|
3 | 3 | from django.db import models |
4 | 4 | from django.test import TestCase |
5 | 5 | from rest_framework import generics, status, permissions, authentication, HTTP_HEADER_ENCODING |
6 | | -from rest_framework.test import APIRequestFactory |
7 | 6 | from rest_framework.compat import guardian |
| 7 | +from rest_framework.test import APIRequestFactory |
| 8 | +from rest_framework.tests.models import BasicModel |
| 9 | +from rest_framework.settings import api_settings |
8 | 10 | import base64 |
9 | 11 |
|
10 | 12 | factory = APIRequestFactory() |
11 | 13 |
|
12 | | - |
13 | | -class BasicModel(models.Model): |
14 | | - text = models.CharField(max_length=100) |
15 | | - |
16 | | - |
17 | 14 | class RootView(generics.ListCreateAPIView): |
18 | 15 | model = BasicModel |
19 | 16 | authentication_classes = [authentication.BasicAuthentication] |
@@ -145,45 +142,67 @@ def test_options_updateonly(self): |
145 | 142 | self.assertEqual(list(response.data['actions'].keys()), ['PUT']) |
146 | 143 |
|
147 | 144 |
|
148 | | -class OwnerModel(models.Model): |
149 | | - text = models.CharField(max_length=100) |
150 | | - owner = models.ForeignKey(User) |
| 145 | +class BasicPermModel(BasicModel): |
151 | 146 |
|
| 147 | + class Meta: |
| 148 | + app_label = 'tests' |
| 149 | + permissions = ( |
| 150 | + ('read_basicpermmodel', "Can view basic perm model"), |
| 151 | + # add, change, delete built in to django |
| 152 | + ) |
152 | 153 |
|
153 | | -class IsOwnerPermission(permissions.BasePermission): |
154 | | - def has_object_permission(self, request, view, obj): |
155 | | - return request.user == obj.owner |
156 | | - |
157 | | - |
158 | | -class OwnerInstanceView(generics.RetrieveUpdateDestroyAPIView): |
159 | | - model = OwnerModel |
| 154 | +class ObjectPermissionInstanceView(generics.RetrieveUpdateDestroyAPIView): |
| 155 | + model = BasicModel |
160 | 156 | authentication_classes = [authentication.BasicAuthentication] |
161 | | - permission_classes = [IsOwnerPermission] |
162 | | - |
163 | | - |
164 | | -owner_instance_view = OwnerInstanceView.as_view() |
165 | | - |
166 | | - |
167 | | -class ObjectPermissionsIntegrationTests(TestCase): |
168 | | - """ |
169 | | - Integration tests for the object level permissions API. |
170 | | - """ |
171 | | - |
172 | | - def setUp(self): |
173 | | - User.objects.create_user('not_owner', 'not_owner@example.com', 'password') |
174 | | - user = User.objects.create_user('owner', 'owner@example.com', 'password') |
175 | | - |
176 | | - self.not_owner_credentials = basic_auth_header('not_owner', 'password') |
177 | | - self.owner_credentials = basic_auth_header('owner', 'password') |
178 | | - |
179 | | - OwnerModel(text='foo', owner=user).save() |
180 | | - |
181 | | - def test_owner_has_delete_permissions(self): |
182 | | - request = factory.delete('/1', HTTP_AUTHORIZATION=self.owner_credentials) |
183 | | - response = owner_instance_view(request, pk='1') |
184 | | - self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT) |
185 | | - |
186 | | - def test_non_owner_does_not_have_delete_permissions(self): |
187 | | - request = factory.delete('/1', HTTP_AUTHORIZATION=self.not_owner_credentials) |
188 | | - response = owner_instance_view(request, pk='1') |
189 | | - self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) |
| 157 | + permission_classes = [permissions.DjangoObjectLevelModelPermissions] |
| 158 | + |
| 159 | + |
| 160 | +object_permissions_view = ObjectPermissionInstanceView.as_view() |
| 161 | + |
| 162 | +if guardian: |
| 163 | + class ObjectPermissionsIntegrationTests(TestCase): |
| 164 | + """ |
| 165 | + Integration tests for the object level permissions API. |
| 166 | + """ |
| 167 | + |
| 168 | + def setUp(self): |
| 169 | + # create users |
| 170 | + User.objects.create_user('no_permission', 'no_permission@example.com', 'password') |
| 171 | + reader = User.objects.create_user('reader', 'reader@example.com', 'password') |
| 172 | + writer = User.objects.create_user('writer', 'writer@example.com', 'password') |
| 173 | + full_access = User.objects.create_user('full_access', 'full_access@example.com', 'password') |
| 174 | + |
| 175 | + model = BasicPermModel.objects.create(text='foo') |
| 176 | + |
| 177 | + # assign permissions appropriately |
| 178 | + from guardian.shortcuts import assign_perm |
| 179 | + |
| 180 | + read = "read_basicpermmodel" |
| 181 | + write = "change_basicpermmodel" |
| 182 | + delete = "delete_basicpermmodel" |
| 183 | + app_label = 'tests.' |
| 184 | + # model level permissions |
| 185 | + assign_perm(app_label + delete, full_access, obj=model) |
| 186 | + (assign_perm(app_label + write, user, obj=model) for user in (writer, full_access)) |
| 187 | + (assign_perm(app_label + read, user, obj=model) for user in (reader, writer, full_access)) |
| 188 | + |
| 189 | + # object level permissions |
| 190 | + assign_perm(delete, full_access, obj=model) |
| 191 | + (assign_perm(write, user, obj=model) for user in (writer, full_access)) |
| 192 | + (assign_perm(read, user, obj=model) for user in (reader, writer, full_access)) |
| 193 | + |
| 194 | + self.no_permission_credentials = basic_auth_header('no_permission', 'password') |
| 195 | + self.reader_credentials = basic_auth_header('reader', 'password') |
| 196 | + self.writer_credentials = basic_auth_header('writer', 'password') |
| 197 | + self.full_access_credentials = basic_auth_header('full_access', 'password') |
| 198 | + |
| 199 | + |
| 200 | + def test_has_delete_permissions(self): |
| 201 | + request = factory.delete('/1', HTTP_AUTHORIZATION=self.full_access_credentials) |
| 202 | + response = object_permissions_view(request, pk='1') |
| 203 | + self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT) |
| 204 | + |
| 205 | + def test_no_delete_permissions(self): |
| 206 | + request = factory.delete('/1', HTTP_AUTHORIZATION=self.writer_credentials) |
| 207 | + response = object_permissions_view(request, pk='1') |
| 208 | + self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND) |
0 commit comments