wcs: sign requests done by manager to present forms/categories (#9370)

combo/apps/wcs/models.py

@@ -59,7 +59,7 @@ class WcsFormCell(CellBase):
         if self.formdef_reference:
             wcs_key, form_slug = self.formdef_reference.split(':')
             wcs_site = get_wcs_services().get(wcs_key)
-            forms_response_json = get_wcs_json(wcs_site.get('url'), 'json')
+            forms_response_json = get_wcs_json(wcs_site, 'api/formdefs/')
             for form in forms_response_json:
                 slug = form.get('slug')
                 if slug == form_slug:
@@ -100,7 +100,7 @@ class WcsCommonCategoryCell(CellBase):
         if self.category_reference:
             wcs_key, category_slug = self.category_reference.split(':')
             wcs_site = get_wcs_services().get(wcs_key)
-            categories_response_json = get_wcs_json(wcs_site.get('url'), 'categories')
+            categories_response_json = get_wcs_json(wcs_site, 'api/categories/')
             for category in categories_response_json.get('data'):
                 slug = category.get('slug')
                 if slug == category_slug:

combo/apps/wcs/utils.py

@@ -19,6 +19,8 @@ import requests
 from django.conf import settings
 from django.core.cache import cache
 
+from combo.utils import sign_url
+
 def is_wcs_enabled(cls):
     return hasattr(settings, 'KNOWN_SERVICES') and settings.KNOWN_SERVICES.get('wcs')
 
@@ -27,13 +29,19 @@ def get_wcs_services():
         return {}
     return settings.KNOWN_SERVICES.get('wcs')
 
-def get_wcs_json(wcs_url, path):
+def get_wcs_json(wcs_site, path):
+    wcs_url = wcs_site.get('url')
     if not wcs_url.endswith('/'):
         wcs_url += '/'
     url = wcs_url + path
     response_json = cache.get(url)
     if response_json is None:
-        response_json = requests.get(url, headers={'accept': 'application/json'}).json()
+        real_url = url
+        if wcs_site.get('orig') and wcs_site.get('secret'):
+            real_url += '?orig=%s' % wcs_site.get('orig')
+            real_url = sign_url(real_url, wcs_site.get('secret'))
+        response_json = requests.get(real_url,
+                headers={'accept': 'application/json'}).json()
         cache.set(url, response_json)
     return response_json
 
@@ -41,7 +49,7 @@ def get_wcs_options(url):
     references = []
     for wcs_key, wcs_site in get_wcs_services().iteritems():
         site_title = wcs_site.get('title')
-        response_json = get_wcs_json(wcs_site.get('url'), url)
+        response_json = get_wcs_json(wcs_site, url)
         if type(response_json) is dict:
             response_json = response_json.get('data')
         for element in response_json:

tests/test_wcs.py

@@ -14,7 +14,7 @@ from django.template import Context
 
 from combo.data.models import Page
 from combo.apps.wcs.models import (WcsFormCell, WcsCurrentFormsCell,
-        WcsFormsOfCategoryCell, WcsCurrentDraftsCell)
+        WcsFormsOfCategoryCell, WcsCurrentDraftsCell, WcsCategoryCell)
 
 from combo.utils import NothingInCacheException
 
@@ -52,6 +52,7 @@ from quixote import get_publisher
 
 from wcs.categories import Category
 from wcs.formdef import FormDef
+from wcs.roles import Role
 from wcs import fields
 
 cats = []
@@ -118,6 +119,18 @@ formdata.status = 'draft'
 formdata.receipt_time = datetime.datetime(2015, 1, 1).timetuple()
 formdata.user_id = user.id
 formdata.store()
+
+# a private formdef
+role = Role(name='Blah')
+role.store()
+
+formdef = FormDef()
+formdef.name = 'a private form'
+formdef.category_id = cats[2].id
+formdef.roles = [role.id]
+formdef.fields = []
+formdef.store()
+
 """,
 
 }
@@ -183,13 +196,16 @@ def test_form_cell_setup():
     form_class = cell.get_default_form_class()
     form = form_class()
     assert form.fields['formdef_reference'].widget.choices == [
+            (u'default:a-private-form', u'test : a private form'),
             (u'default:a-second-form-title', u'test : a second form title'),
             (u'default:form-title', u'test : form title'),
             (u'default:third-form-title', u'test : third form title'),
+            (u'other:a-private-form', u'test2 : a private form'),
             (u'other:a-second-form-title', u'test2 : a second form title'),
             (u'other:form-title', u'test2 : form title'),
             (u'other:third-form-title', u'test2 : third form title')]
 
+
 @wcsctl_present
 def test_form_cell_save_cache():
     page = Page(title='xxx', slug='test_form_cell_save_cache', template_name='standard')
@@ -201,6 +217,17 @@ def test_form_cell_save_cache():
     assert cell.cached_title == 'form title'
     assert cell.get_additional_label() == 'form title'
 
+@wcsctl_present
+def test_category_cell_save_cache():
+    page = Page(title='xxx', slug='test_category_cell_save_cache', template_name='standard')
+    page.save()
+    cell = WcsCategoryCell(page=page, placeholder='content', order=0)
+    assert cell.get_additional_label() is None
+    cell.category_reference = u'default:test-3'
+    cell.save()
+    assert cell.cached_title == 'Test 3'
+    assert cell.get_additional_label() == 'Test 3'
+
 @wcsctl_present
 def test_form_cell_render():
     page = Page(title='xxx', slug='test_form_cell_render', template_name='standard')