wagtail 7.0.1__py3-none-any.whl → 7.1__py3-none-any.whl

wagtail/contrib/settings/tests/site_specific/test_admin.py

@@ -1,14 +1,13 @@
-from django.contrib.auth.models import Permission
+from django.contrib.auth.models import Group, Permission
 from django.test import TestCase, override_settings
 from django.urls import reverse
-from django.utils.text import capfirst
 
 from wagtail import hooks
 from wagtail.admin.admin_url_finder import AdminURLFinder
 from wagtail.admin.panels import FieldPanel, ObjectList, TabbedInterface
 from wagtail.contrib.settings.registry import SettingMenuItem
 from wagtail.contrib.settings.views import get_setting_edit_handler
-from wagtail.models import Page, Site
+from wagtail.models import GroupSitePermission, Page, Site
 from wagtail.test.testapp.models import (
     FileSiteSetting,
     IconSiteSetting,
@@ -20,7 +19,7 @@ from wagtail.test.testapp.models import (
 from wagtail.test.utils import WagtailTestUtils
 
 
-class TestSiteSettingMenu(WagtailTestUtils, TestCase):
+class SiteSettingTestMixin:
     def login_only_admin(self):
         """Log in with a user that only has permission to access the admin"""
         user = self.create_user(username="test", password="password")
@@ -32,24 +31,57 @@ class TestSiteSettingMenu(WagtailTestUtils, TestCase):
         self.login(username="test", password="password")
         return user
 
+    def grant_default_site_permission(self, user):
+        """
+        Grant the user permission to edit TestSiteSetting for the default site.
+        This is used to test site-specific permissions.
+        """
+        site_owners = Group.objects.create(name="Site Owners")
+        GroupSitePermission.objects.create(
+            group=site_owners,
+            site=Site.objects.get(is_default_site=True),
+            permission=Permission.objects.get_by_natural_key(
+                app_label="tests",
+                model="testsitesetting",
+                codename="change_testsitesetting",
+            ),
+        )
+        user.groups.add(site_owners)
+
+
+class TestSiteSettingMenu(SiteSettingTestMixin, WagtailTestUtils, TestCase):
     def test_menu_item_in_admin(self):
         self.login()
         response = self.client.get(reverse("wagtailadmin_home"))
 
-        self.assertContains(response, capfirst(TestSiteSetting._meta.verbose_name))
+        self.assertContains(response, "Test site setting")
         self.assertContains(
             response, reverse("wagtailsettings:edit", args=("tests", "testsitesetting"))
         )
 
+        # test that custom icon is used
+        self.assertContains(response, '"tag"')
+
     def test_menu_item_no_permissions(self):
         self.login_only_admin()
         response = self.client.get(reverse("wagtailadmin_home"))
 
-        self.assertNotContains(response, TestSiteSetting._meta.verbose_name)
+        self.assertNotContains(response, "Test site setting")
         self.assertNotContains(
             response, reverse("wagtailsettings:edit", args=("tests", "testsitesetting"))
         )
 
+    def test_menu_item_with_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+
+        response = self.client.get(reverse("wagtailadmin_home"))
+
+        self.assertContains(response, "Test site setting")
+        self.assertContains(
+            response, reverse("wagtailsettings:edit", args=("tests", "testsitesetting"))
+        )
+
     def test_menu_item_icon(self):
         menu_item = SettingMenuItem(IconSiteSetting, icon="tag", classname="test-class")
         self.assertEqual(menu_item.icon_name, "tag")
@@ -70,7 +102,7 @@ class BaseTestSiteSettingView(WagtailTestUtils, TestCase):
         return reverse("wagtailsettings:edit", args=args)
 
 
-class TestSiteSettingCreateView(BaseTestSiteSettingView):
+class TestSiteSettingCreateView(SiteSettingTestMixin, BaseTestSiteSettingView):
     def setUp(self):
         self.user = self.login()
 
