42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
|
from django.contrib.auth.models import AnonymousUser
|
||
|
|
|
||
|
|
from intent.access import org_access
|
||
|
|
from intent.orgs.models import OrgMembership
|
||
|
|
|
||
|
|
|
||
|
|
def test_owner_access(owner, org):
|
||
|
|
access = org_access(owner, org)
|
||
|
|
assert access.is_owner
|
||
|
|
assert access.can_view_members
|
||
|
|
assert access.can_manage_members
|
||
|
|
assert access.can_create_projects
|
||
|
|
|
||
|
|
|
||
|
|
def test_collaborator_access(collaborator, org):
|
||
|
|
access = org_access(collaborator, org)
|
||
|
|
assert access.is_member
|
||
|
|
assert not access.is_owner
|
||
|
|
assert access.can_view_members
|
||
|
|
assert not access.can_manage_members
|
||
|
|
assert not access.can_create_projects
|
||
|
|
|
||
|
|
|
||
|
|
def test_collaborator_with_grant_can_create_projects(collaborator, org):
|
||
|
|
OrgMembership.objects.filter(user=collaborator).update(can_create_projects=True)
|
||
|
|
assert org_access(collaborator, org).can_create_projects
|
||
|
|
|
||
|
|
|
||
|
|
def test_outsiders_have_no_access(make_user, org):
|
||
|
|
for user in [AnonymousUser(), make_user()]:
|
||
|
|
access = org_access(user, org)
|
||
|
|
assert not access.is_member
|
||
|
|
assert not access.can_view_members
|
||
|
|
assert not access.can_create_projects
|
||
|
|
|
||
|
|
|
||
|
|
def test_staff_never_have_access_even_with_a_membership_row(make_user, org):
|
||
|
|
admin = make_user(is_staff=True)
|
||
|
|
# Bypasses the service checks to prove access.py doesn't rely on them alone.
|
||
|
|
OrgMembership.objects.create(org=org, user=admin, role="owner")
|
||
|
|
assert not org_access(admin, org).is_member
|