669 lines
22 KiB
Python
669 lines
22 KiB
Python
# authentic2 - versatile identity manager
|
|
# Copyright (C) 2010-2019 Entr'ouvert
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
import pytest
|
|
from django.core.exceptions import ValidationError
|
|
|
|
from authentic2.a2_rbac.models import OrganizationalUnit as OU
|
|
from authentic2.a2_rbac.models import Role, RoleParenting
|
|
from authentic2.data_transfer import (
|
|
ExportContext,
|
|
ImportContext,
|
|
RoleDeserializer,
|
|
export_ous,
|
|
export_roles,
|
|
export_site,
|
|
import_ou,
|
|
import_site,
|
|
search_role,
|
|
)
|
|
from authentic2.utils.misc import get_hex_uuid
|
|
|
|
|
|
def test_export_basic_role(db):
|
|
role = Role.objects.create(name='basic role', slug='basic-role', uuid=get_hex_uuid())
|
|
query_set = Role.objects.filter(uuid=role.uuid)
|
|
roles = export_roles(ExportContext(role_qs=query_set))
|
|
assert len(roles) == 1
|
|
role_dict = roles[0]
|
|
for key, value in role.export_json().items():
|
|
assert role_dict[key] == value
|
|
|
|
|
|
def test_export_role_with_parents(db):
|
|
grand_parent_role = Role.objects.create(
|
|
name='test grand parent role', slug='test-grand-parent-role', uuid=get_hex_uuid()
|
|
)
|
|
parent_1_role = Role.objects.create(
|
|
name='test parent 1 role', slug='test-parent-1-role', uuid=get_hex_uuid()
|
|
)
|
|
parent_1_role.add_parent(grand_parent_role)
|
|
parent_2_role = Role.objects.create(
|
|
name='test parent 2 role', slug='test-parent-2-role', uuid=get_hex_uuid()
|
|
)
|
|
parent_2_role.add_parent(grand_parent_role)
|
|
child_role = Role.objects.create(name='test child role', slug='test-child-role', uuid=get_hex_uuid())
|
|
child_role.add_parent(parent_1_role)
|
|
child_role.add_parent(parent_2_role)
|
|
|
|
query_set = Role.objects.filter(slug__startswith='test').order_by('slug')
|
|
roles = export_roles(ExportContext(role_qs=query_set))
|
|
assert len(roles) == 4
|
|
|
|
child_role_dict = roles[0]
|
|
assert child_role_dict['slug'] == child_role.slug
|
|
parents = child_role_dict['parents']
|
|
assert len(parents) == 2
|
|
expected_slugs = {parent_1_role.slug, parent_2_role.slug}
|
|
for parent in parents:
|
|
assert parent['slug'] in expected_slugs
|
|
expected_slugs.remove(parent['slug'])
|
|
|
|
grand_parent_role_dict = roles[1]
|
|
assert grand_parent_role_dict['slug'] == grand_parent_role.slug
|
|
|
|
parent_1_role_dict = roles[2]
|
|
assert parent_1_role_dict['slug'] == parent_1_role.slug
|
|
parents = parent_1_role_dict['parents']
|
|
assert len(parents) == 1
|
|
assert parents[0]['slug'] == grand_parent_role.slug
|
|
|
|
parent_2_role_dict = roles[3]
|
|
assert parent_2_role_dict['slug'] == parent_2_role.slug
|
|
parents = parent_2_role_dict['parents']
|
|
assert len(parents) == 1
|
|
assert parents[0]['slug'] == grand_parent_role.slug
|
|
|
|
|
|
def test_export_role_with_soft_deleted_parents(db):
|
|
Role.objects.all().delete()
|
|
parent_1_role = Role.objects.create(
|
|
name='test parent 1 role', slug='test-parent-1-role', uuid=get_hex_uuid()
|
|
)
|
|
parent_2_role = Role.objects.create(
|
|
name='test parent 2 role', slug='test-parent-2-role', uuid=get_hex_uuid()
|
|
)
|
|
child_role = Role.objects.create(name='test child role', slug='test-child-role', uuid=get_hex_uuid())
|
|
child_role.add_parent(parent_1_role)
|
|
child_role.add_parent(parent_2_role)
|
|
child_role.remove_parent(parent_2_role)
|
|
|
|
roles = export_roles(ExportContext(role_qs=Role.objects.all()))
|
|
assert len(roles) == 3
|
|
child_role_export = [x for x in roles if x['name'] == 'test child role'][0]
|
|
assert [x['name'] for x in child_role_export['parents']] == ['test parent 1 role']
|
|
|
|
|
|
def test_export_ous(db):
|
|
ou = OU.objects.create(name='ou name', slug='ou-slug', description='ou description')
|
|
ous = export_ous(ExportContext(ou_qs=OU.objects.filter(name='ou name')))
|
|
assert len(ous) == 1
|
|
ou_d = ous[0]
|
|
assert ou_d['name'] == ou.name
|
|
assert ou_d['slug'] == ou.slug
|
|
assert ou_d['description'] == ou.description
|
|
|
|
|
|
def test_search_role_by_uuid(db):
|
|
uuid = get_hex_uuid()
|
|
role_d = {'uuid': uuid, 'slug': 'role-slug'}
|
|
role = Role.objects.create(**role_d)
|
|
assert role == search_role({'uuid': uuid, 'slug': 'other-role-slug'})
|
|
|
|
|
|
def test_search_role_by_slug(db):
|
|
role_d = {'uuid': get_hex_uuid(), 'slug': 'role-slug'}
|
|
role = Role.objects.create(**role_d)
|
|
assert role == search_role({'uuid': get_hex_uuid(), 'slug': 'role-slug', 'ou': None, 'service': None})
|
|
|
|
|
|
def test_search_role_not_found(db):
|
|
assert (
|
|
search_role(
|
|
{'uuid': get_hex_uuid(), 'slug': 'role-slug', 'name': 'role name', 'ou': None, 'service': None}
|
|
)
|
|
is None
|
|
)
|
|
|
|
|
|
def test_search_role_slug_not_unique(db):
|
|
role1_d = {'uuid': get_hex_uuid(), 'slug': 'role-slug', 'name': 'role name'}
|
|
role2_d = {'uuid': get_hex_uuid(), 'slug': 'role-slug', 'name': 'role name'}
|
|
ou = OU.objects.create(name='some ou', slug='some-ou')
|
|
role1 = Role.objects.create(ou=ou, **role1_d)
|
|
Role.objects.create(**role2_d)
|
|
assert role1 == search_role(role1.export_json())
|
|
|
|
|
|
def test_role_deserializer(db):
|
|
rd = RoleDeserializer(
|
|
{
|
|
'name': 'some role',
|
|
'description': 'some role description',
|
|
'slug': 'some-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
},
|
|
ImportContext(),
|
|
)
|
|
assert rd._parents is None
|
|
assert rd._attributes is None
|
|
assert rd._obj is None
|
|
role, status = rd.deserialize()
|
|
assert status == 'created'
|
|
assert role.name == 'some role'
|
|
assert role.description == 'some role description'
|
|
assert role.slug == 'some-role'
|
|
assert rd._obj == role
|
|
|
|
|
|
def test_role_deserializer_with_ou(db):
|
|
ou = OU.objects.create(name='some ou', slug='some-ou')
|
|
rd = RoleDeserializer(
|
|
{
|
|
'uuid': get_hex_uuid(),
|
|
'name': 'some role',
|
|
'description': 'some role description',
|
|
'slug': 'some-role',
|
|
'ou': {'slug': 'some-ou'},
|
|
'service': None,
|
|
},
|
|
ImportContext(),
|
|
)
|
|
role, dummy = rd.deserialize()
|
|
assert role.ou == ou
|
|
|
|
|
|
def test_role_deserializer_missing_ou(db):
|
|
rd = RoleDeserializer(
|
|
{
|
|
'uuid': get_hex_uuid(),
|
|
'name': 'some role',
|
|
'description': 'role description',
|
|
'slug': 'some-role',
|
|
'ou': {'slug': 'some-ou'},
|
|
'service': None,
|
|
},
|
|
ImportContext(),
|
|
)
|
|
with pytest.raises(ValidationError):
|
|
rd.deserialize()
|
|
|
|
|
|
def test_role_deserializer_update_ou(db):
|
|
ou1 = OU.objects.create(name='ou 1', slug='ou-1')
|
|
ou2 = OU.objects.create(name='ou 2', slug='ou-2')
|
|
uuid = get_hex_uuid()
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 0
|
|
existing_role = Role.objects.create(uuid=uuid, slug='some-role', ou=ou1)
|
|
rd = RoleDeserializer(
|
|
{'uuid': uuid, 'name': 'some-role', 'slug': 'some-role', 'ou': {'slug': 'ou-2'}, 'service': None},
|
|
ImportContext(),
|
|
)
|
|
assert rd.deserialize()
|
|
existing_role.refresh_from_db()
|
|
assert existing_role.ou == ou2
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 1
|
|
