2026-10-27 07:10:27 -04:00
|
|
|
import itertools
|
|
|
|
|
|
|
|
|
|
import pytest
|
|
|
|
|
from allauth.account.models import EmailAddress
|
|
|
|
|
from django.contrib.auth import get_user_model
|
|
|
|
|
|
|
|
|
|
from intent.orgs.models import OrgMembership, Role
|
|
|
|
|
from intent.orgs.services import create_org
|
2026-10-27 07:58:16 -04:00
|
|
|
from intent.projects.models import ProjectMembership, Visibility
|
|
|
|
|
from intent.projects.services import create_project
|
2026-10-27 07:10:27 -04:00
|
|
|
|
|
|
|
|
_counter = itertools.count()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def make_user(db):
|
|
|
|
|
def make(username=None, *, email=None, is_staff=False):
|
|
|
|
|
username = username or f"user{next(_counter)}"
|
|
|
|
|
email = email or f"{username}@example.com"
|
|
|
|
|
user = get_user_model().objects.create_user(
|
|
|
|
|
username=username, email=email, is_staff=is_staff
|
|
|
|
|
)
|
|
|
|
|
EmailAddress.objects.create(user=user, email=email, verified=True, primary=True)
|
|
|
|
|
return user
|
|
|
|
|
|
|
|
|
|
return make
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def owner(make_user):
|
|
|
|
|
return make_user("olive")
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def org(owner):
|
|
|
|
|
return create_org(slug="catbriar", name="Catbriar", owner=owner)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def collaborator(make_user, org):
|
|
|
|
|
user = make_user("cole")
|
|
|
|
|
OrgMembership.objects.create(org=org, user=user, role=Role.COLLABORATOR)
|
|
|
|
|
return user
|
2026-10-27 07:58:16 -04:00
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def project(org, owner):
|
|
|
|
|
"""A private project created by the org owner, who is therefore its project owner too."""
|
|
|
|
|
return create_project(
|
|
|
|
|
org,
|
|
|
|
|
owner,
|
|
|
|
|
slug="intent",
|
|
|
|
|
name="Intent",
|
|
|
|
|
feature_prefix="INT",
|
|
|
|
|
visibility=Visibility.PRIVATE,
|
|
|
|
|
open_contribution=False,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def editor(make_user, org, project):
|
|
|
|
|
"""An org collaborator who is a collaborator on the project."""
|
|
|
|
|
user = make_user("eddie")
|
|
|
|
|
OrgMembership.objects.create(org=org, user=user)
|
|
|
|
|
ProjectMembership.objects.create(project=project, user=user)
|
|
|
|
|
return user
|
Add issues and comment threads (Phase 3)
Issues: per-project numbers, statuses (open, accepted, rejected,
withdrawn, duplicate), feature links, edits, and a timeline of comments
and events. From an issue, collaborators create or update a feature
with the revision tied to the issue and an option to accept it.
Comments: general and line-anchored threads on features, one
discussion thread per issue, edit history, tombstone deletes, resolve,
and promoting a feature thread to an issue. Line threads attach to
top-level Markdown blocks and go outdated only when the text changes.
HTMX swaps threads in place with focus management; every action also
works as a plain form post. Markdown headings are re-levelled so user
text never skips heading levels on the page.
The example flow from concept.md (steps 1-7) is covered end to end in
tests/test_example_flow.py.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 09:18:45 -04:00
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def open_project(project):
|
|
|
|
|
"""The project, made public and open to contributions from any signed-in user."""
|
|
|
|
|
project.visibility = Visibility.PUBLIC
|
|
|
|
|
project.open_contribution = True
|
|
|
|
|
project.save()
|
|
|
|
|
return project
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def outsider(make_user):
|
|
|
|
|
"""A signed-in user with no role in the org."""
|
|
|
|
|
return make_user("uma")
|
Harden for launch: limits, CSP, moderation, admin 2FA (Phase 5)
- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 10:51:06 -04:00
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.fixture
|
|
|
|
|
def verified_admin(client, make_user):
|
|
|
|
|
"""Sign `client` in as a staff user who has passed the admin's second factor."""
|
|
|
|
|
from django_otp import DEVICE_ID_SESSION_KEY
|
|
|
|
|
from django_otp.plugins.otp_totp.models import TOTPDevice
|
|
|
|
|
|
|
|
|
|
def sign_in(user=None):
|
|
|
|
|
user = user or get_user_model().objects.create_superuser(
|
|
|
|
|
"sam", "sam@example.com", "a-long-admin-password"
|
|
|
|
|
)
|
|
|
|
|
device = TOTPDevice.objects.create(user=user, name="Phone", confirmed=True)
|
|
|
|
|
client.force_login(user)
|
|
|
|
|
session = client.session
|
|
|
|
|
session[DEVICE_ID_SESSION_KEY] = device.persistent_id
|
|
|
|
|
session.save()
|
|
|
|
|
return user
|
|
|
|
|
|
|
|
|
|
return sign_in
|