55 lines
3.3 KiB
Python
55 lines
3.3 KiB
Python
"""Régressions des droits admin. Lancer avec : python manage.py test common."""
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import Client, TestCase
|
|
from django.urls import reverse
|
|
|
|
|
|
class AdminApiTests(TestCase):
|
|
def setUp(self):
|
|
User = get_user_model()
|
|
self.superuser = User.objects.create_superuser(username="owner", password="TestPassword2026!")
|
|
self.staff = User.objects.create_user(username="staff", password="TestPassword2026!", is_staff=True)
|
|
self.member = User.objects.create_user(username="member", password="TestPassword2026!")
|
|
|
|
def test_dashboard_rejects_anonymous_and_regular_users(self):
|
|
self.assertEqual(self.client.get(reverse("admin-dashboard")).status_code, 401)
|
|
self.client.force_login(self.member)
|
|
self.assertEqual(self.client.get(reverse("admin-dashboard")).status_code, 403)
|
|
|
|
def test_staff_can_read_but_not_write(self):
|
|
self.client.force_login(self.staff)
|
|
response = self.client.get(reverse("admin-dashboard"))
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertEqual(response.json()["stats"]["total"], 3)
|
|
self.assertEqual(self.client.post(reverse("admin-create-user"), data='{"username":"newuser", "password":"AnotherPassword2026!"}', content_type="application/json").status_code, 403)
|
|
|
|
def test_superuser_can_create_and_disable_standard_account(self):
|
|
self.client.force_login(self.superuser)
|
|
response = self.client.post(reverse("admin-create-user"), data='{"username":"newuser", "password":"AnotherPassword2026!"}', content_type="application/json")
|
|
self.assertEqual(response.status_code, 201)
|
|
created = get_user_model().objects.get(username="newuser")
|
|
self.assertFalse(created.is_staff)
|
|
response = self.client.post(reverse("admin-user-active", kwargs={"user_id": created.pk}), data='{"is_active":false}', content_type="application/json")
|
|
self.assertEqual(response.status_code, 200)
|
|
created.refresh_from_db()
|
|
self.assertFalse(created.is_active)
|
|
|
|
def test_superuser_cannot_disable_self_or_other_superusers(self):
|
|
self.client.force_login(self.superuser)
|
|
response = self.client.post(reverse("admin-user-active", kwargs={"user_id": self.superuser.pk}), data='{"is_active":false}', content_type="application/json")
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
def test_csrf_required_for_login(self):
|
|
client = Client(enforce_csrf_checks=True)
|
|
client.get(reverse("auth-csrf"))
|
|
self.assertEqual(client.post(reverse("auth-login"), data='{"username":"owner", "password":"TestPassword2026!"}', content_type="application/json").status_code, 403)
|
|
token = client.cookies["csrftoken"].value
|
|
response = client.post(reverse("auth-login"), data='{"username":"owner", "password":"TestPassword2026!"}', content_type="application/json", HTTP_X_CSRFTOKEN=token)
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertEqual(response.json()["user"]["username"], "owner")
|
|
|
|
def test_ordinary_user_cannot_log_in_to_admin(self):
|
|
response = self.client.post(reverse("auth-login"), data='{"username":"member", "password":"TestPassword2026!"}', content_type="application/json")
|
|
self.assertEqual(response.status_code, 403)
|
|
self.assertNotIn("_auth_user_id", self.client.session)
|