45 lines
2.5 KiB
Python
45 lines
2.5 KiB
Python
"""Tests : CMS public, droits, liens et pages libres."""
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase
|
|
from rest_framework.test import APIClient
|
|
|
|
from .models import SiteContent, SiteBlock, SitePage
|
|
|
|
|
|
class CMSTests(TestCase):
|
|
def setUp(self):
|
|
User = get_user_model()
|
|
self.admin = User.objects.create_superuser(username='editor', password='StrongPass2026!')
|
|
self.member = User.objects.create_user(username='member', password='StrongPass2026!')
|
|
self.client = APIClient()
|
|
|
|
def test_public_content_read_only(self):
|
|
SiteContent.objects.create(key='home.title', value='Bonjour')
|
|
self.assertEqual(self.client.get('/api/cms/content/').data['home.title'], 'Bonjour')
|
|
self.assertEqual(self.client.put('/api/cms/content/home.title/', {'value': 'Non'}, format='json').status_code, 403)
|
|
self.client.force_authenticate(user=self.member)
|
|
self.assertEqual(self.client.put('/api/cms/content/home.title/', {'value': 'Non'}, format='json').status_code, 403)
|
|
|
|
def test_admin_can_edit_and_reset(self):
|
|
self.client.force_authenticate(user=self.admin)
|
|
self.assertEqual(self.client.put('/api/cms/content/home.title/', {'value': 'Texte'}, format='json').status_code, 200)
|
|
self.assertEqual(self.client.delete('/api/cms/content/home.title/').status_code, 204)
|
|
self.assertFalse(SiteContent.objects.filter(key='home.title').exists())
|
|
|
|
def test_unsafe_links_rejected(self):
|
|
self.client.force_authenticate(user=self.admin)
|
|
self.assertEqual(self.client.put('/api/cms/content/contact.button.href/', {'value': 'javascript:alert(1)'}, format='json').status_code, 400)
|
|
self.assertEqual(self.client.post('/api/cms/blocks/', {'page_slug': 'home', 'kind': 'button', 'url': 'javascript:alert(1)'}, format='json').status_code, 400)
|
|
|
|
def test_pages_and_blocks_publication(self):
|
|
page = SitePage.objects.create(slug='cours', title='Cours', published=False)
|
|
SiteBlock.objects.create(page_slug='cours', kind='text', body='Interne', published=False)
|
|
self.assertFalse(self.client.get('/api/cms/pages/').data)
|
|
self.assertFalse(self.client.get('/api/cms/blocks/').data)
|
|
self.client.force_authenticate(user=self.admin)
|
|
self.assertEqual(self.client.get('/api/cms/pages/').data[0]['id'], page.pk)
|
|
self.assertEqual(len(self.client.get('/api/cms/blocks/').data), 1)
|
|
|
|
def test_media_upload_is_private(self):
|
|
self.assertEqual(self.client.post('/api/cms/upload/').status_code, 403)
|