253 lines
10 KiB
Python
253 lines
10 KiB
Python
import pytest
|
|
|
|
from awx.main.models import Organization, Project
|
|
from awx.main.access import (
|
|
NotificationTemplateAccess,
|
|
NotificationAccess,
|
|
JobTemplateAccess
|
|
)
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_get_queryset_orgmember(notification_template, user):
|
|
access = NotificationTemplateAccess(user('user', False))
|
|
notification_template.organization.member_role.members.add(user('user', False))
|
|
assert access.get_queryset().count() == 0
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_get_queryset_nonorgmember(notification_template, user):
|
|
access = NotificationTemplateAccess(user('user', False))
|
|
assert access.get_queryset().count() == 0
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_get_queryset_su(notification_template, user):
|
|
access = NotificationTemplateAccess(user('user', True))
|
|
assert access.get_queryset().count() == 1
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_get_queryset_orgadmin(notification_template, user):
|
|
access = NotificationTemplateAccess(user('admin', False))
|
|
notification_template.organization.admin_role.members.add(user('admin', False))
|
|
assert access.get_queryset().count() == 1
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_get_queryset_notificationadmin(notification_template, user):
|
|
access = NotificationTemplateAccess(user('admin', False))
|
|
notification_template.organization.notification_admin_role.members.add(user('admin', False))
|
|
assert access.get_queryset().count() == 1
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_get_queryset_org_auditor(notification_template, org_auditor):
|
|
access = NotificationTemplateAccess(org_auditor)
|
|
assert access.get_queryset().count() == 1
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_access_superuser(notification_template_factory):
|
|
nf_objects = notification_template_factory('test-orphaned', organization='test', superusers=['admin'])
|
|
admin = nf_objects.superusers.admin
|
|
nf = nf_objects.notification_template
|
|
|
|
access = NotificationTemplateAccess(admin)
|
|
assert access.can_read(nf)
|
|
assert access.can_change(nf, None)
|
|
assert access.can_delete(nf)
|
|
|
|
nf.organization = None
|
|
nf.save()
|
|
|
|
assert access.can_read(nf)
|
|
assert access.can_change(nf, None)
|
|
assert access.can_delete(nf)
|
|
|
|
|
|
@pytest.mark.django_db
|
|
@pytest.mark.parametrize("role", ["present.admin_role:admin", "present.notification_admin_role:admin"])
|
|
def test_notification_template_access_admin(role, organization_factory, notification_template_factory):
|
|
other_objects = organization_factory('other')
|
|
present_objects = organization_factory('present',
|
|
users=['admin'],
|
|
notification_templates=['test-notification'],
|
|
roles=[role])
|
|
|
|
notification_template = present_objects.notification_templates.test_notification
|
|
other_org = other_objects.organization
|
|
present_org = present_objects.organization
|
|
admin = present_objects.users.admin
|
|
|
|
access = NotificationTemplateAccess(admin)
|
|
assert not access.can_change(notification_template, {'organization': other_org.id})
|
|
assert access.can_read(notification_template)
|
|
assert access.can_change(notification_template, None)
|
|
assert access.can_change(notification_template, {'organization': present_org.id})
|
|
assert access.can_delete(notification_template)
|
|
|
|
nf = notification_template_factory("test-orphaned").notification_template
|
|
assert not access.can_read(nf)
|
|
assert not access.can_change(nf, None)
|
|
assert not access.can_delete(nf)
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_template_access_org_user(notification_template, user):
|
|
u = user('normal', False)
|
|
notification_template.organization.member_role.members.add(u)
|
|
access = NotificationTemplateAccess(user('normal', False))
|
|
assert not access.can_read(notification_template)
|
|
assert not access.can_change(notification_template, None)
|
|
assert not access.can_delete(notification_template)
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notificaiton_template_orphan_access_org_admin(notification_template, organization, org_admin):
|
|
notification_template.organization = None
|
|
access = NotificationTemplateAccess(org_admin)
|
|
assert not access.can_change(notification_template, {'organization': organization.id})
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_access_get_queryset_org_admin(notification, org_admin):
|
|
access = NotificationAccess(org_admin)
|
|
assert access.get_queryset().count() == 1
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_access_get_queryset_org_auditor(notification, org_auditor):
|
|
access = NotificationAccess(org_auditor)
|
|
assert access.get_queryset().count() == 1
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_access_system_admin(notification, admin):
|
|
access = NotificationAccess(admin)
|
|
assert access.can_read(notification)
|
|
assert access.can_delete(notification)
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_system_auditor_JT_attach(system_auditor, job_template, notification_template):
