udata 14.0.0__py3-none-any.whl → 14.4.1.dev7__py3-none-any.whl

udata/tests/test_migrations.py

@@ -43,23 +43,23 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
         if migration_path.exists():
             migration_path.unlink()
 
-    def test_list_available_migrations(self, cli):
+    def test_list_available_migrations(self):
         """Test that we can list available migrations"""
-        result = cli("db status")
+        result = self.cli("db status")
         assert result.exit_code == 0
         # Should contain at least some output (may be empty if no migrations)
 
-    def test_migration_workflow(self, cli, db, migration_file):
+    def test_migration_workflow(self, db, migration_file):
         """Test complete migration workflow: info, migrate, status, unrecord"""
 
         # 1. Test info command on non-executed migration
-        result = cli(f"db info {migration_file}")
+        result = self.cli(f"db info {migration_file}")
         assert result.exit_code == 0
         assert "Test migration for integration testing" in result.output
         assert "Not applied" in result.output
 
         # 2. Test migrate command
-        result = cli("db migrate")
+        result = self.cli("db migrate")
         assert result.exit_code == 0
 
         # Verify migration was executed
@@ -76,17 +76,17 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
         assert record["ops"][0]["success"] is True
 
         # 3. Test status command after migration
-        result = cli("db status")
+        result = self.cli("db status")
         assert result.exit_code == 0
         assert migration_file.replace(".py", "") in result.output
 
         # 4. Test info command on executed migration
-        result = cli(f"db info {migration_file}")
+        result = self.cli(f"db info {migration_file}")
         assert result.exit_code == 0
         assert "Test migration for integration testing" in result.output
 
         # 5. Test unrecord command
-        result = cli(f"db unrecord {migration_file}")
+        result = self.cli(f"db unrecord {migration_file}")
         assert result.exit_code == 0
 
         # Verify migration record was removed
@@ -101,10 +101,10 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
         # Cleanup test data
         db.test_collection.delete_many({})
 
-    def test_migrate_recordonly(self, cli, db, migration_file):
+    def test_migrate_recordonly(self, db, migration_file):
         """Test migrate with --record flag"""
 
-        result = cli("db migrate --record")
+        result = self.cli("db migrate --record")
         assert result.exit_code == 0
 
         # Migration should be recorded
@@ -119,10 +119,10 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
         # Cleanup
         db.migrations.delete_one({"filename": migration_file})
 
-    def test_migrate_dry_run(self, cli, db, migration_file):
+    def test_migrate_dry_run(self, db, migration_file):
         """Test migrate with --dry-run flag"""
 
-        result = cli("db migrate --dry-run")
+        result = self.cli("db migrate --dry-run")
         assert result.exit_code == 0
 
         # Migration should NOT be recorded
@@ -133,18 +133,18 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
         inserted = db.test_collection.find_one()
         assert inserted is None
 
-    def test_migrate_already_applied(self, cli, db, migration_file):
+    def test_migrate_already_applied(self, db, migration_file):
         """Test that already applied migrations are skipped"""
 
         # First migration
-        result = cli("db migrate")
+        result = self.cli("db migrate")
         assert result.exit_code == 0
 
         # Count records
         count_before = db.test_collection.count_documents({})
 
         # Second migration attempt
-        result = cli("db migrate")
+        result = self.cli("db migrate")
         assert result.exit_code == 0
         assert "Skipped" in result.output
 
@@ -156,7 +156,7 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
         db.test_collection.delete_many({})
         db.migrations.delete_one({"filename": migration_file})
 
-    def test_unrecord_with_complete_filename(self, cli, db):
+    def test_unrecord_with_complete_filename(self, db):
         """Should unrecord migration with complete filename"""
         db.migrations.insert_one(
             {
@@ -172,11 +172,11 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
                 ],
             }
         )
-        result = cli("db unrecord test.py")
+        result = self.cli("db unrecord test.py")
         assert result.exit_code == 0
         assert db.migrations.count_documents({}) == 0
 
-    def test_unrecord_without_parameters(self, cli, db):
+    def test_unrecord_without_parameters(self, db):
         """Should fail when no filename is provided"""
         db.migrations.insert_one(
             {
@@ -192,17 +192,17 @@ class MigrationsCommandsTest(PytestOnlyDBTestCase):
                 ],
             }
         )
-        result = cli("db unrecord", check=False)
+        result = self.cli("db unrecord", expect_error=True)
         assert result.exit_code != 0
         assert db.migrations.count_documents({}) == 1
 
-    def test_all_existing_migrations_can_run(self, cli, db):
+    def test_all_existing_migrations_can_run(self, db):
         """Test that all existing migrations can be executed without errors on a clean database"""
         # Get all available migrations
         all_migrations = migrations.list_available()
 
         # Run migrations
-        result = cli("db migrate")
+        result = self.cli("db migrate")
         assert result.exit_code == 0
 
         # Verify all migrations were recorded successfully

udata/tests/test_notifications.py

@@ -1,75 +1,33 @@
-from datetime import datetime
-
-import pytz
 from flask import url_for
 
-from udata.core.user.factories import UserFactory
-from udata.features.notifications import actions
-
-from .api import APITestCase, DBTestCase
-
-
-class NotificationsMixin(object):
-    def setUp(self):
-        actions._providers = {}
-
-
-class NotificationsActionsTest(NotificationsMixin, DBTestCase):
-    def test_registered_provider_is_listed(self):
-        def fake_provider(user):
-            return []
-
-        actions.register_provider("fake", fake_provider)
-
-        self.assertIn("fake", actions.list_providers())
+from udata.core.organization.factories import OrganizationFactory
+from udata.core.organization.models import Member
 
-    def test_registered_provider_with_decorator_is_listed(self):
-        @actions.notifier("fake")
-        def fake_provider(user):
-            return []
+from .api import APITestCase
 
-        self.assertIn("fake", actions.list_providers())
 
-    def test_registered_provider_provide_values(self):
-        dt = datetime.utcnow()
-
-        def fake_provider(user):
-            return [(dt, {"some": "value"})]
-
-        actions.register_provider("fake", fake_provider)
-
-        user = UserFactory()
-        notifs = actions.get_notifications(user)
-
-        self.assertEqual(len(notifs), 1)
-        self.assertEqual(notifs[0]["type"], "fake")
-        self.assertEqual(notifs[0]["details"], {"some": "value"})
-        self.assertEqualDates(notifs[0]["created_on"], dt)
-
-
-class NotificationsAPITest(NotificationsMixin, APITestCase):
+class NotificationsAPITest(APITestCase):
     def test_no_notifications(self):
         self.login()
         response = self.get(url_for("api.notifications"))
         self.assert200(response)
 
-        self.assertEqual(len(response.json), 0)
+        self.assertEqual(response.json["total"], 0)
 
     def test_has_notifications(self):
+        admin = self.login()
         self.login()
-        dt = datetime.utcnow()
+        organization = OrganizationFactory(members=[Member(user=admin, role="admin")])
+        data = {"comment": "a comment"}
 
-        @actions.notifier("fake")
-        def fake_notifier(user):
-            return [(dt, {"some": "value"}), (dt, {"another": "value"})]
+        response = self.post(url_for("api.request_membership", org=organization), data)
+        self.assert201(response)
 
+        self.login(admin)
         response = self.get(url_for("api.notifications"))
         self.assert200(response)
 
