udata 13.0.1.dev12__py3-none-any.whl → 14.4.1.dev7__py3-none-any.whl

udata/tests/api/__init__.py

@@ -2,7 +2,10 @@ from contextlib import contextmanager
 from urllib.parse import urlparse
 
 import pytest
+from flask import json
+from flask_security.utils import login_user, logout_user, set_request_attr
 
+from udata.core.user.factories import UserFactory
 from udata.mongo import db
 from udata.mongo.document import get_all_models
 from udata.tests import PytestOnlyTestCase, TestCase, helpers
@@ -11,12 +14,15 @@ from udata.tests import PytestOnlyTestCase, TestCase, helpers
 @pytest.mark.usefixtures("instance_path")
 class APITestCaseMixin:
     """
-    See explanation about `get`, `post` overrides in :TestClientOverride
+    API Test Case Mixin with integrated API client functionality.
 
-    (switch from `data` in kwargs to `data` in args to avoid doing `data=data` and default to `json=True`)
+    This mixin provides API testing methods with automatic JSON handling.
+    The `get`, `post`, `put`, `patch`, `delete`, and `options` methods
+    default to JSON content-type and automatic serialization.
     """
 
     user = None
+    _user = None  # For API key authentication context
 
     @pytest.fixture(autouse=True)
     def load_api_routes(self, app):
@@ -26,45 +32,126 @@ class APITestCaseMixin:
         frontend.init_app(app)
 
     @pytest.fixture(autouse=True)
-    def inject_api(self, api):
+    def inject_client(self, app):
         """
-        Inject API test client for compatibility with legacy tests.
+        Inject test client for Flask testing.
         """
-        self.api = api
-
-    @pytest.fixture(autouse=True)
-    def inject_client(self, client):
-        """
-        Inject test client for compatibility with Flask-Testing.
-        """
-        self.client = client
+        self.client = app.test_client()
 
     @contextmanager
     def api_user(self, user=None):
-        with self.api.user(user) as user:
-            yield user
+        """
+        Context manager for API key authentication.
+
+        Usage:
+            with self.api_user(user) as user:
+                response = self.get(url)
+        """
+        self._user = user or UserFactory()
+        if not self._user.apikey:
+            self._user.generate_api_key()
+            self._user.save()
+        yield self._user
+        self._user = None
 
     def login(self, user=None):
-        self.user = self.client.login(user)
+        """Login a user via session authentication."""
+        self.user = user or UserFactory()
+
+        login_user(self.user)
+        set_request_attr("fs_authn_via", "session")
+
         return self.user
 
+    def logout(self):
+        """Logout the current user."""
+        logout_user()
+        self.user = None
+
+    def perform(self, verb, url, **kwargs):
+        """
+        Perform an HTTP request with JSON handling.
+
+        Args:
+            verb: HTTP verb (get, post, put, patch, delete, options)
+            url: URL to request
+            **kwargs: Additional arguments for the request
+
+        Returns:
+            Flask test response
+        """
+        headers = kwargs.pop("headers", {})
+
+        # Only set Content-Type for methods that have a body
+        if verb in ("post", "put", "patch", "delete"):
+            headers["Content-Type"] = "application/json"
+
+        data = kwargs.get("data")
+        if data is not None:
+            data = json.dumps(data)
+            headers["Content-Length"] = len(data)
+            kwargs["data"] = data
+
+        if self._user:
+            headers["X-API-KEY"] = kwargs.get("X-API-KEY", self._user.apikey)
+
+        kwargs["headers"] = headers
+        method = getattr(self.client, verb)
+        return method(url, **kwargs)
+
     def get(self, url, *args, **kwargs):
-        return self.api.get(url, *args, **kwargs)
+        """Perform a GET request with JSON handling."""
+        return self.perform("get", url, *args, **kwargs)
 
     def post(self, url, data=None, json=True, *args, **kwargs):
-        return self.api.post(url, data=data, json=json, *args, **kwargs)
+        """
+        Perform a POST request.
+
+        Args:
+            url: URL to request
+            data: Data to send (will be JSON-encoded if json=True)
+            json: If True, send as JSON (default: True)
+            *args, **kwargs: Additional arguments
+        """
+        if not json:
+            return self.client.post(url, data=data or {}, *args, **kwargs)
+        return self.perform("post", url, data=data or {}, *args, **kwargs)
 
