Manage own permissions with areas for finds (refs #4060)

1 files changed, 82 insertions, 9 deletions

diff --git a/archaeological_finds/tests.py b/archaeological_finds/tests.py
index 3ae669517..b44bc9979 100644
--- a/archaeological_finds/tests.py
+++ b/archaeological_finds/tests.py
@@ -20,15 +20,16 @@
 import json
 
 from django.conf import settings
-from django.contrib.auth.models import User
+from django.contrib.auth.models import User, Permission
 from django.core.files import File
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.core.urlresolvers import reverse
 from django.test.client import Client
 from ishtar_common.models import ImporterType, IshtarUser, ImporterColumn,\
-    FormaterType, ImportTarget, IshtarSiteProfile
+    FormaterType, ImportTarget, IshtarSiteProfile, ProfileType
 
-from ishtar_common.models import Person, get_current_profile
+from ishtar_common.models import Person, get_current_profile, UserProfile, \
+    Town, Area
 from archaeological_context_records.models import Period, Dating, ContextRecord
 from archaeological_finds import models, views
 from archaeological_warehouse.models import Warehouse, WarehouseType
@@ -36,7 +37,7 @@ from archaeological_warehouse.models import Warehouse, WarehouseType
 from ishtar_common import forms_common
 
 from ishtar_common.tests import WizardTest, WizardTestFormData as FormData, \
-    TestCase
+    TestCase, create_user, create_superuser
 from archaeological_operations.tests import ImportTest, create_operation
 from archaeological_context_records.tests import ContextRecordInit, \
     CONTEXT_RECORD_FIXTURES, CONTEXT_RECORD_TOWNS_FIXTURES
@@ -61,21 +62,23 @@ WAREHOUSE_FIXTURES = FIND_FIXTURES + [
 class FindInit(ContextRecordInit):
     test_context_records = False
 
-    def create_finds(self, user=None, data_base={}, data={}, force=False):
+    def create_finds(self, data_base={}, data={}, user=None, force=False):
         if not getattr(self, 'finds', None):
             self.finds = []
         if not getattr(self, 'base_finds', None):
             self.base_finds = []
 
         default = {'label': "Base find"}
-        if not data_base.get('history_modifier') or not data_base[
+        if user:
+            data_base['history_modifier'] = user
+        elif not data_base.get('history_modifier') or not data_base[
             'history_modifier'].pk:
             user = self.get_default_user()
             user.save()
             data_base['history_modifier'] = user
         if force or not data_base.get('context_record'):
             data_base['context_record'] = self.get_default_context_record(
-                force=force)
+                force=force, user=user)
         default.update(data_base)
         base_find = models.BaseFind.objects.create(**default)
         self.base_finds.append(base_find)
@@ -630,6 +633,76 @@ class FindSearchTest(FindInit, TestCase):
         self.assertTrue(json.loads(response.content)['recordsTotal'] == 1)
 
 
+class FindPermissionTest(FindInit, TestCase):
+    fixtures = FIND_FIXTURES
+    model = models.Find
+
+    def setUp(self):
+        self.username, self.password, self.user = create_superuser()
+        self.alt_username, self.alt_password, self.alt_user = create_user()
+        self.alt_user.user_permissions.add(Permission.objects.get(
+            codename='view_own_find'))
+        self.alt_user.user_permissions.add(Permission.objects.get(
+            codename='change_own_find'))
+        self.alt_username2, self.alt_password2, self.alt_user2 = create_user(
+            username='luke', password='iamyourfather'
+        )
+        profile = UserProfile.objects.create(
+            profile_type=ProfileType.objects.get(txt_idx='collaborator'),
+            person=self.alt_user2.ishtaruser.person,
+            current=True
+        )
+
+        town = Town.objects.create(name='Tatouine', numero_insee='66000')
+        area = Area.objects.create(label='Galaxie', txt_idx='galaxie')
+        area.towns.add(town)
+        profile.areas.add(area)
+
+        self.orgas = self.create_orgas(self.user)
+        self.create_operation(self.user, self.orgas[0])
+        self.create_operation(self.alt_user, self.orgas[0])
+
+        self.create_context_record(
+            user=self.user,
+            data={"label": u"CR 1", "operation": self.operations[0]})
+        self.create_context_record(
+            user=self.alt_user,
+            data={"label": u"CR 2", "operation": self.operations[1]})
+        self.cr_1 = self.context_records[-2]
+        self.cr_2 = self.context_records[-1]
+
+        self.create_finds(data_base={'context_record': self.cr_1},
+                          user=self.user, force=True)
+        self.create_finds(data_base={'context_record': self.cr_2},
+                          user=self.alt_user, force=True)
+
+        self.find_1 = self.finds[-2]
+        self.find_2 = self.finds[-1]
+        self.operations[-1].towns.add(town)
+
+    def test_own_search(self):
+        # no result when no authentification
+        c = Client()
+        response = c.get(reverse('get-find'))
+        self.assertTrue(not json.loads(response.content))
+
+        # possession
+        c = Client()
+        c.login(username=self.alt_username, password=self.alt_password)
+        response = c.get(reverse('get-find'))
+        # only one "own" context record available
+        self.assertTrue(json.loads(response.content))
+        self.assertEqual(json.loads(response.content)['recordsTotal'], 1)
+
+        # area filter
+        c = Client()
+        c.login(username=self.alt_username2, password=self.alt_password2)
+        response = c.get(reverse('get-find'))
+        # only one "own" operation available
+        self.assertTrue(json.loads(response.content))
+        self.assertEqual(json.loads(response.content)['recordsTotal'], 1)
+
+
 class PackagingTest(FindInit, TestCase):
     fixtures = FIND_FIXTURES
     model = models.Find
@@ -638,8 +711,8 @@ class PackagingTest(FindInit, TestCase):
         img = settings.ROOT_PATH + \
             '../ishtar_common/static/media/images/ishtar-bg.jpg'
 
-        self.create_finds({"label": u"Find 1"}, force=True)
-        self.create_finds({"label": u"Find 2"}, force=True)
+        self.create_finds(data_base={"label": u"Find 1"}, force=True)
+        self.create_finds(data_base={"label": u"Find 2"}, force=True)
         self.finds[0].image.save('ishtar-bg.jpg', File(open(img)))
         self.finds[0].save()