-        self.assertEqual(len(response.json), 2)
-
-        for notification in response.json:
-            self.assertEqual(notification["created_on"], pytz.utc.localize(dt).isoformat())
-            self.assertEqual(notification["type"], "fake")
-        self.assertEqual(response.json[0]["details"], {"some": "value"})
-        self.assertEqual(response.json[1]["details"], {"another": "value"})
+        self.assertEqual(response.json["total"], 1)
+        self.assertEqual(
+            response.json["data"][0]["details"]["request_organization"]["id"], str(organization.id)
+        )

udata/tests/test_notifications_task.py

@@ -0,0 +1,43 @@
+from datetime import datetime, timedelta
+
+import pytest
+from flask import current_app
+
+from udata.core.organization.models import Member, MembershipRequest, Organization
+from udata.core.user.factories import UserFactory
+from udata.features.notifications import tasks
+from udata.features.notifications.models import Notification
+from udata.tests.api import APITestCase
+
+
+class UserTasksTest(APITestCase):
+    @pytest.mark.options(DAYS_AFTER_NOTIFICATION_EXPIRED=3)
+    def test_notify_inactive_users(self):
+        self.login()
+        member = Member(user=self.user, role="admin")
+        org = Organization.objects.create(
+            name="with transfert", description="XXX", members=[member]
+        )
+
+        notification_handled_date = (
+            datetime.utcnow()
+            - timedelta(days=current_app.config["DAYS_AFTER_NOTIFICATION_EXPIRED"])
+            - timedelta(days=1)  # add margin
+        )
+
+        applicant = UserFactory()
+
+        request = MembershipRequest(user=applicant, comment="test")
+        org.add_membership_request(request)
+
+        assert Notification.objects.count() == 1
+
+        request.status = "accepted"
+        request.handled_by = self.user
+        request.handled_on = notification_handled_date
+        org.save()
+        MembershipRequest.after_handle.send(request, org=org)
+
+        tasks.delete_expired_notifications()
+
+        assert Notification.objects.count() == 0

udata/tests/test_owned.py

@@ -1,13 +1,14 @@
 from mongoengine import post_save
 
 import udata.core.owned as owned
+from udata.core.dataset.permissions import OwnableReadPermission
 from udata.core.organization.factories import OrganizationFactory
 from udata.core.organization.models import Organization
 from udata.core.user.factories import AdminFactory, UserFactory
 from udata.core.user.models import User
 from udata.models import Member
 from udata.mongo import db
-from udata.tests.api import DBTestCase
+from udata.tests.api import APITestCase, DBTestCase
 
 
 class CustomQuerySet(owned.OwnedQuerySet):
@@ -265,3 +266,82 @@ class OwnedQuerysetTest(DBTestCase):
             name="private_owned_by_other_user"
         )
         self.assertEqual(len(result), 0)
+
+
+class OwnableReadPermissionTest(APITestCase):
+    def setUp(self):
+        super().setUp()
+        from flask import g
+        from flask_principal import AnonymousIdentity
+
+        g.identity = AnonymousIdentity()
+
+    def test_public_object_visible_by_anonymous(self):
+        """Public objects should be visible by anonymous users."""
+        obj = Owned.objects.create(owner=UserFactory(), private=False)
+        assert OwnableReadPermission(obj).can() is True
+
+    def test_public_object_visible_by_authenticated(self):
+        """Public objects should be visible by authenticated users."""
+        obj = Owned.objects.create(owner=UserFactory(), private=False)
+        self.login()
+        assert OwnableReadPermission(obj).can() is True
+
+    def test_private_object_not_visible_by_anonymous(self):
+        """Private objects should not be visible by anonymous users."""
+        obj = Owned.objects.create(owner=UserFactory(), private=True)
+        assert OwnableReadPermission(obj).can() is False
+
+    def test_private_object_not_visible_by_other_user(self):
+        """Private objects should not be visible by other users."""
+        obj = Owned.objects.create(owner=UserFactory(), private=True)
+        self.login()
+        assert OwnableReadPermission(obj).can() is False
+
+    def test_private_object_visible_by_owner(self):
+        """Private objects should be visible by their owner."""
+        owner = UserFactory()
+        obj = Owned.objects.create(owner=owner, private=True)
+        self.login(owner)
+        assert OwnableReadPermission(obj).can() is True
+
+    def test_private_object_visible_by_org_admin(self):
+        """Private objects should be visible by organization admins."""
+        admin = UserFactory()
+        org = OrganizationFactory(members=[Member(user=admin, role="admin")])
+        obj = Owned.objects.create(organization=org, private=True)
+        self.login(admin)
+        assert OwnableReadPermission(obj).can() is True
+
+    def test_private_object_visible_by_org_editor(self):
+        """Private objects should be visible by organization editors."""
+        editor = UserFactory()
+        org = OrganizationFactory(members=[Member(user=editor, role="editor")])
+        obj = Owned.objects.create(organization=org, private=True)
+        self.login(editor)
+        assert OwnableReadPermission(obj).can() is True
+
+    def test_private_object_not_visible_by_other_org_member(self):
+        """Private objects should not be visible by members of other organizations."""
+        member = UserFactory()
+        OrganizationFactory(members=[Member(user=member, role="admin")])
+        org = OrganizationFactory()
+        obj = Owned.objects.create(organization=org, private=True)
+        self.login(member)
+        assert OwnableReadPermission(obj).can() is False
+
+    def test_private_object_visible_by_admin(self):
+        """Private objects should be visible by sysadmins."""
+        admin = AdminFactory()
+        obj = Owned.objects.create(owner=UserFactory(), private=True)
+        self.login(admin)
+        assert OwnableReadPermission(obj).can() is True
+
+    def test_object_without_private_attribute(self):
+        """Objects without private attribute should be visible by everyone."""
+
+        class OwnedWithoutPrivate(owned.Owned, db.Document):
+            name = db.StringField()
+
+        obj = OwnedWithoutPrivate.objects.create(owner=UserFactory())
+        assert OwnableReadPermission(obj).can() is True

