Kyle DammannandClaude Opus 5.5
6f7e4f92ca
- Recipe model with ingredients (amount/range, unit, group, note), steps, lowercase tags, author notes, source URL and private/public visibility - Central RecipeQuerySet.visible_to() used by every read path; edit only by owner, delete by owner or admin (visible recipes only) - Text-based editing: ingredient/step parser with roundtrip and scaling - Photo upload (JPEG/PNG/WebP/HEIC), re-encoded to WebP without EXIF, thumbnails, cover image, served only through permission-checked view - Search across title, description, ingredients, tags; ingredient and tag filters; "mine" and favourites views - Admin can delete all recipes of a deactivated user - Acceptance tests: private recipes unreachable for others and admins in list, search, tags, favourites, detail, edit, delete and image URLs Co-Authored-By: Claude Opus 5.5 <[email protected]>
71 lines
2.8 KiB
Python
71 lines
2.8 KiB
Python
import pytest
|
|
from django.test import Client
|
|
from django.urls import reverse
|
|
|
|
from accounts.models import Invitation, User
|
|
|
|
from .conftest import PASSWORD
|
|
|
|
pytestmark = pytest.mark.django_db
|
|
|
|
|
|
@pytest.mark.parametrize("name", ["accounts:admin_users", "accounts:admin_invitations"])
|
|
def test_admin_pages_forbidden_for_users(user_client, name):
|
|
assert user_client.get(reverse(name)).status_code == 403
|
|
|
|
|
|
@pytest.mark.parametrize("name", ["accounts:admin_users", "accounts:admin_invitations"])
|
|
def test_admin_pages_ok_for_admin(admin_client, name):
|
|
assert admin_client.get(reverse(name)).status_code == 200
|
|
|
|
|
|
@pytest.mark.parametrize("action", ["make_admin", "deactivate", "reset_link", "temp_password"])
|
|
def test_user_actions_forbidden_for_users(user_client, other_user, action):
|
|
response = user_client.post(reverse("accounts:admin_user_action", args=[other_user.pk, action]))
|
|
assert response.status_code == 403
|
|
other_user.refresh_from_db()
|
|
assert other_user.role == User.Role.USER and other_user.is_active and other_user.check_password(PASSWORD)
|
|
|
|
|
|
def test_user_cannot_create_invitation(user_client):
|
|
user_client.post(reverse("accounts:admin_invitations"), {"role": "admin", "valid_days": 7})
|
|
assert not Invitation.objects.exists()
|
|
|
|
|
|
def test_admin_creates_invitation(admin_client):
|
|
response = admin_client.post(reverse("accounts:admin_invitations"), {"role": "user", "valid_days": 3, "note": "Oma"})
|
|
assert response.status_code == 200
|
|
assert "/einladung/" in response.context["value"]
|
|
assert Invitation.objects.get().note == "Oma"
|
|
|
|
|
|
def test_admin_can_promote_and_deactivate(admin_client, user):
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "make_admin"]))
|
|
user.refresh_from_db()
|
|
assert user.role == User.Role.ADMIN
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "deactivate"]))
|
|
user.refresh_from_db()
|
|
assert not user.is_active
|
|
|
|
|
|
def test_deactivated_user_session_ends(admin_client, user):
|
|
session = Client()
|
|
session.force_login(user)
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "deactivate"]))
|
|
assert session.get(reverse("recipes:list")).status_code == 302
|
|
|
|
|
|
def test_admin_cannot_demote_or_deactivate_self(admin_client, admin_user):
|
|
for action in ["make_user", "deactivate"]:
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[admin_user.pk, action]))
|
|
admin_user.refresh_from_db()
|
|
assert admin_user.is_admin
|
|
|
|
|
|
def test_unknown_action_rejected(admin_client, user):
|
|
assert admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "delete"])).status_code == 403
|
|
|
|
|
|
def test_admin_actions_require_post(admin_client, user):
|
|
assert admin_client.get(reverse("accounts:admin_user_action", args=[user.pk, "make_admin"])).status_code == 405
|