@@ -78,6 +110,28 @@ class TestSiteSettingCreateView(BaseTestSiteSettingView):
         response = self.get()
         self.assertEqual(response.status_code, 200)
 
+    def test_get_edit_without_permission(self):
+        self.login_only_admin()
+        response = self.get()
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
+    def test_get_edit_with_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        response = self.get()
+        self.assertEqual(response.status_code, 200)
+
+    def test_get_edit_without_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        other_site = Site.objects.create(
+            hostname="example.com", root_page=Page.objects.get(pk=2)
+        )
+        response = self.get(site_pk=other_site.pk)
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
     def test_edit_invalid(self):
         response = self.post(post_data={"foo": "bar"})
         self.assertContains(response, "The setting could not be saved due to errors.")
@@ -99,6 +153,43 @@ class TestSiteSettingCreateView(BaseTestSiteSettingView):
         expected_url = "/admin/settings/tests/testsitesetting/%d/" % default_site.pk
         self.assertEqual(url_finder.get_edit_url(setting), expected_url)
 
+    def test_edit_without_permission(self):
+        self.login_only_admin()
+        response = self.post(
+            post_data={"title": "Edited site title", "email": "test@example.com"}
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+        self.assertFalse(TestSiteSetting.objects.exists())
+
+    def test_edit_with_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+
+        response = self.post(
+            post_data={"title": "Edited site title", "email": "test@example.com"}
+        )
+        self.assertEqual(response.status_code, 302)
+        default_site = Site.objects.get(is_default_site=True)
+        setting = TestSiteSetting.objects.get(site=default_site)
+        self.assertEqual(setting.title, "Edited site title")
+        self.assertEqual(setting.email, "test@example.com")
+
+    def test_edit_without_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        other_site = Site.objects.create(
+            hostname="example.com", root_page=Page.objects.get(pk=2)
+        )
+
+        response = self.post(
+            site_pk=other_site.pk,
+            post_data={"title": "Edited site title", "email": "test@example.com"},
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+        self.assertFalse(TestSiteSetting.objects.exists())
+
     def test_file_upload_multipart(self):
         response = self.get(setting=FileSiteSetting)
         # Ensure the form supports file uploads
@@ -205,7 +296,7 @@ class TestSiteSettingCreateView(BaseTestSiteSettingView):
         self.assertEqual(settings.sensitive_email, "test@example.com")
 
 
-class TestSiteSettingEditView(BaseTestSiteSettingView):
+class TestSiteSettingEditView(SiteSettingTestMixin, BaseTestSiteSettingView):
     def setUp(self):
         self.default_site = Site.objects.get(is_default_site=True)
 
@@ -221,6 +312,28 @@ class TestSiteSettingEditView(BaseTestSiteSettingView):
         response = self.get()
         self.assertEqual(response.status_code, 200)
 
+    def test_get_edit_without_permission(self):
+        self.login_only_admin()
+        response = self.get()
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
+    def test_get_edit_with_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        response = self.get()
+        self.assertEqual(response.status_code, 200)
+
+    def test_get_edit_without_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        other_site = Site.objects.create(
+            hostname="example.com", root_page=Page.objects.get(pk=2)
+        )
+        response = self.get(site_pk=other_site.pk)
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
     def test_non_existent_model(self):
         response = self.client.get(
             reverse("wagtailsettings:edit", args=["test", "foo", 1])
@@ -250,6 +363,46 @@ class TestSiteSettingEditView(BaseTestSiteSettingView):
         self.assertEqual(setting.title, "Edited site title")
         self.assertEqual(setting.email, "test@example.com")
 
