug': 'countries'}),
-    ('.remove_broadcast_area', {'broadcast_message_id': sample_uuid, 'area_slug': 'england'}),
-    ('.preview_broadcast_message', {'broadcast_message_id': sample_uuid}),
+@pytest.mark.parametrize('endpoint, extra_args, expected_get_status, expected_post_status', (
+    (
+        '.broadcast_dashboard', {},
+        403, 405,
+    ),
+    (
+        '.broadcast_dashboard_updates', {},
+        403, 405,
+    ),
+    (
+        '.broadcast',
+        {'template_id': sample_uuid},
+        403, 405,
+    ),
+    (
+        '.preview_broadcast_areas', {'broadcast_message_id': sample_uuid},
+        403, 405,
+    ),
+    (
+        '.choose_broadcast_library', {'broadcast_message_id': sample_uuid},
+        403, 405,
+    ),
+    (
+        '.choose_broadcast_area', {'broadcast_message_id': sample_uuid, 'library_slug': 'countries'},
+        403, 403,
+    ),
+    (
+        '.remove_broadcast_area', {'broadcast_message_id': sample_uuid, 'area_slug': 'england'},
+        403, 405,
+    ),
+    (
+        '.preview_broadcast_message', {'broadcast_message_id': sample_uuid},
+        403, 403,
+    ),
+    (
+        '.view_broadcast_message', {'broadcast_message_id': sample_uuid},
+        403, 403,
+    ),
+    (
+        '.cancel_broadcast_message', {'broadcast_message_id': sample_uuid},
+        403, 403,
+    ),
 ))
 def test_broadcast_pages_403_without_permission(
     client_request,
     endpoint,
     extra_args,
+    expected_get_status,
+    expected_post_status,
 ):
     client_request.get(
         endpoint,
         service_id=SERVICE_ONE_ID,
-        _expected_status=403,
+        _expected_status=expected_get_status,
+        **extra_args
+    )
+    client_request.post(
+        endpoint,
+        service_id=SERVICE_ONE_ID,
+        _expected_status=expected_post_status,
         **extra_args
     )