|
|
|
|
def test_role_deserializer_update_fields(db):
|
|
uuid = get_hex_uuid()
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 0
|
|
existing_role = Role.objects.create(uuid=uuid, slug='some-role', name='some role')
|
|
rd = RoleDeserializer(
|
|
{'uuid': uuid, 'slug': 'some-role', 'name': 'some role changed', 'ou': None, 'service': None},
|
|
ImportContext(),
|
|
)
|
|
role, dummy = rd.deserialize()
|
|
existing_role.refresh_from_db()
|
|
assert role == existing_role
|
|
assert existing_role.name == 'some role changed'
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 1
|
|
|
|
|
|
def test_role_deserializer_with_attributes(db):
|
|
|
|
attributes_data = {
|
|
'is_superuser': dict(name='is_superuser', kind='string', value='true'),
|
|
'emails': dict(name='emails', kind='json', value='["a@a.com"]'),
|
|
}
|
|
rd = RoleDeserializer(
|
|
{
|
|
'uuid': get_hex_uuid(),
|
|
'name': 'some role',
|
|
'description': 'some role description',
|
|
'slug': 'some-role',
|
|
'attributes': list(attributes_data.values()),
|
|
'ou': None,
|
|
'service': None,
|
|
},
|
|
ImportContext(),
|
|
)
|
|
role, status = rd.deserialize()
|
|
rd.attributes()
|
|
assert status == 'created'
|
|
assert role.is_superuser is True
|
|
assert role.emails == ['a@a.com']
|
|
|
|
|
|
def test_role_deserializer_creates_admin_role(db):
|
|
role_dict = {
|
|
'name': 'some role',
|
|
'slug': 'some-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
rd = RoleDeserializer(role_dict, ImportContext())
|
|
rd.deserialize()
|
|
Role.objects.get(slug='_a2-managers-of-role-some-role')
|
|
|
|
|
|
def test_role_deserializer_parenting_existing_parent(db):
|
|
parent_role_dict = {
|
|
'name': 'grand parent role',
|
|
'slug': 'grand-parent-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
parent_role = Role.objects.create(**parent_role_dict)
|
|
child_role_dict = {
|
|
'name': 'child role',
|
|
'slug': 'child-role',
|
|
'parents': [parent_role_dict],
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
|
|
rd = RoleDeserializer(child_role_dict, ImportContext())
|
|
child_role, status = rd.deserialize()
|
|
created, dummy = rd.parentings()
|
|
|
|
assert status == 'created'
|
|
assert len(created) == 1
|
|
parenting = created[0]
|
|
assert parenting.direct is True
|
|
assert parenting.parent == parent_role
|
|
assert parenting.child == child_role
|
|
|
|
|
|
def test_role_deserializer_parenting_non_existing_parent(db):
|
|
parent_role_dict = {
|
|
'name': 'grand parent role',
|
|
'slug': 'grand-parent-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
child_role_dict = {
|
|
'name': 'child role',
|
|
'slug': 'child-role',
|
|
'parents': [parent_role_dict],
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
rd = RoleDeserializer(child_role_dict, ImportContext())
|
|
rd.deserialize()
|
|
with pytest.raises(ValidationError) as excinfo:
|
|
rd.parentings()
|
|
|
|
assert "Could not find parent role" in str(excinfo.value)
|
|
|
|
|
|
def test_role_deserializer_permissions(db):
|
|
ou = OU.objects.create(slug='some-ou')
|
|
other_role_dict = {'name': 'other role', 'slug': 'other-role-slug', 'uuid': get_hex_uuid(), 'ou': ou}
|
|
other_role = Role.objects.create(**other_role_dict)
|
|
other_role_dict['permisison'] = {
|
|
"operation": {"slug": "admin"},
|
|
"ou": {"slug": "default", "name": "Collectivit\u00e9 par d\u00e9faut"},
|
|
'target_ct': {'app_label': 'a2_rbac', 'model': 'role'},
|
|
"target": {
|
|
"slug": "role-deux",
|
|
"ou": {"slug": "default", "name": "Collectivit\u00e9 par d\u00e9faut"},
|
|
"service": None,
|
|
"name": "role deux",
|
|
},
|
|
}
|
|
some_role_dict = {
|
|
'name': 'some role',
|
|
'slug': 'some-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
some_role_dict['permissions'] = [
|
|
{
|
|
'operation': {'slug': 'add'},
|
|
'ou': None,
|
|
'target_ct': {'app_label': 'a2_rbac', 'model': 'role'},
|
|
'target': {"slug": 'other-role-slug', 'ou': {'slug': 'some-ou'}, 'service': None},
|
|
}
|
|
]
|
|
|
|
import_context = ImportContext()
|
|
rd = RoleDeserializer(some_role_dict, import_context)
|
|
rd.deserialize()
|
|
perm_created, perm_deleted = rd.permissions()
|
|
|
|
assert len(perm_created) == 1
|
|
assert len(perm_deleted) == 0
|
|
del some_role_dict['permissions']
|
|
role = Role.objects.get(slug=some_role_dict['slug'])
|
|
assert role.permissions.count() == 1
|
|
perm = role.permissions.first()
|
|
assert perm.operation.slug == 'add'
|
|
assert not perm.ou
|
|
assert perm.target == other_role
|
|
|
|
# that one should delete permissions
|
|
rd = RoleDeserializer(some_role_dict, import_context)
|
|
role, _ = rd.deserialize()
|
|
perm_created, perm_deleted = rd.permissions()
|
|
assert role.permissions.count() == 0
|
|
assert len(perm_created) == 0
|
|
assert len(perm_deleted) == 1
|
|
|
|
|
|
def test_permission_on_role(db):
|
|
perm_ou = OU.objects.create(slug='perm-ou', name='perm ou')
|
|
perm_role = Role.objects.create(slug='perm-role', ou=perm_ou, name='perm role')
|
|
|
|
some_role_dict = {'name': 'some role', 'slug': 'some-role-slug', 'ou': None, 'service': None}
|
|
some_role_dict['permissions'] = [
|
|
{
|
|
"operation": {"slug": "admin"},
|
|
"ou": {"slug": "perm-ou", "name": "perm-ou"},
|
|
'target_ct': {'app_label': 'a2_rbac', 'model': 'role'},
|
|
"target": {
|
|
"slug": "perm-role",
|
|
"ou": {"slug": "perm-ou", "name": "perm ou"},
|
|
"service": None,
|
|
"name": "perm role",
|
|
},
|
|
}
|
|
]
|
|
|
|
import_context = ImportContext()
|
|
rd = RoleDeserializer(some_role_dict, import_context)
|
|
rd.deserialize()
|
|
perm_created, dummy = rd.permissions()
|
|
assert len(perm_created) == 1
|
|
perm = perm_created[0]
|
|
assert perm.target == perm_role
|
|
assert perm.ou == perm_ou
|
|
assert perm.operation.slug == 'admin'
|
|
|
|
|
|
def test_permission_on_contentype(db):
|
|
perm_ou = OU.objects.create(slug='perm-ou', name='perm ou')
|
|
some_role_dict = {'name': 'some role', 'slug': 'some-role-slug', 'ou': None, 'service': None}
|
|
some_role_dict['permissions'] = [
|
|
{
|
|
"operation": {"slug": "admin"},
|
|
"ou": {"slug": "perm-ou", "name": "perm-ou"},
|
|
'target_ct': {"model": "contenttype", "app_label": "contenttypes"},
|
|
"target": {"model": "logentry", "app_label": "admin"},
|
|
}
|
|
]
|
|
|
|
import_context = ImportContext()
|
|
rd = RoleDeserializer(some_role_dict, import_context)
|
|
rd.deserialize()
|
|
perm_created, dummy = rd.permissions()
|
|
assert len(perm_created) == 1
|
|
perm = perm_created[0]
|
|
assert perm.target.app_label == 'admin'
|
|
assert perm.target.model == 'logentry'
|
|
assert perm.ou == perm_ou
|
|
|
|
|
|
def import_ou_created(db):
|
|
uuid = get_hex_uuid()
|
|
ou_d = {'uuid': uuid, 'slug': 'ou-slug', 'name': 'ou name'}
|
|
ou, status = import_ou(ou_d)
|
|
assert status == 'created'
|
|
assert ou.uuid == ou_d['uuid']
|
|
assert ou.slug == ou_d['slug']
|
|
assert ou.name == ou_d['name']
|
|
|
|
|
|
def import_ou_updated(db):
|
|
ou = OU.objects.create(slug='some-ou', name='ou name')
|
|
ou_d = {'uuid': ou.uuid, 'slug': ou.slug, 'name': 'new name'}
|
|
ou_updated, status = import_ou(ou_d)
|
|
assert status == 'updated'