+    def test_edit_without_permission(self):
+        self.login_only_admin()
+        response = self.post(
+            post_data={"title": "Edited site title", "email": "test@example.com"}
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+        self.test_setting.refresh_from_db()
+        self.assertEqual(self.test_setting.title, "Site title")
+        self.assertEqual(self.test_setting.email, "initial@example.com")
+
+    def test_edit_with_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+
+        response = self.post(
+            post_data={"title": "Edited site title", "email": "test@example.com"}
+        )
+        self.assertEqual(response.status_code, 302)
+        self.test_setting.refresh_from_db()
+        self.assertEqual(self.test_setting.title, "Edited site title")
+        self.assertEqual(self.test_setting.email, "test@example.com")
+
+    def test_edit_without_site_specific_permission(self):
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        other_site = Site.objects.create(
+            hostname="example.com", root_page=Page.objects.get(pk=2)
+        )
+
+        response = self.post(
+            site_pk=other_site.pk,
+            post_data={"title": "Edited site title", "email": "test@example.com"},
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+        self.test_setting.refresh_from_db()
+        self.assertEqual(self.test_setting.title, "Site title")
+        self.assertEqual(self.test_setting.email, "initial@example.com")
+
     def test_get_redirect_to_relevant_instance(self):
         url = reverse("wagtailsettings:edit", args=("tests", "testsitesetting"))
         default_site = Site.objects.get(is_default_site=True)
@@ -265,6 +418,32 @@ class TestSiteSettingEditView(BaseTestSiteSettingView):
         response = self.client.get(url)
         self.assertRedirects(response, status_code=302, expected_url="/admin/")
 
+    def test_get_redirect_to_relevant_instance_with_specific_site_permission(self):
+        user = self.login_only_admin()
+        other_site = Site.objects.create(
+            hostname="example.com", root_page=Page.objects.get(pk=2)
+        )
+
+        # grant this user permission to edit other_site only
+        site_owners = Group.objects.create(name="Site Owners")
+        GroupSitePermission.objects.create(
+            group=site_owners,
+            site=other_site,
+            permission=Permission.objects.get_by_natural_key(
+                app_label="tests",
+                model="testsitesetting",
+                codename="change_testsitesetting",
+            ),
+        )
+        user.groups.add(site_owners)
+
+        url = reverse("wagtailsettings:edit", args=("tests", "testsitesetting"))
+
+        response = self.client.get(url)
+        self.assertRedirects(
+            response, status_code=302, expected_url=f"{url}{other_site.pk}/"
+        )
+
     def test_edit_restricted_field(self):
         # User has edit permission over the setting model, including the sensitive_email field
         test_setting = TestPermissionedSiteSetting()
@@ -382,7 +561,7 @@ class TestSiteSettingEditView(BaseTestSiteSettingView):
 @override_settings(
     ALLOWED_HOSTS=["testserver", "example.com", "noneoftheabove.example.com"]
 )
-class TestMultiSite(BaseTestSiteSettingView):
+class TestMultiSite(SiteSettingTestMixin, BaseTestSiteSettingView):
     def setUp(self):
         self.default_site = Site.objects.get(is_default_site=True)
         self.other_site = Site.objects.create(
@@ -438,7 +617,61 @@ class TestMultiSite(BaseTestSiteSettingView):
         """Check that the switcher form exists in the page"""
         response = self.get()
         self.assertEqual(response.status_code, 200)
-        self.assertContains(response, 'id="settings-site-switch"')
+        soup = self.get_soup(response.content)
+        options = soup.select("form#settings-site-switch option")
+        self.assertEqual(len(options), 2)  # other site + default site
+        self.assertEqual("example.com", options[0].text.strip())
+        self.assertEqual("localhost [default]", options[1].text.strip())
+
+    def test_no_switcher_when_only_permission_for_one_site(self):
+        """
+        The switcher should not be displayed if the user only has permission to edit one site,
+        but a static label should be shown instead
+        """
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        response = self.get()
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, 'id="settings-site-switch"')
+        self.assertContains(response, "Site: localhost [default]", html=True)
+
+    def test_no_switcher_when_only_one_site_exists(self):
+        """
+        No switcher or label should be shown if only one site exists
+        """
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        self.other_site.delete()  # Remove the other site
+
+        response = self.get()
+        self.assertEqual(response.status_code, 200)
+        self.assertNotContains(response, 'id="settings-site-switch"')
+        self.assertNotContains(response, "Site: localhost [default]", html=True)
+
+    def test_switcher_when_permission_for_individual_sites(self):
+        """The switcher should only show the sites the user has permission to edit"""
+        user = self.login_only_admin()
+        self.grant_default_site_permission(user)
+        third_site = Site.objects.create(
+            hostname="third.example.com", root_page=Page.objects.get(pk=2)
+        )
+        GroupSitePermission.objects.create(
+            group=Group.objects.get(name="Site Owners"),
+            site=third_site,
+            permission=Permission.objects.get_by_natural_key(
+                app_label="tests",
+                model="testsitesetting",
+                codename="change_testsitesetting",
+            ),
+        )
+
+        response = self.get()
+        self.assertEqual(response.status_code, 200)
+        soup = self.get_soup(response.content)
+        options = soup.select("form#settings-site-switch option")
+        self.assertEqual(len(options), 2)  # default site + third site
+        self.assertEqual("localhost [default]", options[0].text.strip())
+        self.assertEqual("third.example.com", options[1].text.strip())
 
