test private thread visibility

misago/threads/tests/test_privatethread_view.py

@@ -1,7 +1,77 @@
 from misago.acl.testutils import override_acl
-from misago.categories.models import Category
+
+from .. import testutils
+from ..models import ThreadParticipant
 from .test_privatethreads import PrivateThreadsTestCase
 
 
 class PrivateThreadViewTests(PrivateThreadsTestCase):
-    pass
+    def setUp(self):
+        super(PrivateThreadViewTests, self).setUp()
+
+        self.thread = testutils.post_thread(self.category, poster=self.user)
+        self.thread_url = self.thread.get_absolute_url()
+
+    def test_anonymous(self):
+        """anonymous user can't see private thread"""
+        self.logout_user()
+
+        response = self.client.get(self.thread_url)
+        self.assertContains(response, "sign in to use private threads", status_code=403)
+
+    def test_no_permission(self):
+        """user needs to have permission to see private thread"""
+        override_acl(self.user, {
+            'can_use_private_threads': 0
+        })
+
+        response = self.client.get(self.thread_url)
+        self.assertContains(response, "t use private threads", status_code=403)
+
+    def test_no_participant(self):
+        """user cant see thread he isn't part of"""
+        response = self.client.get(self.thread_url)
+        self.assertEqual(response.status_code, 404)
+
+    def test_mod_not_reported(self):
+        """moderator can't see private thread that has no reports"""
+        override_acl(self.user, {
+            'can_moderate_private_threads': 1
+        })
+
+        response = self.client.get(self.thread_url)
+        self.assertEqual(response.status_code, 404)
+
+    def test_reported_not_mod(self):
+        """non-mod can't see private thread that has reported posts"""
+        self.thread.has_reported_posts = True
+        self.thread.save()
+
+        response = self.client.get(self.thread_url)
+        self.assertEqual(response.status_code, 404)
+
+    def test_can_see_owner(self):
+        """user can see thread he is owner of"""
+        ThreadParticipant.objects.set_owner(self.thread, self.user)
+
+        response = self.client.get(self.thread_url)
+        self.assertContains(response, self.thread.title)
+
+    def test_can_see_participant(self):
+        """user can see thread he is participant of"""
+        ThreadParticipant.objects.add_participants(self.thread, [self.user])
+
+        response = self.client.get(self.thread_url)
+        self.assertContains(response, self.thread.title)
+
+    def test_mod_can_see_reported(self):
+        """moderator can see private thread that has reports"""
+        override_acl(self.user, {
+            'can_moderate_private_threads': 1
+        })
+
+        self.thread.has_reported_posts = True
+        self.thread.save()
+
+        response = self.client.get(self.thread_url)
+        self.assertContains(response, self.thread.title)

misago/threads/tests/test_privatethreads.py

@@ -6,7 +6,6 @@ from misago.users.testutils import AuthenticatedUserTestCase
 class PrivateThreadsTestCase(AuthenticatedUserTestCase):
     def setUp(self):
         super(PrivateThreadsTestCase, self).setUp()
-
         self.category = Category.objects.private_threads()
 
         override_acl(self.user, {

misago/threads/viewmodels/thread.py

@@ -9,7 +9,7 @@ from misago.readtracker.threadstracker import make_read_aware
 
 from ..models import Poll, Thread
 from ..participants import make_participants_aware
-from ..permissions.privatethreads import allow_see_private_thread
+from ..permissions.privatethreads import allow_use_private_threads, allow_see_private_thread
 from ..permissions.threads import allow_see_thread
 from ..serializers import ThreadSerializer
 from ..subscriptions import make_subscription_aware
@@ -117,6 +117,8 @@ class ForumThread(ViewModel):
 
 class PrivateThread(ViewModel):
     def get_thread(self, request, pk, slug=None, select_for_update=False):
+        allow_use_private_threads(request.user)
+
         if select_for_update:
             queryset = Thread.objects.select_for_update()
         else: