tests: add authentication to required calls (#11375)

tests/conftest.py

@@ -1,5 +1,7 @@
 import pytest
 
+from django.contrib.auth.models import User
+
 import django_webtest
 
 @pytest.fixture

tests/test_api.py

@@ -2,13 +2,24 @@ import datetime
 import pytest
 from webtest import TestApp
 
+from django.contrib.auth import get_user_model
 from django.test import override_settings
 from django.utils.timezone import now
 
 from chrono.agendas.models import Agenda, Event, Booking
 
+
 pytestmark = pytest.mark.django_db
 
+@pytest.fixture
+def user():
+    User = get_user_model()
+    user = User.objects.create(username='john.doe',
+            first_name=u'John', last_name=u'Doe', email='john.doe@example.net')
+    user.set_password('password')
+    user.save()
+    return user
+
 @pytest.fixture
 def some_data():
     agenda = Agenda(label=u'Foo bar')
@@ -50,32 +61,41 @@ def test_datetime_api_fr(app, some_data):
         assert resp.json['data'][0]['text'].endswith(' 17:00')
         assert 'data' in resp.json
 
-
-def test_booking_api(app, some_data):
+def test_booking_api(app, some_data, user):
     agenda_id = Agenda.objects.filter(label=u'Foo bar')[0].id
     event = Event.objects.filter(agenda_id=agenda_id)[0]
+
+    # unauthenticated
+    resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda_id, event.id), status=403)
+
+    app.authorization = ('Basic', ('john.doe', 'password'))
     resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda_id, event.id))
     Booking.objects.get(id=resp.json['booking_id'])
     assert Booking.objects.count() == 1
 
-def test_booking_api_with_data(app, some_data):
+def test_booking_api_with_data(app, some_data, user):
     agenda_id = Agenda.objects.filter(label=u'Foo bar')[0].id
     event = Event.objects.filter(agenda_id=agenda_id)[0]
+
+    app.authorization = ('Basic', ('john.doe', 'password'))
     resp = app.post_json('/api/agenda/%s/fillslot/%s/' % (agenda_id, event.id),
             params={'hello': 'world'})
     assert Booking.objects.count() == 1
     assert Booking.objects.all()[0].extra_data == {'hello': 'world'}
 
-def test_booking_cancellation_api(app, some_data):
+def test_booking_cancellation_api(app, some_data, user):
     agenda_id = Agenda.objects.filter(label=u'Foo bar')[0].id
     event = Event.objects.filter(agenda_id=agenda_id)[0]
+    resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda_id, event.id), status=403)
+
+    app.authorization = ('Basic', ('john.doe', 'password'))
     resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda_id, event.id))
     booking_id = resp.json['booking_id']
     assert Booking.objects.count() == 1
     resp = app.delete('/api/booking/%s/' % booking_id)
     assert Booking.objects.filter(cancellation_datetime__isnull=False).count() == 1
 
-def test_soldout(app, some_data):
+def test_soldout(app, some_data, user):
     agenda_id = Agenda.objects.filter(label=u'Foo bar')[0].id
     event = Event.objects.filter(agenda_id=agenda_id).exclude(start_datetime__lt=now())[0]
 
@@ -90,6 +110,7 @@ def test_soldout(app, some_data):
     assert len(resp.json['data']) == 2
     assert not event.id in [x['id'] for x in resp.json['data']]
 
+    app.authorization = ('Basic', ('john.doe', 'password'))
     resp = app.post('/api/agenda/%s/fillslot/%s/' % (agenda_id, event.id), status=400)
     assert resp.json['err'] == 1
     assert resp.json['reason'] == 'sold out'