     def put(self, url, data=None, json=True, *args, **kwargs):
-        return self.api.put(url, data=data, json=json, *args, **kwargs)
+        """
+        Perform a PUT request.
+
+        Args:
+            url: URL to request
+            data: Data to send (will be JSON-encoded if json=True)
+            json: If True, send as JSON (default: True)
+            *args, **kwargs: Additional arguments
+        """
+        if not json:
+            return self.client.put(url, data=data or {}, *args, **kwargs)
+        return self.perform("put", url, data=data or {}, *args, **kwargs)
 
     def patch(self, url, data=None, json=True, *args, **kwargs):
-        return self.api.patch(url, data=data, json=json, *args, **kwargs)
+        """
+        Perform a PATCH request.
+
+        Args:
+            url: URL to request
+            data: Data to send (will be JSON-encoded if json=True)
+            json: If True, send as JSON (default: True)
+            *args, **kwargs: Additional arguments
+        """
+        if not json:
+            return self.client.patch(url, data=data or {}, *args, **kwargs)
+        return self.perform("patch", url, data=data or {}, *args, **kwargs)
 
     def delete(self, url, data=None, *args, **kwargs):
-        return self.api.delete(url, data=data, *args, **kwargs)
+        """Perform a DELETE request with JSON handling."""
+        return self.perform("delete", url, data=data or {}, *args, **kwargs)
 
     def options(self, url, data=None, *args, **kwargs):
-        return self.api.options(url, data=data, *args, **kwargs)
+        """Perform an OPTIONS request with JSON handling."""
+        return self.perform("options", url, data=data or {}, *args, **kwargs)
 
     def assertStatus(self, response, status_code, message=None):
         __tracebackhide__ = True

udata/tests/api/test_activities_api.py

@@ -4,6 +4,7 @@ from werkzeug.test import TestResponse
 from udata.core.activity.models import Activity
 from udata.core.dataset.factories import DatasetFactory
 from udata.core.dataset.models import Dataset
+from udata.core.organization.factories import OrganizationFactory
 from udata.core.reuse.factories import ReuseFactory
 from udata.core.reuse.models import Reuse
 from udata.core.topic.factories import TopicFactory
@@ -111,3 +112,38 @@ class ActivityAPITest(APITestCase):
         assert activity_data["related_to_id"] == str(topic.id)
         assert activity_data["related_to_kind"] == "Topic"
         assert activity_data["related_to_url"] == topic.self_api_url()
+
+    def test_activity_api_list_with_private_visible_to_owner(self) -> None:
+        """Owner should see activities about their own private objects."""
+        owner = UserFactory()
+        dataset = DatasetFactory(private=True, owner=owner)
+        FakeDatasetActivity.objects.create(actor=UserFactory(), related_to=dataset)
+
+        # Anonymous user won't see it
+        response = self.get(url_for("api.activity"))
+        assert200(response)
+        assert len(response.json["data"]) == 0
+
+        # Owner should see their own private dataset activity
+        self.login(owner)
+        response = self.get(url_for("api.activity"))
+        assert200(response)
+        assert len(response.json["data"]) == 1
+
+    def test_activity_api_list_with_private_visible_to_org_member(self) -> None:
+        """Organization members should see activities about their org's private objects."""
+        member = UserFactory()
+        org = OrganizationFactory(admins=[member])
+        dataset = DatasetFactory(private=True, organization=org)
+        FakeDatasetActivity.objects.create(actor=UserFactory(), related_to=dataset)
+
+        # Anonymous user won't see it
+        response = self.get(url_for("api.activity"))
+        assert200(response)
+        assert len(response.json["data"]) == 0
+
+        # Org member should see the private dataset activity
+        self.login(member)
+        response = self.get(url_for("api.activity"))
+        assert200(response)
+        assert len(response.json["data"]) == 1