|
|
assert ou == ou_updated
|
|
assert ou.name == 'new name'
|
|
|
|
|
|
def testi_import_site_empty():
|
|
res = import_site({}, ImportContext())
|
|
assert res.roles == {'created': [], 'updated': []}
|
|
assert res.ous == {'created': [], 'updated': []}
|
|
assert res.parentings == {'created': [], 'deleted': []}
|
|
|
|
|
|
def test_import_site_roles(db):
|
|
parent_role_dict = {
|
|
'name': 'grand parent role',
|
|
'slug': 'grand-parent-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
child_role_dict = {
|
|
'name': 'child role',
|
|
'slug': 'child-role',
|
|
'parents': [parent_role_dict],
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
roles = [parent_role_dict, child_role_dict]
|
|
res = import_site({'roles': roles}, ImportContext())
|
|
created_roles = res.roles['created']
|
|
assert len(created_roles) == 2
|
|
parent_role = Role.objects.get(**parent_role_dict)
|
|
del child_role_dict['parents']
|
|
child_role = Role.objects.get(**child_role_dict)
|
|
assert created_roles[0] == parent_role
|
|
assert created_roles[1] == child_role
|
|
|
|
assert len(res.parentings['created']) == 1
|
|
assert res.parentings['created'][0] == RoleParenting.objects.get(
|
|
child=child_role, parent=parent_role, direct=True
|
|
)
|
|
|
|
|
|
def test_roles_import_ignore_technical_role(db):
|
|
roles = [{'name': 'some role', 'description': 'some role description', 'slug': '_some-role'}]
|
|
res = import_site({'roles': roles}, ImportContext())
|
|
assert res.roles == {'created': [], 'updated': []}
|
|
|
|
|
|
def test_roles_import_ignore_technical_role_with_service(db):
|
|
roles = [{'name': 'some role', 'description': 'some role description', 'slug': '_some-role'}]
|
|
res = import_site({'roles': roles}, ImportContext())
|
|
assert res.roles == {'created': [], 'updated': []}
|
|
|
|
|
|
def test_import_role_handle_manager_role_parenting(db):
|
|
parent_role_dict = {
|
|
'name': 'grand parent role',
|
|
'slug': 'grand-parent-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
parent_role_manager_dict = {
|
|
'name': 'Administrateur du role grand parent role',
|
|
'slug': '_a2-managers-of-role-grand-parent-role',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
child_role_dict = {
|
|
'name': 'child role',
|
|
'slug': 'child-role',
|
|
'parents': [parent_role_dict, parent_role_manager_dict],
|
|
'uuid': get_hex_uuid(),
|
|
'ou': None,
|
|
'service': None,
|
|
}
|
|
import_site({'roles': [child_role_dict, parent_role_dict]}, ImportContext())
|
|
child = Role.objects.get(slug='child-role')
|
|
manager = Role.objects.get(slug='_a2-managers-of-role-grand-parent-role')
|
|
rp = RoleParenting.objects.get(child=child, parent=manager, direct=True)
|
|
assert str(rp)
|
|
|
|
|
|
def test_import_roles_role_delete_orphans(db):
|
|
roles = [{'name': 'some role', 'description': 'some role description', 'slug': '_some-role'}]
|
|
with pytest.raises(ValidationError):
|
|
import_site({'roles': roles}, ImportContext(role_delete_orphans=True))
|
|
|
|
|
|
def test_roles_import_no_slug(db):
|
|
roles = [{'name': 'some role', 'description': 'some role description', 'ou': None}]
|
|
import_site({'roles': roles}, ImportContext())
|
|
role = Role.objects.get(name='some role')
|
|
assert role.slug == 'some-role'
|
|
|
|
|
|
def test_import_ou(db):
|
|
uuid = get_hex_uuid()
|
|
name = 'ou name'
|
|
ous = [{'uuid': uuid, 'slug': 'ou-slug', 'name': name}]
|
|
res = import_site({'ous': ous}, ImportContext())
|
|
assert len(res.ous['created']) == 1
|
|
ou = res.ous['created'][0]
|
|
assert ou.uuid == uuid
|
|
assert ou.name == name
|
|
Role.objects.get(slug='_a2-managers-of-ou-slug')
|
|
|
|
|
|
def test_import_ou_already_existing(db):
|
|
uuid = get_hex_uuid()
|
|
ou_d = {'uuid': uuid, 'slug': 'ou-slug', 'name': 'ou name'}
|
|
ou = OU.objects.create(**ou_d)
|
|
num_ous = OU.objects.count()
|
|
res = import_site({'ous': [ou_d]}, ImportContext())
|
|
assert len(res.ous['created']) == 0
|
|
assert num_ous == OU.objects.count()
|
|
assert ou == OU.objects.get(uuid=uuid)
|
|
|
|
|
|
def test_import_context_flags(db):
|
|
ous = [{'uuid': get_hex_uuid(), 'slug': 'ou-slug', 'name': 'ou name'}]
|
|
roles = [
|
|
{
|
|
'name': 'other role',
|
|
'slug': 'other-role-slug',
|
|
'uuid': get_hex_uuid(),
|
|
'ou': {'slug': 'ou-slug'},
|
|
}
|
|
]
|
|
d = {'ous': ous, 'roles': roles}
|
|
import_site(d, ImportContext(import_roles=False, import_ous=False))
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 0
|
|
assert OU.objects.exclude(slug='default').count() == 0
|
|
with pytest.raises(ValidationError) as e:
|
|
import_site(d, ImportContext(import_roles=True, import_ous=False))
|
|
assert 'missing Organizational' in e.value.args[0]
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 0
|
|
assert OU.objects.exclude(slug='default').count() == 0
|
|
import_site(d, ImportContext(import_roles=False, import_ous=True))
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 0
|
|
assert OU.objects.exclude(slug='default').count() == 1
|
|
import_site(d, ImportContext(import_roles=True, import_ous=True))
|
|
assert Role.objects.exclude(slug__startswith='_').count() == 1
|
|
assert OU.objects.exclude(slug='default').count() == 1
|
|
|
|
|
|
def test_export_site(db):
|
|
ou = OU.objects.create(name='ou')
|
|
Role.objects.create(name='role', ou=ou)
|
|
d = export_site()
|
|
assert len([ou for ou in d['ous'] if ou['slug'] != 'default']) == 1
|
|
assert len([role for role in d['roles'] if role['slug'][0] != '_']) == 1
|
|
d = export_site(ExportContext(ou_qs=OU.objects.filter(name='ou')))
|
|
assert len(d['ous']) == 1
|
|
d = export_site(ExportContext(role_qs=Role.objects.filter(name='role')))
|
|
assert len(d['roles']) == 1
|
|
d = export_site(ExportContext(export_roles=False))
|
|
assert 'roles' not in d
|
|
d = export_site(ExportContext(export_ous=False))
|
|
assert 'ous' not in d
|
|
|
|
|
|
def test_role_validate_unique(db):
|
|
ou = OU.objects.create(name='ou', slug='ou')
|
|
Role.objects.create(name='role1', slug='role1', ou=ou)
|
|
Role.objects.create(name='role2', slug='role2', ou=ou)
|
|
|
|
data = {
|
|
'roles': [
|
|
{
|
|
'name': 'role1',
|
|
'slug': 'role2',
|
|
'ou': {'slug': 'ou'},
|
|
}
|
|
]
|
|
}
|
|
with pytest.raises(ValidationError, match=r'Role "role1": name="role1": Name already used'):
|
|
import_site(data)
|
|
|
|
|
|
@pytest.mark.parametrize('uuid', [None, 1, [], {}, '', 'a'])
|
|
def test_import_roles_invalid_uuid(uuid, db):
|
|
with pytest.raises(ValidationError, match='.*invalid uuid'):
|
|
import_site(
|
|
{
|
|
'roles': [
|
|
{
|
|
'ou': {'slug': 'default'},
|
|
'uuid': uuid,
|
|
'name': 'role',
|
|
'description': 'role',
|
|
'slug': '-role',
|
|
}
|
|
]
|
|
}
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize('slug', [None, 1, [], {}, '', 'é', 'x a'])
|
|
def test_import_roles_invalid_slug(slug, db):
|
|
with pytest.raises(ValidationError, match='.*invalid slug'):
|
|
import_site(
|
|
{
|
|
'roles': [
|
|
{
|
|
'ou': {'slug': 'default'},
|
|
'uuid': '1d2a8aea-f8e3-40c1-aed5-6fc1327fdba0',
|
|
'name': 'role',
|
|
'description': 'role',
|
|
'slug': slug,
|
|
}
|
|
]
|
|
}
|
|
)
|