#19 Tests

* adds tests for compensations (WIP)
* refactors some dummy data generating into base test class
* fixes bugs detected by testing
* adds important requirements.txt change for itsdangerous package (<1.0.0 for compatibility to django-simple-sso)

compensation/models.py

@@ -229,6 +229,19 @@ class Compensation(AbstractCompensation):
             self.identifier = self.generate_new_identifier()
         super().save(*args, **kwargs)
 
+    def is_shared_with(self, user: User):
+        """ Access check
+
+        Checks whether a given user has access to this object
+
+        Args:
+            user ():
+
+        Returns:
+
+        """
+        return self.intervention.users.filter(id=user.id)
+
     def get_LANIS_link(self) -> str:
         """ Generates a link for LANIS depending on the geometry
 

compensation/tests.py

@@ -1,3 +0,0 @@
-from django.test import TestCase
-
-# Create your tests here.

compensation/tests/test_views.py

@@ -0,0 +1,202 @@
+"""
+Author: Michel Peltriaux
+Organization: Struktur- und Genehmigungsdirektion Nord, Rhineland-Palatinate, Germany
+Contact: michel.peltriaux@sgdnord.rlp.de
+Created on: 27.10.21
+
+"""
+from django.urls import reverse
+from django.test import Client
+
+from compensation.models import CompensationState, CompensationAction
+from konova.settings import DEFAULT_GROUP
+from konova.tests.test_views import BaseViewTestCase
+
+
+class ViewTestCase(BaseViewTestCase):
+    comp_state = None
+    comp_action = None
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.create_dummy_states()
+        self.create_dummy_action()
+
+        # Prepare urls
+        self.index_url = reverse("compensation:index", args=())
+        self.new_url = reverse("compensation:new", args=(self.intervention.id,))
+        self.new_id_url = reverse("compensation:new-id", args=())
+        self.detail_url = reverse("compensation:detail", args=(self.compensation.id,))
+        self.log_url = reverse("compensation:log", args=(self.compensation.id,))
+        self.edit_url = reverse("compensation:edit", args=(self.compensation.id,))
+        self.remove_url = reverse("compensation:remove", args=(self.compensation.id,))
+        self.report_url = reverse("compensation:report", args=(self.compensation.id,))
+        self.state_new_url = reverse("compensation:new-state", args=(self.compensation.id,))
+        self.action_new_url = reverse("compensation:new-action", args=(self.compensation.id,))
+        self.deadline_new_url = reverse("compensation:new-deadline", args=(self.compensation.id,))
+        self.new_doc_url = reverse("compensation:new-doc", args=(self.compensation.id,))
+
+        self.state_remove_url = reverse("compensation:state-remove", args=(self.comp_state.id,))
+        self.action_remove_url = reverse("compensation:action-remove", args=(self.comp_action.id,))
+
+    def create_dummy_states(self):
+        """ Creates an intervention which can be used for tests
+
+        Returns:
+
+        """
+        self.comp_state = CompensationState.objects.create(
+            surface=10.00,
+            biotope_type=None,
+        )
+        self.compensation.before_states.set([self.comp_state])
+        self.compensation.after_states.set([self.comp_state])
+
+    def create_dummy_action(self):
+        """ Creates an intervention which can be used for tests
+
+        Returns:
+
+        """
+        self.comp_action = CompensationAction.objects.create(
+            amount=10
+        )
+        self.compensation.actions.set([self.comp_action])
+
+    def test_logged_in_no_groups_shared(self):
+        """ Check correct status code for all requests
+
+        Assumption: User logged in and has no groups and data is shared
+
+        Returns:
+
+        """
+        client = Client()
+        client.login(username=self.superuser.username, password=self.superuser_pw)
+        self.superuser.groups.set([])
+        self.intervention.users.set([self.superuser])
+
+        # Since the user has no groups, it does not matter that data has been shared. There SHOULD not be any difference
+        # to a user without access, since the important permissions are missing
+        success_urls = [
+            self.index_url,
+            self.detail_url,
+            self.report_url,
+        ]
+        fail_urls = [
+            self.new_url,
+            self.new_id_url,
+            self.log_url,
+            self.edit_url,
+            self.remove_url,
+            self.state_new_url,
+            self.action_new_url,
+            self.deadline_new_url,
+            self.state_remove_url,
+            self.action_remove_url,
+            self.new_doc_url,
+        ]
+
+        self.assert_url_success(client, success_urls)
+        self.assert_url_fail(client, fail_urls)
+
+    def test_logged_in_no_groups_unshared(self):
+        """ Check correct status code for all requests
+
+        Assumption: User logged in and has no groups and data is shared
+
+        Returns:
+
+        """
+        client = Client()
+        client.login(username=self.superuser.username, password=self.superuser_pw)
+        self.superuser.groups.set([])
+        self.intervention.users.set([])
+
+        # Since the user has no groups, it does not matter that data is unshared. There SHOULD not be any difference
+        # to a user having shared access, since all important permissions are missing
+        success_urls = [
+            self.index_url,
+            self.detail_url,
+            self.report_url,
+        ]
+        fail_urls = [
+            self.new_url,
+            self.new_id_url,
+            self.log_url,
+            self.edit_url,
+            self.remove_url,
+            self.state_new_url,
+            self.action_new_url,
+            self.deadline_new_url,
+            self.state_remove_url,
+            self.action_remove_url,
+            self.new_doc_url,
+        ]
+
+        self.assert_url_success(client, success_urls)
+        self.assert_url_fail(client, fail_urls)
+
+    def test_logged_in_default_group_shared(self):
+        """ Check correct status code for all requests
+
+        Assumption: User logged in and has no groups and data is shared
+
+        Returns:
+
+        """
+        client = Client()
+        client.login(username=self.superuser.username, password=self.superuser_pw)
+        group = self.groups.get(name=DEFAULT_GROUP)
+        self.superuser.groups.set([group])
+        self.intervention.users.set([self.superuser])
+
+        success_urls = [
+            self.index_url,
+            self.detail_url,
+            self.report_url,
+            self.new_url,
+            self.new_id_url,
+            self.edit_url,
+            self.state_new_url,
+            self.action_new_url,
+            self.deadline_new_url,
+            self.state_remove_url,
+            self.action_remove_url,
+            self.new_doc_url,
+            self.log_url,
+            self.remove_url,
+        ]
+        self.assert_url_success(client, success_urls)
+
+    def test_anonymous_user(self):
+        """ Check correct status code for all requests
+
+        Assumption: User not logged in
+
+        Returns:
+
+        """
+        client = Client()
+
+        success_urls = [
+            self.report_url,
+        ]
+        fail_urls = [
+            self.index_url,
+            self.detail_url,
+            self.new_url,
+            self.new_id_url,
+            self.log_url,
+            self.edit_url,
+            self.remove_url,
+            self.state_new_url,
+            self.action_new_url,
+            self.deadline_new_url,
+            self.state_remove_url,
+            self.action_remove_url,
+            self.new_doc_url,
+        ]
+
+        self.assert_url_success(client, success_urls)
+        self.assert_url_fail(client, fail_urls)

compensation/views/compensation_views.py

@@ -90,6 +90,7 @@ def new_view(request: HttpRequest, intervention_id: str = None):
 
 
 @login_required
+@default_group_required
 def new_id_view(request: HttpRequest):
     """ JSON endpoint
 
@@ -196,6 +197,8 @@ def detail_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
+@shared_access_required(Compensation, "id")
 def log_view(request: HttpRequest, id: str):
     """ Renders a log view using modal
 
@@ -220,6 +223,8 @@ def log_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
+@shared_access_required(Compensation, "id")
 def remove_view(request: HttpRequest, id: str):
     """ Renders a modal view for removing the compensation
 
@@ -240,6 +245,8 @@ def remove_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
+@shared_access_required(Compensation, "id")
 def new_document_view(request: HttpRequest, id: str):
     """ Renders a form for uploading new documents
 
@@ -258,6 +265,7 @@ def new_document_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
 def get_document_view(request: HttpRequest, doc_id: str):
     """ Returns the document as downloadable file
 
@@ -284,6 +292,7 @@ def get_document_view(request: HttpRequest, doc_id: str):
 
 
 @login_required
+@default_group_required
 def remove_document_view(request: HttpRequest, doc_id: str):
     """ Removes the document from the database and file system
 
@@ -304,6 +313,8 @@ def remove_document_view(request: HttpRequest, doc_id: str):
 
 
 @login_required
+@default_group_required
+@shared_access_required(Compensation, "id")
 def state_new_view(request: HttpRequest, id: str):
     """ Renders a form for adding new states for a compensation
 
@@ -323,6 +334,8 @@ def state_new_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
+@shared_access_required(Compensation, "id")
 def action_new_view(request: HttpRequest, id: str):
     """ Renders a form for adding new actions for a compensation
 
@@ -342,6 +355,8 @@ def action_new_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
+@shared_access_required(Compensation, "id")
 def deadline_new_view(request: HttpRequest, id: str):
     """ Renders a form for adding new states for a compensation
 
@@ -361,6 +376,7 @@ def deadline_new_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
 def state_remove_view(request: HttpRequest, id: str):
     """ Renders a form for removing a compensation state
 
@@ -380,6 +396,7 @@ def state_remove_view(request: HttpRequest, id: str):
 
 
 @login_required
+@default_group_required
 def action_remove_view(request: HttpRequest, id: str):
     """ Renders a form for removing a compensation action