Alec Perkins
1af217f6fb
Sign-in via django-allauth: emailed one-time codes, GitHub, Discord, and Forgejo instances as OpenID Connect apps registered in admin. Regular users never have a password; sysadmins sign in only at /admin/ and are redirected there from the normal sign-in. Organizations at the URL root with owner and collaborator roles, a per-member project-create grant, and invites by username or email. Email invites carry a bearer token stored only as a hash. The last owner can't leave, be removed or be demoted. Permission checks live in intent/access.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.4 KiB
Python
41 lines
1.4 KiB
Python
from django.contrib.auth.models import AnonymousUser
|
|
|
|
from intent.access import org_access
|
|
from intent.orgs.models import OrgMembership
|
|
|
|
|
|
def test_owner_access(owner, org):
|
|
access = org_access(owner, org)
|
|
assert access.is_owner
|
|
assert access.can_view_members
|
|
assert access.can_manage_members
|
|
assert access.can_create_projects
|
|
|
|
|
|
def test_collaborator_access(collaborator, org):
|
|
access = org_access(collaborator, org)
|
|
assert access.is_member
|
|
assert not access.is_owner
|
|
assert access.can_view_members
|
|
assert not access.can_manage_members
|
|
assert not access.can_create_projects
|
|
|
|
|
|
def test_collaborator_with_grant_can_create_projects(collaborator, org):
|
|
OrgMembership.objects.filter(user=collaborator).update(can_create_projects=True)
|
|
assert org_access(collaborator, org).can_create_projects
|
|
|
|
|
|
def test_outsiders_have_no_access(make_user, org):
|
|
for user in [AnonymousUser(), make_user()]:
|
|
access = org_access(user, org)
|
|
assert not access.is_member
|
|
assert not access.can_view_members
|
|
assert not access.can_create_projects
|
|
|
|
|
|
def test_staff_never_have_access_even_with_a_membership_row(make_user, org):
|
|
admin = make_user(is_staff=True)
|
|
# Bypasses the service checks to prove access.py doesn't rely on them alone.
|
|
OrgMembership.objects.create(org=org, user=admin, role="owner")
|
|
assert not org_access(admin, org).is_member
|