udata/tests/test_storages.py

@@ -13,7 +13,7 @@ from udata.core.storages import utils
 from udata.core.storages.api import META, chunk_filename
 from udata.core.storages.tasks import purge_chunks
 from udata.tests import PytestOnlyTestCase
-from udata.tests.api import PytestOnlyDBTestCase
+from udata.tests.api import PytestOnlyAPITestCase
 from udata.utils import faker
 
 from .helpers import assert200, assert400
@@ -108,12 +108,13 @@ class ConfigurableAllowedExtensionsTest(PytestOnlyTestCase):
 
 
 @pytest.mark.usefixtures("instance_path")
-class StorageUploadViewTest(PytestOnlyDBTestCase):
-    def test_standard_upload(self, client):
-        client.login()
-        response = client.post(
-            url_for("test-storage.upload", name="resources"),
+class StorageUploadViewTest(PytestOnlyAPITestCase):
+    def test_standard_upload(self):
+        self.login()
+        response = self.post(
+            url_for("storage.upload", name="resources"),
             {"file": (BytesIO(b"aaa"), "Test with  spaces.TXT")},
+            json=False,
         )
 
         assert200(response)
@@ -128,14 +129,14 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
         assert response.json["url"] == expected
         assert response.json["mime"] == "text/plain"
 
-    def test_chunked_upload(self, client):
-        client.login()
-        url = url_for("test-storage.upload", name="tmp")
+    def test_chunked_upload(self):
+        self.login()
+        url = url_for("storage.upload", name="tmp")
         uuid = str(uuid4())
         parts = 4
 
         for i in range(parts):
-            response = client.post(
+            response = self.post(
                 url,
                 {
                     "file": (BytesIO(b"a"), "blob"),
@@ -147,6 +148,7 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
                     "totalparts": parts,
                     "chunksize": 1,
                 },
+                json=False,
             )
 
             assert200(response)
@@ -157,7 +159,7 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
             assert "sha1" not in response.json
             assert "url" not in response.json
 
-        response = client.post(
+        response = self.post(
             url,
             {
                 "uuid": uuid,
@@ -165,6 +167,7 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
                 "totalfilesize": parts,
                 "totalparts": parts,
             },
+            json=False,
         )
         assert "filename" in response.json
         assert "url" in response.json
@@ -180,13 +183,13 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
         assert storages.tmp.read(filename) == b"aaaa"
         assert list(storages.chunks.list_files()) == []
 
