<s> from __future__ import unicode_literals <EOL> import base64 <EOL> import unittest <EOL> from django . contrib . auth . models import Group , Permission , User <EOL> from django . core . urlresolvers import ResolverMatch <EOL> from django . db import models <EOL> from django . test import TestCase <EOL> from rest_framework import ( <EOL> HTTP_HEADER_ENCODING , authentication , generics , permissions , serializers , <EOL> status <EOL> ) <EOL> from rest_framework . compat import guardian <EOL> from rest_framework . filters import DjangoObjectPermissionsFilter <EOL> from rest_framework . routers import DefaultRouter <EOL> from rest_framework . test import APIRequestFactory <EOL> from tests . models import BasicModel <EOL> factory = APIRequestFactory ( ) <EOL> class BasicSerializer ( serializers . ModelSerializer ) : <EOL> class Meta : <EOL> model = BasicModel <EOL> class RootView ( generics . ListCreateAPIView ) : <EOL> queryset = BasicModel . objects . all ( ) <EOL> serializer_class = BasicSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ permissions . DjangoModelPermissions ] <EOL> class InstanceView ( generics . RetrieveUpdateDestroyAPIView ) : <EOL> queryset = BasicModel . objects . all ( ) <EOL> serializer_class = BasicSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ permissions . DjangoModelPermissions ] <EOL> class GetQuerySetListView ( generics . ListCreateAPIView ) : <EOL> serializer_class = BasicSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ permissions . DjangoModelPermissions ] <EOL> def get_queryset ( self ) : <EOL> return BasicModel . objects . all ( ) <EOL> class EmptyListView ( generics . ListCreateAPIView ) : <EOL> queryset = BasicModel . objects . none ( ) <EOL> serializer_class = BasicSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ permissions . DjangoModelPermissions ] <EOL> root_view = RootView . as_view ( ) <EOL> api_root_view = DefaultRouter ( ) . get_api_root_view ( ) <EOL> instance_view = InstanceView . as_view ( ) <EOL> get_queryset_list_view = GetQuerySetListView . as_view ( ) <EOL> empty_list_view = EmptyListView . as_view ( ) <EOL> def basic_auth_header ( username , password ) : <EOL> credentials = ( '<STR_LIT>' % ( username , password ) ) <EOL> base64_credentials = base64 . b64encode ( credentials . encode ( HTTP_HEADER_ENCODING ) ) . decode ( HTTP_HEADER_ENCODING ) <EOL> return '<STR_LIT>' % base64_credentials <EOL> class ModelPermissionsIntegrationTests ( TestCase ) : <EOL> def setUp ( self ) : <EOL> User . objects . create_user ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> user = User . objects . create_user ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> user . user_permissions = [ <EOL> Permission . objects . get ( codename = '<STR_LIT>' ) , <EOL> Permission . objects . get ( codename = '<STR_LIT>' ) , <EOL> Permission . objects . get ( codename = '<STR_LIT>' ) <EOL> ] <EOL> user = User . objects . create_user ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> user . user_permissions = [ <EOL> Permission . objects . get ( codename = '<STR_LIT>' ) , <EOL> ] <EOL> self . permitted_credentials = basic_auth_header ( '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> self . disallowed_credentials = basic_auth_header ( '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> self . updateonly_credentials = basic_auth_header ( '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> BasicModel ( text = '<STR_LIT:foo>' ) . save ( ) <EOL> def test_has_create_permissions ( self ) : <EOL> request = factory . post ( '<STR_LIT:/>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . permitted_credentials ) <EOL> response = root_view ( request , pk = <NUM_LIT:1> ) <EOL> self . assertEqual ( response . status_code , status . HTTP_201_CREATED ) <EOL> def test_api_root_view_discard_default_django_model_permission ( self ) : <EOL> """<STR_LIT>""" <EOL> request = factory . get ( '<STR_LIT:/>' , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . permitted_credentials ) <EOL> request . resolver_match = ResolverMatch ( '<STR_LIT>' , ( ) , { } ) <EOL> response = api_root_view ( request ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> def test_get_queryset_has_create_permissions ( self ) : <EOL> request = factory . post ( '<STR_LIT:/>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . permitted_credentials ) <EOL> response = get_queryset_list_view ( request , pk = <NUM_LIT:1> ) <EOL> self . assertEqual ( response . status_code , status . HTTP_201_CREATED ) <EOL> def test_has_put_permissions ( self ) : <EOL> request = factory . put ( '<STR_LIT>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . permitted_credentials ) <EOL> response = instance_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> def test_has_delete_permissions ( self ) : <EOL> request = factory . delete ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . permitted_credentials ) <EOL> response = instance_view ( request , pk = <NUM_LIT:1> ) <EOL> self . assertEqual ( response . status_code , status . HTTP_204_NO_CONTENT ) <EOL> def test_does_not_have_create_permissions ( self ) : <EOL> request = factory . post ( '<STR_LIT:/>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . disallowed_credentials ) <EOL> response = root_view ( request , pk = <NUM_LIT:1> ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> def test_does_not_have_put_permissions ( self ) : <EOL> request = factory . put ( '<STR_LIT>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . disallowed_credentials ) <EOL> response = instance_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> def test_does_not_have_delete_permissions ( self ) : <EOL> request = factory . delete ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . disallowed_credentials ) <EOL> response = instance_view ( request , pk = <NUM_LIT:1> ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> def test_options_permitted ( self ) : <EOL> request = factory . options ( <EOL> '<STR_LIT:/>' , <EOL> HTTP_AUTHORIZATION = self . permitted_credentials <EOL> ) <EOL> response = root_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertIn ( '<STR_LIT>' , response . data ) <EOL> self . assertEqual ( list ( response . data [ '<STR_LIT>' ] . keys ( ) ) , [ '<STR_LIT:POST>' ] ) <EOL> request = factory . options ( <EOL> '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . permitted_credentials <EOL> ) <EOL> response = instance_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertIn ( '<STR_LIT>' , response . data ) <EOL> self . assertEqual ( list ( response . data [ '<STR_LIT>' ] . keys ( ) ) , [ '<STR_LIT>' ] ) <EOL> def test_options_disallowed ( self ) : <EOL> request = factory . options ( <EOL> '<STR_LIT:/>' , <EOL> HTTP_AUTHORIZATION = self . disallowed_credentials <EOL> ) <EOL> response = root_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertNotIn ( '<STR_LIT>' , response . data ) <EOL> request = factory . options ( <EOL> '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . disallowed_credentials <EOL> ) <EOL> response = instance_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertNotIn ( '<STR_LIT>' , response . data ) <EOL> def test_options_updateonly ( self ) : <EOL> request = factory . options ( <EOL> '<STR_LIT:/>' , <EOL> HTTP_AUTHORIZATION = self . updateonly_credentials <EOL> ) <EOL> response = root_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertNotIn ( '<STR_LIT>' , response . data ) <EOL> request = factory . options ( <EOL> '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . updateonly_credentials <EOL> ) <EOL> response = instance_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertIn ( '<STR_LIT>' , response . data ) <EOL> self . assertEqual ( list ( response . data [ '<STR_LIT>' ] . keys ( ) ) , [ '<STR_LIT>' ] ) <EOL> def test_empty_view_does_not_assert ( self ) : <EOL> request = factory . get ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . permitted_credentials ) <EOL> response = empty_list_view ( request , pk = <NUM_LIT:1> ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> class BasicPermModel ( models . Model ) : <EOL> text = models . CharField ( max_length = <NUM_LIT:100> ) <EOL> class Meta : <EOL> app_label = '<STR_LIT>' <EOL> permissions = ( <EOL> ( '<STR_LIT>' , '<STR_LIT>' ) , <EOL> ) <EOL> class BasicPermSerializer ( serializers . ModelSerializer ) : <EOL> class Meta : <EOL> model = BasicPermModel <EOL> class ViewObjectPermissions ( permissions . DjangoObjectPermissions ) : <EOL> perms_map = { <EOL> '<STR_LIT:GET>' : [ '<STR_LIT>' ] , <EOL> '<STR_LIT>' : [ '<STR_LIT>' ] , <EOL> '<STR_LIT>' : [ '<STR_LIT>' ] , <EOL> '<STR_LIT:POST>' : [ '<STR_LIT>' ] , <EOL> '<STR_LIT>' : [ '<STR_LIT>' ] , <EOL> '<STR_LIT>' : [ '<STR_LIT>' ] , <EOL> '<STR_LIT>' : [ '<STR_LIT>' ] , <EOL> } <EOL> class ObjectPermissionInstanceView ( generics . RetrieveUpdateDestroyAPIView ) : <EOL> queryset = BasicPermModel . objects . all ( ) <EOL> serializer_class = BasicPermSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ ViewObjectPermissions ] <EOL> object_permissions_view = ObjectPermissionInstanceView . as_view ( ) <EOL> class ObjectPermissionListView ( generics . ListAPIView ) : <EOL> queryset = BasicPermModel . objects . all ( ) <EOL> serializer_class = BasicPermSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ ViewObjectPermissions ] <EOL> object_permissions_list_view = ObjectPermissionListView . as_view ( ) <EOL> class GetQuerysetObjectPermissionInstanceView ( generics . RetrieveUpdateDestroyAPIView ) : <EOL> serializer_class = BasicPermSerializer <EOL> authentication_classes = [ authentication . BasicAuthentication ] <EOL> permission_classes = [ ViewObjectPermissions ] <EOL> def get_queryset ( self ) : <EOL> return BasicPermModel . objects . all ( ) <EOL> get_queryset_object_permissions_view = GetQuerysetObjectPermissionInstanceView . as_view ( ) <EOL> @ unittest . skipUnless ( guardian , '<STR_LIT>' ) <EOL> class ObjectPermissionsIntegrationTests ( TestCase ) : <EOL> """<STR_LIT>""" <EOL> def setUp ( self ) : <EOL> from guardian . shortcuts import assign_perm <EOL> create = User . objects . create_user <EOL> users = { <EOL> '<STR_LIT>' : create ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) , <EOL> '<STR_LIT>' : create ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) , <EOL> '<STR_LIT>' : create ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) , <EOL> '<STR_LIT>' : create ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' ) , <EOL> } <EOL> everyone = Group . objects . create ( name = '<STR_LIT>' ) <EOL> model_name = BasicPermModel . _meta . model_name <EOL> app_label = BasicPermModel . _meta . app_label <EOL> f = '<STR_LIT>' . format <EOL> perms = { <EOL> '<STR_LIT>' : f ( '<STR_LIT>' , model_name ) , <EOL> '<STR_LIT>' : f ( '<STR_LIT>' , model_name ) , <EOL> '<STR_LIT>' : f ( '<STR_LIT>' , model_name ) <EOL> } <EOL> for perm in perms . values ( ) : <EOL> perm = '<STR_LIT>' . format ( app_label , perm ) <EOL> assign_perm ( perm , everyone ) <EOL> everyone . user_set . add ( * users . values ( ) ) <EOL> readers = Group . objects . create ( name = '<STR_LIT>' ) <EOL> writers = Group . objects . create ( name = '<STR_LIT>' ) <EOL> deleters = Group . objects . create ( name = '<STR_LIT>' ) <EOL> model = BasicPermModel . objects . create ( text = '<STR_LIT:foo>' ) <EOL> assign_perm ( perms [ '<STR_LIT>' ] , readers , model ) <EOL> assign_perm ( perms [ '<STR_LIT>' ] , writers , model ) <EOL> assign_perm ( perms [ '<STR_LIT>' ] , deleters , model ) <EOL> readers . user_set . add ( users [ '<STR_LIT>' ] , users [ '<STR_LIT>' ] ) <EOL> writers . user_set . add ( users [ '<STR_LIT>' ] , users [ '<STR_LIT>' ] ) <EOL> deleters . user_set . add ( users [ '<STR_LIT>' ] , users [ '<STR_LIT>' ] ) <EOL> self . credentials = { } <EOL> for user in users . values ( ) : <EOL> self . credentials [ user . username ] = basic_auth_header ( user . username , '<STR_LIT:password>' ) <EOL> def test_can_delete_permissions ( self ) : <EOL> request = factory . delete ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_204_NO_CONTENT ) <EOL> def test_cannot_delete_permissions ( self ) : <EOL> request = factory . delete ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> def test_can_update_permissions ( self ) : <EOL> request = factory . patch ( <EOL> '<STR_LIT>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] <EOL> ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertEqual ( response . data . get ( '<STR_LIT:text>' ) , '<STR_LIT>' ) <EOL> def test_cannot_update_permissions ( self ) : <EOL> request = factory . patch ( <EOL> '<STR_LIT>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] <EOL> ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_404_NOT_FOUND ) <EOL> def test_cannot_update_permissions_non_existing ( self ) : <EOL> request = factory . patch ( <EOL> '<STR_LIT>' , { '<STR_LIT:text>' : '<STR_LIT>' } , format = '<STR_LIT>' , <EOL> HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] <EOL> ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_404_NOT_FOUND ) <EOL> def test_can_read_permissions ( self ) : <EOL> request = factory . get ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> def test_cannot_read_permissions ( self ) : <EOL> request = factory . get ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> response = object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_404_NOT_FOUND ) <EOL> def test_can_read_get_queryset_permissions ( self ) : <EOL> """<STR_LIT>""" <EOL> request = factory . get ( '<STR_LIT>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> response = get_queryset_object_permissions_view ( request , pk = '<STR_LIT:1>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> def test_can_read_list_permissions ( self ) : <EOL> request = factory . get ( '<STR_LIT:/>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> object_permissions_list_view . cls . filter_backends = ( DjangoObjectPermissionsFilter , ) <EOL> response = object_permissions_list_view ( request ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertEqual ( response . data [ <NUM_LIT:0> ] . get ( '<STR_LIT:id>' ) , <NUM_LIT:1> ) <EOL> def test_cannot_read_list_permissions ( self ) : <EOL> request = factory . get ( '<STR_LIT:/>' , HTTP_AUTHORIZATION = self . credentials [ '<STR_LIT>' ] ) <EOL> object_permissions_list_view . cls . filter_backends = ( DjangoObjectPermissionsFilter , ) <EOL> response = object_permissions_list_view ( request ) <EOL> self . assertEqual ( response . status_code , status . HTTP_200_OK ) <EOL> self . assertListEqual ( response . data , [ ] ) <EOL> class BasicPerm ( permissions . BasePermission ) : <EOL> def has_permission ( self , request , view ) : <EOL> return False <EOL> class BasicPermWithDetail ( permissions . BasePermission ) : <EOL> message = '<STR_LIT>' <EOL> def has_permission ( self , request , view ) : <EOL> return False <EOL> class BasicObjectPerm ( permissions . BasePermission ) : <EOL> def has_object_permission ( self , request , view , obj ) : <EOL> return False <EOL> class BasicObjectPermWithDetail ( permissions . BasePermission ) : <EOL> message = '<STR_LIT>' <EOL> def has_object_permission ( self , request , view , obj ) : <EOL> return False <EOL> class PermissionInstanceView ( generics . RetrieveUpdateDestroyAPIView ) : <EOL> queryset = BasicModel . objects . all ( ) <EOL> serializer_class = BasicSerializer <EOL> class DeniedView ( PermissionInstanceView ) : <EOL> permission_classes = ( BasicPerm , ) <EOL> class DeniedViewWithDetail ( PermissionInstanceView ) : <EOL> permission_classes = ( BasicPermWithDetail , ) <EOL> class DeniedObjectView ( PermissionInstanceView ) : <EOL> permission_classes = ( BasicObjectPerm , ) <EOL> class DeniedObjectViewWithDetail ( PermissionInstanceView ) : <EOL> permission_classes = ( BasicObjectPermWithDetail , ) <EOL> denied_view = DeniedView . as_view ( ) <EOL> denied_view_with_detail = DeniedViewWithDetail . as_view ( ) <EOL> denied_object_view = DeniedObjectView . as_view ( ) <EOL> denied_object_view_with_detail = DeniedObjectViewWithDetail . as_view ( ) <EOL> class CustomPermissionsTests ( TestCase ) : <EOL> def setUp ( self ) : <EOL> BasicModel ( text = '<STR_LIT:foo>' ) . save ( ) <EOL> User . objects . create_user ( '<STR_LIT:username>' , '<STR_LIT>' , '<STR_LIT:password>' ) <EOL> credentials = basic_auth_header ( '<STR_LIT:username>' , '<STR_LIT:password>' ) <EOL> self . request = factory . get ( '<STR_LIT>' , format = '<STR_LIT>' , HTTP_AUTHORIZATION = credentials ) <EOL> self . custom_message = '<STR_LIT>' <EOL> def test_permission_denied ( self ) : <EOL> response = denied_view ( self . request , pk = <NUM_LIT:1> ) <EOL> detail = response . data . get ( '<STR_LIT>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> self . assertNotEqual ( detail , self . custom_message ) <EOL> def test_permission_denied_with_custom_detail ( self ) : <EOL> response = denied_view_with_detail ( self . request , pk = <NUM_LIT:1> ) <EOL> detail = response . data . get ( '<STR_LIT>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> self . assertEqual ( detail , self . custom_message ) <EOL> def test_permission_denied_for_object ( self ) : <EOL> response = denied_object_view ( self . request , pk = <NUM_LIT:1> ) <EOL> detail = response . data . get ( '<STR_LIT>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> self . assertNotEqual ( detail , self . custom_message ) <EOL> def test_permission_denied_for_object_with_custom_detail ( self ) : <EOL> response = denied_object_view_with_detail ( self . request , pk = <NUM_LIT:1> ) <EOL> detail = response . data . get ( '<STR_LIT>' ) <EOL> self . assertEqual ( response . status_code , status . HTTP_403_FORBIDDEN ) <EOL> self . assertEqual ( detail , self . custom_message ) </s>