     def test_unknown_site(self):
         """Check that unknown sites throw a 404"""
@@ -514,3 +747,80 @@ class TestEditHandlers(TestCase):
         handler = get_setting_edit_handler(TabbedSiteSettings)
         self.assertIsInstance(handler, TabbedInterface)
         self.assertEqual(len(handler.children), 2)
+
+
+class TestPermissionConfiguration(WagtailTestUtils, TestCase):
+    def setUp(self):
+        self.login()
+
+        self.group = Group.objects.get(name="Editors")
+        self.default_site = Site.objects.get(is_default_site=True)
+        self.other_site = Site.objects.create(
+            hostname="example.com", root_page=Page.objects.get(pk=2)
+        )
+        self.permission = Permission.objects.get_by_natural_key(
+            app_label="tests",
+            model="testsitesetting",
+            codename="change_testsitesetting",
+        )
+        GroupSitePermission.objects.create(
+            group=self.group,
+            site=self.default_site,
+            permission=self.permission,
+        )
+
+    def test_get_permissions(self):
+        response = self.client.get(
+            reverse("wagtailusers_groups:edit", args=(self.group.id,)),
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Test site setting permissions")
+        soup = self.get_soup(response.content)
+        default_site_checkbox = soup.select_one(
+            f"[name='tests_testsitesetting_site_permissions-sites'][value='{self.default_site.pk}']"
+        )
+        self.assertTrue(default_site_checkbox.has_attr("checked"))
+        other_site_checkbox = soup.select_one(
+            f"[name='tests_testsitesetting_site_permissions-sites'][value='{self.other_site.pk}']"
+        )
+        self.assertFalse(other_site_checkbox.has_attr("checked"))
+
+    def test_set_permissions(self):
+        response = self.client.post(
+            reverse("wagtailusers_groups:edit", args=(self.group.id,)),
+            {
+                "name": "test group",
+                "permissions": [],
+                "page_permissions-TOTAL_FORMS": ["0"],
+                "page_permissions-MAX_NUM_FORMS": ["1000"],
+                "page_permissions-INITIAL_FORMS": ["0"],
+                "document_permissions-TOTAL_FORMS": ["0"],
+                "document_permissions-MAX_NUM_FORMS": ["1000"],
+                "document_permissions-INITIAL_FORMS": ["0"],
+                "image_permissions-TOTAL_FORMS": ["0"],
+                "image_permissions-MAX_NUM_FORMS": ["1000"],
+                "image_permissions-INITIAL_FORMS": ["0"],
+                "collection_permissions-TOTAL_FORMS": ["0"],
+                "collection_permissions-MAX_NUM_FORMS": ["1000"],
+                "collection_permissions-INITIAL_FORMS": ["0"],
+                "tests_testsitesetting_site_permissions-sites": [
+                    str(self.other_site.pk),
+                ],
+            },
+        )
+        self.assertRedirects(response, reverse("wagtailusers_groups:index"))
+
+        self.assertTrue(
+            GroupSitePermission.objects.filter(
+                group=self.group,
+                site=self.other_site,
+                permission=self.permission,
+            ).exists()
+        )
+        self.assertFalse(
+            GroupSitePermission.objects.filter(
+                group=self.group,
+                site=self.default_site,
+                permission=self.permission,
+            ).exists()
+        )

