Manage own permissions with areas for operations

1 files changed, 101 insertions, 4 deletions

diff --git a/archaeological_operations/tests.py b/archaeological_operations/tests.py
index 7cfa83435..299ed49f8 100644
--- a/archaeological_operations/tests.py
+++ b/archaeological_operations/tests.py
@@ -41,7 +41,8 @@ from ishtar_common.models import OrganizationType, Organization, ItemKey, \
     ImporterType, IshtarUser, TargetKey, ImporterModel, IshtarSiteProfile, \
     Town, ImporterColumn, Person, Author, SourceType, AuthorType, \
     DocumentTemplate, PersonType, TargetKeyGroup, JsonDataField, \
-    JsonDataSection, ImportTarget, FormaterType, CustomForm, ExcludedField
+    JsonDataSection, ImportTarget, FormaterType, CustomForm, ExcludedField, \
+    UserProfile, ProfileType, Area
 from archaeological_files.models import File, FileType
 from archaeological_context_records.models import Unit, ContextRecord
 
@@ -1372,6 +1373,20 @@ class OperationSearchTest(TestCase, OperationInitTest):
         self.alt_username, self.alt_password, self.alt_user = create_user()
         self.alt_user.user_permissions.add(Permission.objects.get(
             codename='view_own_operation'))
+        self.alt_user.user_permissions.add(Permission.objects.get(
+            codename='change_own_operation'))
+        self.alt_username2, self.alt_password2, self.alt_user2 = create_user(
+            username='luke', password='iamyourfather'
+        )
+        profile = UserProfile.objects.create(
+            profile_type=ProfileType.objects.get(txt_idx='collaborator'),
+            person=self.alt_user2.ishtaruser.person
+        )
+        town = Town.objects.create(name='Tatouine', numero_insee='66000')
+        area = Area.objects.create(label='Galaxie', txt_idx='galaxie')
+        area.towns.add(town)
+        profile.areas.add(area)
+
         self.orgas = self.create_orgas(self.user)
         self.operations = self.create_operation(self.user, self.orgas[0])
         self.operations += self.create_operation(self.alt_user, self.orgas[0])
@@ -1407,7 +1422,6 @@ class OperationSearchTest(TestCase, OperationInitTest):
         result = json.loads(response.content)
         self.assertEqual(result['recordsTotal'], 1)
 
-
     def create_relations(self):
         rel1 = models.RelationType.objects.create(
             symmetrical=True, label='Include', txt_idx='include')
@@ -1504,19 +1518,102 @@ class OperationSearchTest(TestCase, OperationInitTest):
         self.assertEqual(response.status_code, 200)
         self.assertEqual(json.loads(response.content)['recordsTotal'], 1)
 
-    def testOwnSearch(self):
+
+class OperationPermissionTest(TestCase, OperationInitTest):
+    fixtures = FILE_FIXTURES
+
+    def setUp(self):
+        IshtarSiteProfile.objects.get_or_create(
+            slug='default', active=True)
+        self.username, self.password, self.user = create_superuser()
+        self.alt_username, self.alt_password, self.alt_user = create_user()
+        self.alt_user.user_permissions.add(Permission.objects.get(
+            codename='view_own_operation'))
+        self.alt_user.user_permissions.add(Permission.objects.get(
+            codename='change_own_operation'))
+        self.alt_username2, self.alt_password2, self.alt_user2 = create_user(
+            username='luke', password='iamyourfather'
+        )
+        profile = UserProfile.objects.create(
+            profile_type=ProfileType.objects.get(txt_idx='collaborator'),
+            person=self.alt_user2.ishtaruser.person,
+            current=True
+        )
+        town = Town.objects.create(name='Tatouine', numero_insee='66000')
+        area = Area.objects.create(label='Galaxie', txt_idx='galaxie')
+        area.towns.add(town)
+        profile.areas.add(area)
+
+        self.orgas = self.create_orgas(self.user)
+        self.operations = self.create_operation(self.user, self.orgas[0])
+        self.operations += self.create_operation(self.alt_user, self.orgas[0])
+        self.operations[1].towns.add(town)
+        self.item = self.operations[0]
+
+    def test_own_search(self):
+        # no result when no authentification
         c = Client()
         response = c.get(reverse('get-operation'), {'year': '2010'})
-        # no result when no authentification
         self.assertTrue(not json.loads(response.content))
+
+        # possession
+        c = Client()
         c.login(username=self.alt_username, password=self.alt_password)
         response = c.get(reverse('get-operation'), {'year': '2010'})
         # only one "own" operation available
+        self.assertTrue(json.loads(response.content))
+        self.assertTrue(json.loads(response.content)['recordsTotal'] == 1)
+        response = c.get(reverse('get-operation'),
+                         {'operator': self.orgas[0].pk})
+        self.assertTrue(json.loads(response.content)['recordsTotal'] == 1)
+
+        # area filter
+        c = Client()
+        c.login(username=self.alt_username2, password=self.alt_password2)
+        response = c.get(reverse('get-operation'), {'year': '2010'})
+        # only one "own" operation available
+        self.assertTrue(json.loads(response.content))
         self.assertTrue(json.loads(response.content)['recordsTotal'] == 1)
         response = c.get(reverse('get-operation'),
                          {'operator': self.orgas[0].pk})
         self.assertTrue(json.loads(response.content)['recordsTotal'] == 1)
 
+    def test_own_modify(self):
+        operation_pk1 = self.operations[0].pk
+        operation_pk2 = self.operations[1].pk
+
+        # no result when no authentification
+        c = Client()
+        response = c.get(reverse('operation_modify', args=[operation_pk2]))
+        self.assertRedirects(response, "/")
+
+        modif_url = '/operation_modification/general-operation_modification'
+
+        # possession
+        c = Client()
+        c.login(username=self.alt_username, password=self.alt_password)
+        response = c.get(reverse('operation_modify', args=[operation_pk2]),
+                         follow=True)
+        self.assertRedirects(response, modif_url)
+        response = c.get(modif_url)
+        self.assertEqual(response.status_code, 200)
+        response = c.get(reverse('operation_modify', args=[operation_pk1]),
+                         follow=True)
+        self.assertRedirects(response, "/")
+
+        # area filter
+        c = Client()
+        c.login(username=self.alt_username2, password=self.alt_password2)
+        response = c.get(reverse('operation_modify', args=[operation_pk2]),
+                         follow=True)
+        self.assertRedirects(response, modif_url)
+        response = c.get(modif_url)
+        self.assertEqual(response.status_code, 200)
+        response = c.get(reverse('operation_modify', args=[operation_pk1]),
+                         follow=True)
+        self.assertRedirects(response, "/")
+
+
 
 class DashboardTest(TestCase, OperationInitTest):
     fixtures = FILE_FIXTURES