-    def test_chunked_upload_bad_chunk(self, client):
-        client.login()
-        url = url_for("test-storage.upload", name="tmp")
+    def test_chunked_upload_bad_chunk(self):
+        self.login()
+        url = url_for("storage.upload", name="tmp")
         uuid = str(uuid4())
         parts = 4
 
-        response = client.post(
+        response = self.post(
             url,
             {
                 "file": (BytesIO(b"a"), "blob"),
@@ -198,6 +201,7 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
                 "totalparts": parts,
                 "chunksize": 10,  # Does not match
             },
+            json=False,
         )
 
         assert400(response)
@@ -210,10 +214,12 @@ class StorageUploadViewTest(PytestOnlyDBTestCase):
 
         assert list(storages.chunks.list_files()) == []
 
-    def test_upload_resource_bad_request(self, client):
-        client.login()
-        response = client.post(
-            url_for("test-storage.upload", name="tmp"), {"bad": (BytesIO(b"aaa"), "test.txt")}
+    def test_upload_resource_bad_request(self):
+        self.login()
+        response = self.post(
+            url_for("storage.upload", name="tmp"),
+            {"bad": (BytesIO(b"aaa"), "test.txt")},
+            json=False,
         )
 
         assert400(response)

udata/tests/test_topics.py

@@ -16,6 +16,7 @@ from udata.core.topic.factories import (
     TopicWithElementsFactory,
 )
 from udata.core.topic.models import Topic, TopicElement
+from udata.core.user.factories import UserFactory
 from udata.search import reindex
 from udata.tests.api import PytestOnlyDBTestCase
 from udata.tests.helpers import assert_emit
@@ -55,26 +56,32 @@ class TopicModelTest(PytestOnlyDBTestCase):
         TopicWithElementsFactory()
         job_reindex.assert_called()
 
-    def test_topic_activities(self, api, mocker):
+    def test_topic_activities(self, app, mocker):
         # A user must be authenticated for activities to be emitted
-        user = api.login()
+        from flask_login import login_user
+
+        user = UserFactory()
 
         mock_created = mocker.patch.object(UserCreatedTopic, "emit")
         mock_updated = mocker.patch.object(UserUpdatedTopic, "emit")
 
-        with assert_emit(Topic.on_create):
-            topic = TopicFactory(owner=user)
-            mock_created.assert_called()
+        with app.test_request_context():
+            login_user(user)
 
-        with assert_emit(Topic.on_update):
-            topic.name = "new name"
-            topic.save()
-            mock_updated.assert_called()
+            with assert_emit(Topic.on_create):
+                topic = TopicFactory(owner=user)
+                mock_created.assert_called()
 
-    def test_topic_element_activities(self, api, mocker):
+            with assert_emit(Topic.on_update):
+                topic.name = "new name"
+                topic.save()
+                mock_updated.assert_called()
+
+    def test_topic_element_activities(self, app, mocker):
         # A user must be authenticated for activities to be emitted
-        user = api.login()
-        topic = TopicFactory(owner=user)
+        from flask_login import login_user
+
+        user = UserFactory()
 
         mock_topic_created = mocker.patch.object(UserCreatedTopic, "emit")
         mock_topic_updated = mocker.patch.object(UserUpdatedTopic, "emit")
@@ -82,55 +89,64 @@ class TopicModelTest(PytestOnlyDBTestCase):
         mock_element_updated = mocker.patch.object(UserUpdatedTopicElement, "emit")
         mock_element_deleted = mocker.patch.object(UserDeletedTopicElement, "emit")
 