wagtail/contrib/settings/tests/site_specific/test_forms.py

@@ -16,7 +16,7 @@ class TestSiteSwitchFromSiteOrdering(TestCase):
             hostname="bravo.com", root_page=self.root_page, is_default_site=True
         )
         site_3 = Site.objects.create(hostname="alfa.com", root_page=self.root_page)
-        form = SiteSwitchForm(site_1, TestSiteSetting)
+        form = SiteSwitchForm(site_1, TestSiteSetting, sites=Site.objects.all())
         expected_choices = [
             (f"/admin/settings/tests/testsitesetting/{site_3.id}/", "alfa.com"),
             (

wagtail/contrib/settings/urls.py

@@ -14,4 +14,9 @@ urlpatterns = [
         views.EditView.as_view(),
         name="edit",
     ),
+    path(
+        "<slug:app_name>/<slug:model_name>/<int:pk>/preview/",
+        views.PreviewOnEdit.as_view(),
+        name="preview_on_edit",
+    ),
 ]

wagtail/contrib/settings/views.py

@@ -1,5 +1,6 @@
 from functools import lru_cache
 
+from django.core.exceptions import PermissionDenied
 from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
@@ -12,9 +13,10 @@ from wagtail.admin.panels import (
     ObjectList,
     extract_panel_definitions_from_model_class,
 )
+from wagtail.admin.ui.side_panels import ChecksSidePanel, PreviewSidePanel
 from wagtail.admin.views import generic
-from wagtail.models import Site
-from wagtail.permission_policies import ModelPermissionPolicy
+from wagtail.admin.views.generic import preview
+from wagtail.models import PreviewableMixin, Site
 
 from .forms import SiteSwitchForm
 from .models import BaseGenericSetting, BaseSiteSetting
@@ -54,20 +56,37 @@ def redirect_to_relevant_instance(request, app_name, model_name):
     if issubclass(model, BaseSiteSetting):
         # Redirect the user to the edit page for the current site
         # (or the current request does not correspond to a site, the first site in the list)
-        site_request = Site.find_for_request(request)
-        site = site_request or Site.objects.first()
+        site = Site.find_for_request(request)
+        permission_policy = model.get_permission_policy()
+        if not site or not permission_policy.user_has_permission_for_instance(
+            request.user, "change", site
+        ):
+            # Select the first site they can edit
+            site = permission_policy.sites_user_has_permission_for(
+                request.user, "change"
+            ).first()
+
         if not site:
-            messages.error(
-                request,
-                _("This setting could not be opened because there is no site defined."),
-            )
-            return redirect("wagtailadmin_home")
+            if Site.objects.exists():
+                # There are sites, but the user has no permission to edit any of them
+                raise PermissionDenied
+            else:
+                # No sites exist, so we can't redirect to a specific site
+                messages.error(
+                    request,
+                    _(
+                        "This setting could not be opened because there is no site defined."
+                    ),
+                )
+                return redirect("wagtailadmin_home")
+
         return redirect(
             "wagtailsettings:edit",
             app_name,
             model_name,
             site.pk,
         )
+
     elif issubclass(model, BaseGenericSetting):
         return redirect(
             "wagtailsettings:edit",
@@ -82,6 +101,7 @@ def redirect_to_relevant_instance(request, app_name, model_name):
 class EditView(generic.EditView):
     template_name = "wagtailsettings/edit.html"
     edit_url_name = "wagtailsettings:edit"
+    preview_url_name = "wagtailsettings:preview_on_edit"
     error_message = gettext_lazy("The setting could not be saved due to errors.")
     permission_required = "change"
 
