api/users: allow management of multivalued attributes (#86670)

src/authentic2/models.py

@@ -217,7 +217,12 @@ class Attribute(models.Model):
             base_kwargs['allow_null'] = False
 
         base_kwargs.update(kwargs)
-        return field_class(**base_kwargs)
+        if not self.multiple:
+            return field_class(**base_kwargs)
+        listfield_kwargs = {}
+        if 'source' in base_kwargs:  # relevant only in container ListField
+            listfield_kwargs.update({'source': base_kwargs.pop('source')})
+        return serializers.ListField(child=field_class(**base_kwargs), **listfield_kwargs)
 
     def get_kind(self):
         from . import attribute_kinds

tests/api/test_all.py

@@ -328,6 +328,47 @@ def test_api_email_unset_verification(settings, app, admin, simple_user):
     assert not user.email_verified
 
 
+def test_api_users_attribute_multiple_list(app, superuser):
+    Attribute.objects.create(
+        name='favorite_color',
+        label='Favorite color',
+        kind='string',
+        asked_on_registration=False,
+        required=False,
+        user_visible=True,
+        user_editable=True,
+        multiple=False,
+    )
+    Attribute.objects.create(
+        name='neighborhoods',
+        label='Neighborhoods',
+        kind='string',
+        asked_on_registration=False,
+        required=False,
+        user_visible=True,
+        user_editable=True,
+        multiple=True,  # test str multi-valued attributes' serialization into claims
+    )
+    superuser.attributes.neighborhoods = ['foo', 'bar', 'baz']
+    superuser.attributes.favorite_color = 'yellow'
+    superuser.save()
+
+    app.authorization = ('Basic', (superuser.username, superuser.username))
+    resp = app.get('/api/users/%s/' % superuser.uuid)
+    assert resp.json['neighborhoods'] == ['foo', 'bar', 'baz']
+    assert resp.json['favorite_color'] == 'yellow'
+
+    payload = {
+        'favorite_color': 'blue',
+        'neighborhoods': ['a', 'b', 'e'],
+        'email': superuser.email,
+    }
+    app.post_json('/api/users/?update_or_create=email', params=payload)
+    superuser.refresh_from_db()
+    assert superuser.attributes.neighborhoods == ['a', 'b', 'e']
+    assert superuser.attributes.favorite_color == 'blue'
+
+
 def test_api_users_boolean_attribute(app, superuser):
     Attribute.objects.create(kind='boolean', name='boolean', label='boolean', required=True)
     superuser.attributes.boolean = True