|
|
job_template.admin_role.members.add(system_auditor)
|
|
access = JobTemplateAccess(system_auditor)
|
|
assert not access.can_attach(
|
|
job_template, notification_template, 'notification_templates_success',
|
|
{'id': notification_template.id})
|
|
|
|
|
|
@pytest.mark.django_db
|
|
@pytest.mark.parametrize("org_role,expect", [
|
|
('admin_role', True),
|
|
('notification_admin_role', True),
|
|
('workflow_admin_role', False),
|
|
('auditor_role', False),
|
|
('member_role', False)
|
|
])
|
|
def test_org_role_JT_attach(rando, job_template, project, workflow_job_template, inventory_source,
|
|
notification_template, org_role, expect):
|
|
nt_organization = Organization.objects.create(name='organization just for the notification template')
|
|
notification_template.organization = nt_organization
|
|
notification_template.save()
|
|
getattr(notification_template.organization, org_role).members.add(rando)
|
|
kwargs = dict(
|
|
sub_obj=notification_template,
|
|
relationship='notification_templates_success',
|
|
data={'id': notification_template.id}
|
|
)
|
|
permissions = {}
|
|
expected_permissions = {}
|
|
organization = Organization.objects.create(name='objective organization')
|
|
|
|
for resource in (organization, job_template, project, workflow_job_template, inventory_source):
|
|
permission_resource = resource
|
|
if resource == inventory_source:
|
|
permission_resource = inventory_source.inventory
|
|
getattr(permission_resource, 'admin_role').members.add(rando)
|
|
model_name = resource.__class__.__name__
|
|
permissions[model_name] = rando.can_access(resource.__class__, 'attach', resource, **kwargs)
|
|
expected_permissions[model_name] = expect
|
|
|
|
assert permissions == expected_permissions
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_organization_NT_attach_permission(rando, notification_template):
|
|
notification_template.organization.notification_admin_role.members.add(rando)
|
|
target_organization = Organization.objects.create(name='objective organization')
|
|
target_organization.workflow_admin_role.members.add(rando)
|
|
assert not rando.can_access(Organization, 'attach', obj=target_organization, sub_obj=notification_template,
|
|
relationship='notification_templates_success', data={})
|
|
target_organization.auditor_role.members.add(rando)
|
|
assert rando.can_access(Organization, 'attach', obj=target_organization, sub_obj=notification_template,
|
|
relationship='notification_templates_success', data={})
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_project_NT_attach_permission(rando, notification_template):
|
|
notification_template.organization.notification_admin_role.members.add(rando)
|
|
project = Project.objects.create(
|
|
name='objective project',
|
|
organization=Organization.objects.create(name='foo')
|
|
)
|
|
project.update_role.members.add(rando)
|
|
assert not rando.can_access(Project, 'attach', obj=project, sub_obj=notification_template,
|
|
relationship='notification_templates_success', data={})
|
|
project.admin_role.members.add(rando)
|
|
assert rando.can_access(Project, 'attach', obj=project, sub_obj=notification_template,
|
|
relationship='notification_templates_success', data={})
|
|
|
|
|
|
@pytest.mark.django_db
|
|
@pytest.mark.parametrize("res_role,expect", [
|
|
('read_role', True),
|
|
(None, False)
|
|
])
|
|
def test_object_role_JT_attach(rando, job_template, workflow_job_template, inventory_source,
|
|
notification_template, res_role, expect):
|
|
nt_organization = Organization.objects.create(name='organization just for the notification template')
|
|
nt_organization.notification_admin_role.members.add(rando)
|
|
notification_template.organization = nt_organization
|
|
notification_template.save()
|
|
kwargs = dict(
|
|
sub_obj=notification_template,
|
|
relationship='notification_templates_success',
|
|
data={'id': notification_template.id}
|
|
)
|
|
permissions = {}
|
|
expected_permissions = {}
|
|
|
|
for resource in (job_template, workflow_job_template, inventory_source):
|
|
permission_resource = resource
|
|
if resource == inventory_source:
|
|
permission_resource = inventory_source.inventory
|
|
model_name = resource.__class__.__name__
|
|
if res_role is None or hasattr(permission_resource, res_role):
|
|
if res_role is not None:
|
|
getattr(permission_resource, res_role).members.add(rando)
|
|
permissions[model_name] = rando.can_access(
|
|
resource.__class__, 'attach', resource, **kwargs
|
|
)
|
|
expected_permissions[model_name] = expect
|
|
else:
|
|
permissions[model_name] = None
|
|
expected_permissions[model_name] = None
|
|
|
|
assert permissions == expected_permissions
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_access_org_admin(notification, org_admin):
|
|
access = NotificationAccess(org_admin)
|
|
assert access.can_read(notification)
|
|
assert access.can_delete(notification)
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_access_org_auditor(notification, org_auditor):
|
|
access = NotificationAccess(org_auditor)
|
|
assert access.can_read(notification)
|
|
assert not access.can_delete(notification)
|