@@ -89,7 +109,7 @@ class EditView(generic.EditView):
         self.app_name = app_name
         self.model_name = model_name
         self.model = get_model_from_url_params(app_name, model_name)
-        self.permission_policy = ModelPermissionPolicy(self.model)
+        self.permission_policy = self.model.get_permission_policy()
         self.pk = kwargs.get(self.pk_url_kwarg)
         super().setup(request, app_name, model_name, *args, **kwargs)
 
@@ -100,6 +120,12 @@ class EditView(generic.EditView):
         self.site = None
         if issubclass(self.model, BaseSiteSetting):
             self.site = get_object_or_404(Site, pk=self.pk)
+
+            if not self.permission_policy.user_has_permission_for_instance(
+                self.request.user, "change", self.site
+            ):
+                raise PermissionDenied
+
             return self.model.for_site(self.site)
         else:
             return get_object_or_404(self.model, pk=self.pk)
@@ -123,11 +149,22 @@ class EditView(generic.EditView):
         context = super().get_context_data(**kwargs)
 
         site_switcher = None
-        if self.site and Site.objects.count() > 1:
-            site_switcher = SiteSwitchForm(self.site, self.model)
-            context["media"] += site_switcher.media
+        site_for_header = (
+            None  # shown when multiple sites exist, but only one is editable
+        )
+
+        if issubclass(self.model, BaseSiteSetting):
+            sites = self.permission_policy.sites_user_has_permission_for(
+                self.request.user, "change"
+            )
+            if len(sites) > 1:
+                site_switcher = SiteSwitchForm(self.site, self.model, sites=sites)
+                context["media"] += site_switcher.media
+            elif Site.objects.count() > 1:
+                site_for_header = self.site
 
         context["site_switcher"] = site_switcher
+        context["site_for_header"] = site_for_header
         return context
 
     def get_success_url(self):
@@ -138,3 +175,42 @@ class EditView(generic.EditView):
             _("%(setting_type)s updated.")
             % {"setting_type": self.model._meta.verbose_name}
         )
+
+    def get_preview_url(self):
+        if isinstance(self.object, PreviewableMixin) and self.object.is_previewable():
+            return reverse(
+                self.preview_url_name,
+                args=(self.app_name, self.model_name, self.pk),
+            )
+
+    def get_side_panels(self):
+        side_panels = super().get_side_panels()
+        if preview_url := self.get_preview_url():
+            side_panels.append(
+                PreviewSidePanel(self.object, self.request, preview_url=preview_url)
+            )
+            side_panels.append(ChecksSidePanel(self.object, self.request))
+        return side_panels
+
+
+class PreviewOnEdit(preview.PreviewOnEdit):
+    def setup(self, request, app_name, model_name, *args, **kwargs):
+        self.app_name = app_name
+        self.model_name = model_name
+        self.model = get_model_from_url_params(app_name, model_name)
+        self.pk = kwargs.get("pk")
+        super().setup(request, app_name, model_name, *args, **kwargs)
+
+    def get_object(self, queryset=None):
+        self.site = None
+        if issubclass(self.model, BaseSiteSetting):
+            self.site = get_object_or_404(Site, pk=self.pk)
+            return self.model.for_site(self.site)
+        else:
+            return get_object_or_404(self.model, pk=self.pk)
+
+    def get_extra_request_attrs(self):
+        attrs = super().get_extra_request_attrs()
+        # Inject current instance into request so the context processor uses it
+        attrs[self.object.get_cache_attr_name()] = self.object
+        return attrs