tests: add tests on a2_rbac post_migrate handlers (#34133)

tests/test_a2_rbac.py

@@ -25,6 +25,10 @@ from django_rbac.utils import get_permission_model
 from django_rbac.models import Operation
 from authentic2.custom_user.models import User
 from authentic2.models import Service
+from django.core.management import call_command
+
+from authentic2.a2_rbac.models import Role, OrganizationalUnit as OU, RoleAttribute
+from authentic2.a2_rbac.utils import get_default_ou
 from authentic2.a2_rbac.models import (
     Role,
     Permission,
@@ -38,12 +42,12 @@ from utils import login
 
 def test_update_rbac(db):
     # 3 content types managers and 1 global manager
-    assert Role.objects.count() == 4
+    assert Role.objects.count() == 5
     # 3 content type global permissions, 1 role administration permissions (for the main manager
     # role which is self-administered)
     # and 1 user view permission (for the role administrator)
     # and 1 ou view permission (for the user and role administrators)
-    assert Permission.objects.count() == 6
+    assert Permission.objects.count() == 7
 
 
 def test_delete_role(db):
@@ -424,3 +428,68 @@ def test_admin_role_user_view(settings, app, admin, simple_user, ou1, user_ou1,
     assert select2_response.json['more'] is False
     assert (set(result['id'] for result in select2_response.json['results'])
             == set([user_ou1.id]))
+
+
+def test_no_managed_ct(transactional_db, settings):
+    from django.core.management.sql import emit_post_migrate_signal
+
+    call_command('flush', verbosity=0, interactive=False,
+                 database='default', reset_sequences=False)
+    assert Role.objects.count() == 5
+    OU.objects.create(name='OU1', slug='ou1')
+    emit_post_migrate_signal(verbosity=0, interactive=False, db='default', created_models=[])
+    assert Role.objects.count() == 5 + 4 + 4
+    settings.A2_RBAC_MANAGED_CONTENT_TYPES = ()
+    call_command('flush', verbosity=0, interactive=False,
+                 database='default', reset_sequences=False)
+    assert Role.objects.count() == 0
+    # create ou
+    OU.objects.create(name='OU1', slug='ou1')
+    emit_post_migrate_signal(verbosity=0, interactive=False, db='default', created_models=[])
+    assert Role.objects.count() == 0
+
+
+def test_global_manager_roles(db):
+    manager = Role.objects.get(ou__isnull=True, slug='_a2-manager')
+    ou_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-organizational-units')
+    user_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-users')
+    role_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-roles')
+    service_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-services')
+    assert ou_manager in manager.parents()
+    assert user_manager in manager.parents()
+    assert role_manager in manager.parents()
+    assert service_manager in manager.parents()
+    assert manager.parents(include_self=False).count() == 4
+    assert Role.objects.count() == 5
+    assert OU.objects.count() == 1
+
+
+def test_manager_roles_multi_ou(db, ou1):
+    manager = Role.objects.get(ou__isnull=True, slug='_a2-manager')
+    ou_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-organizational-units')
+    user_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-users')
+    role_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-roles')
+    service_manager = Role.objects.get(ou__isnull=True, slug='_a2-manager-of-services')
+    assert ou_manager in manager.parents()
+    assert user_manager in manager.parents()
+    assert role_manager in manager.parents()
+    assert service_manager in manager.parents()
+    assert manager.parents(include_self=False).count() == 4
+
+    for ou in [get_default_ou(), ou1]:
+        manager = Role.objects.get(ou__isnull=True,
+                                   slug='_a2-managers-of-{ou.slug}'.format(ou=ou))
+        user_manager = Role.objects.get(ou=ou,
+                                        slug='_a2-manager-of-users-{ou.slug}'.format(ou=ou))
+        role_manager = Role.objects.get(ou=ou,
+                                        slug='_a2-manager-of-roles-{ou.slug}'.format(ou=ou))
+        service_manager = Role.objects.get(ou=ou,
+                                           slug='_a2-manager-of-services-{ou.slug}'.format(ou=ou))
+
+        assert user_manager in manager.parents()
+        assert role_manager in manager.parents()
+        assert service_manager in manager.parents()
+        assert manager.parents(include_self=False).count() == 3
+
+    # 5 global roles and 4 ou roles for both ous
+    assert Role.objects.count() == 5 + 4 + 4