-        # Test TopicElement creation
-        element = TopicElementDatasetFactory(topic=topic)
-        mock_element_created.assert_called_once()
-        mock_topic_created.assert_not_called()
-        mock_topic_updated.assert_not_called()
-        mock_element_updated.assert_not_called()
-        mock_element_deleted.assert_not_called()
-
-        call_args = mock_element_created.call_args
-        assert call_args[0][0] == topic  # related_to
-        assert call_args[0][1] == topic.organization  # organization
-        assert call_args[1]["extras"]["element_id"] == str(element.id)
-
-        mock_element_created.reset_mock()
-
-        # Test TopicElement update
-        element.title = "Updated title"
-        element.extras = {"key": "value"}
-        element.save()
-        mock_element_updated.assert_called_once()
-        mock_topic_created.assert_not_called()
-        mock_topic_updated.assert_not_called()
-        mock_element_created.assert_not_called()
-        mock_element_deleted.assert_not_called()
-
-        call_args = mock_element_updated.call_args
-        assert call_args[0][0] == topic  # related_to
-        assert call_args[0][1] == topic.organization  # organization
-        assert call_args[0][2] == ["title", "extras"]  # changed_fields
-        assert call_args[1]["extras"]["element_id"] == str(element.id)
-
-        mock_element_updated.reset_mock()
-
-        # Test TopicElement deletion
-        element_id = element.id
-        element.delete()
-
-        # Deletion should only trigger delete activity
-        mock_element_deleted.assert_called_once()
-        mock_element_updated.assert_not_called()
-        mock_topic_created.assert_not_called()
-        mock_topic_updated.assert_not_called()
-        mock_element_created.assert_not_called()
-
-        # Verify delete activity arguments
-        delete_call_args = mock_element_deleted.call_args
-        assert delete_call_args[0][0] == topic  # related_to
-        assert delete_call_args[0][1] == topic.organization  # organization
-        assert delete_call_args[1]["extras"]["element_id"] == str(element_id)
+        with app.test_request_context():
+            login_user(user)
+
+            topic = TopicFactory(owner=user)
+
+            # Reset mocks after topic creation since it emits activities
+            mock_topic_created.reset_mock()
+            mock_topic_updated.reset_mock()
+
+            # Test TopicElement creation
+            element = TopicElementDatasetFactory(topic=topic)
+            mock_element_created.assert_called_once()
+            mock_topic_created.assert_not_called()
+            mock_topic_updated.assert_not_called()
+            mock_element_updated.assert_not_called()
+            mock_element_deleted.assert_not_called()
+
+            call_args = mock_element_created.call_args
+            assert call_args[0][0] == topic  # related_to
+            assert call_args[0][1] == topic.organization  # organization
+            assert call_args[1]["extras"]["element_id"] == str(element.id)
+
+            mock_element_created.reset_mock()
+
+            # Test TopicElement update
+            element.title = "Updated title"
+            element.extras = {"key": "value"}
+            element.save()
+            mock_element_updated.assert_called_once()
+            mock_topic_created.assert_not_called()
+            mock_topic_updated.assert_not_called()
+            mock_element_created.assert_not_called()
+            mock_element_deleted.assert_not_called()
+
+            call_args = mock_element_updated.call_args
+            assert call_args[0][0] == topic  # related_to
+            assert call_args[0][1] == topic.organization  # organization
+            assert call_args[0][2] == ["title", "extras"]  # changed_fields
+            assert call_args[1]["extras"]["element_id"] == str(element.id)
+
+            mock_element_updated.reset_mock()
+
+            # Test TopicElement deletion
+            element_id = element.id
+            element.delete()
+
+            # Deletion should only trigger delete activity
+            mock_element_deleted.assert_called_once()
+            mock_element_updated.assert_not_called()
+            mock_topic_created.assert_not_called()
+            mock_topic_updated.assert_not_called()
+            mock_element_created.assert_not_called()
+
+            # Verify delete activity arguments
+            delete_call_args = mock_element_deleted.call_args
+            assert delete_call_args[0][0] == topic  # related_to
+            assert delete_call_args[0][1] == topic.organization  # organization
+            assert delete_call_args[1]["extras"]["element_id"] == str(element_id)
 
     def test_topic_element_wrong_class(self):
         # use a model instance that is not supported