From b0d2de703bdd9d09976ac25779de1ed5bb6027b6 Mon Sep 17 00:00:00 2001
From: Carlo Costino <carlo.costino@gsa.gov>
Date: Mon, 11 Dec 2023 16:59:04 -0500
Subject: [PATCH] Updated tests with correct permissions and added test for no
 permissions

h/t @stvnrlly for the suggestions!

Signed-off-by: Carlo Costino <carlo.costino@gsa.gov>
---
 tests/app/main/views/test_manage_users.py | 24 ++++++++++++++++++-----
 tests/conftest.py                         |  5 +++++
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/tests/app/main/views/test_manage_users.py b/tests/app/main/views/test_manage_users.py
index 6474cc13d..abc23b563 100644
--- a/tests/app/main/views/test_manage_users.py
+++ b/tests/app/main/views/test_manage_users.py
@@ -762,9 +762,9 @@ def test_edit_user_permissions_shows_authentication_for_email_auth_service(
 def test_should_show_page_for_inviting_user(
     client_request,
     mock_get_template_folders,
-    platform_admin_user,
+    active_user_with_permissions,
 ):
-    client_request.login(platform_admin_user)
+    client_request.login(active_user_with_permissions)
     page = client_request.get(
         "main.invite_user",
         service_id=SERVICE_ONE_ID,
@@ -774,6 +774,21 @@ def test_should_show_page_for_inviting_user(
     assert not page.find("div", class_="checkboxes-nested")
 
 
+def test_should_not_show_page_for_inviting_user_without_permissions(
+    client_request,
+    mock_get_template_folders,
+    active_user_empty_permissions
+):
+    client_request.login(active_user_empty_permissions)
+    page = client_request.get(
+        "main.invite_user",
+        service_id=SERVICE_ONE_ID,
+        _expected_status=403
+    )
+
+    assert "not allowed to see this page" in page.h1.string.strip()
+
+
 def test_should_show_page_for_inviting_user_with_email_prefilled(
     client_request,
     mocker,
@@ -815,10 +830,9 @@ def test_should_show_page_if_prefilled_user_is_already_a_team_member(
     mock_get_template_folders,
     fake_uuid,
     active_user_with_permissions,
-    active_caseworking_user,
-    platform_admin_user,
+    active_caseworking_user
 ):
-    client_request.login(platform_admin_user)
+    client_request.login(active_user_with_permissions)
     mocker.patch(
         "app.models.user.user_api_client.get_user",
         side_effect=[
diff --git a/tests/conftest.py b/tests/conftest.py
index 0c43770d3..9d55b796b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1067,6 +1067,11 @@ def active_user_with_permissions(fake_uuid):
     return create_active_user_with_permissions()
 
 
+@pytest.fixture()
+def active_user_empty_permissions(fake_uuid):
+    return create_active_user_empty_permissions()
+
+
 @pytest.fixture()
 def active_user_with_permission_to_two_services(fake_uuid):
     permissions = [