Removed url, acl and api keys from serialized items

misago/api/testutils.py

@@ -17,4 +17,4 @@ class ApiTestsMixin(object):
     def assertNotInApiResults(self, response, item):
         self.assertEqual(response.status_code, 200)
         results_ids = [r['id'] for r in response.json()['results']]
-        self.assertNotIn(item.id, results_ids)
+        self.assertNotIn(item.id, results_ids)

misago/threads/serializers/poll.py

@@ -13,14 +13,13 @@ MAX_POLL_OPTIONS = 16
 
 class PollSerializer(serializers.ModelSerializer):
     choices = serializers.SerializerMethodField()
+    poster = serializers.SerializerMethodField()
 
     class Meta:
         model = Poll
         fields = [
             'id',
             'poster',
-            'poster_name',
-            'poster_slug',
             'posted_on',
             'length',
             'question',
@@ -34,6 +33,13 @@ class PollSerializer(serializers.ModelSerializer):
     def get_choices(self, obj):
         return obj.choices
 
+    def get_poster(self, obj):
+        return {
+            'id': obj.poster_id,
+            'username': obj.poster_name,
+            'slug': obj.poster_slug
+        }
+
 
 class EditPollSerializer(serializers.ModelSerializer):
     length = serializers.IntegerField(required=True, min_value=0, max_value=180)

misago/threads/tests/test_privatethreads_api.py

@@ -132,8 +132,8 @@ class PrivateThreadRetrieveApiTests(PrivateThreadsTestCase):
                 {
                     'id': self.user.id,
                     'username': self.user.username,
+                    'slug': self.user.slug,
                     'avatars': self.user.avatars,
-                    'url': self.user.get_absolute_url(),
                     'is_owner': True,
                 },
             ]
@@ -153,8 +153,8 @@ class PrivateThreadRetrieveApiTests(PrivateThreadsTestCase):
                 {
                     'id': self.user.id,
                     'username': self.user.username,
+                    'slug': self.user.slug,
                     'avatars': self.user.avatars,
-                    'url': self.user.get_absolute_url(),
                     'is_owner': False,
                 },
             ]

misago/threads/tests/test_thread_pollcreate_api.py

@@ -1,6 +1,5 @@
 from django.urls import reverse
 
-from misago.acl import add_acl
 from misago.core.utils import serialize_datetime
 from misago.threads.models import Poll, Thread
 from misago.threads.serializers.poll import MAX_POLL_OPTIONS
@@ -319,8 +318,7 @@ class ThreadPollCreateTests(ThreadPollApiTestCase):
         self.maxDiff = None
 
         poll = Poll.objects.all()[0]
-        add_acl(self.user, poll)
-
+        
         expected_choices = []
         for choice in poll.choices:
             expected_choices.append(choice.copy())
@@ -328,7 +326,11 @@ class ThreadPollCreateTests(ThreadPollApiTestCase):
 
         self.assertEqual(response.json(), {
             'id': poll.id,
-            'poster_name': self.user.username,
+            'poster': {
+                'id': self.user.id,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
             'posted_on': serialize_datetime(poll.posted_on),
             'length': 40,
             'question': "Select two best colors",
@@ -336,15 +338,7 @@ class ThreadPollCreateTests(ThreadPollApiTestCase):
             'allow_revotes': True,
             'votes': 0,
             'is_public': True,
-            'acl': poll.acl,
             'choices': expected_choices,
-            'api': {
-                'index': poll.get_api_url(),
-                'votes': poll.get_votes_api_url(),
-            },
-            'url': {
-                'poster': self.user.get_absolute_url(),
-            },
         })
         
         self.assertEqual(len(poll.choices), 3)

misago/threads/tests/test_thread_polledit_api.py

@@ -3,7 +3,6 @@ from datetime import timedelta
 from django.urls import reverse
 from django.utils import timezone
 
-from misago.acl import add_acl
 from misago.core.utils import serialize_datetime
 from misago.threads.models import Poll
 from misago.threads.serializers.poll import MAX_POLL_OPTIONS
@@ -356,28 +355,31 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
         self.assertEqual(response.status_code, 200)
 
         poll = Poll.objects.all()[0]
-        add_acl(self.user, poll)
 
-        response_json = response.json()
-
-        self.assertEqual(response_json['poster_name'], self.user.username)
-        self.assertEqual(response_json['length'], 40)
-        self.assertEqual(response_json['question'], "Select two best colors")
-        self.assertEqual(response_json['allowed_choices'], 2)
-        self.assertTrue(response_json['allow_revotes'])
-
-        # you can't change poll's type after its posted
-        self.assertFalse(response_json['is_public'])
+        expected_choices = []
+        for choice in poll.choices:
+            self.assertIn(choice['label'], ["Red", "Green", "Blue"])
+            expected_choices.append(choice.copy())
+            expected_choices[-1]['selected'] = False
 
-        # choices were updated
-        self.assertEqual(len(response_json['choices']), 3)
-        self.assertEqual(len(set([c['hash'] for c in response_json['choices']])), 3)
-        self.assertEqual([c['label'] for c in response_json['choices']], ['Red', 'Green', 'Blue'])
-        self.assertEqual([c['votes'] for c in response_json['choices']], [0, 0, 0])
-        self.assertEqual([c['selected'] for c in response_json['choices']], [False, False, False])
+        self.assertEqual(response.json(), {
+            'id': poll.id,
+            'poster': {
+                'id': self.user.id,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
+            'posted_on': serialize_datetime(poll.posted_on),
+            'length': 40,
+            'question': "Select two best colors",
+            'allowed_choices': 2,
+            'allow_revotes': True,
+            'votes': 0,
+            'is_public': False,
+            'choices': expected_choices,
+        })
 
         # votes were removed
-        self.assertEqual(response_json['votes'], 0)
         self.assertEqual(self.poll.pollvote_set.count(), 0)
 
     def test_poll_current_choices_edited(self):
@@ -417,11 +419,14 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
         self.assertEqual(response.status_code, 200)
 
         poll = Poll.objects.all()[0]
-        add_acl(self.user, poll)
 
         self.assertEqual(response.json(), {
             'id': poll.id,
-            'poster_name': self.user.username,
+            'poster': {
+                'id': self.user.id,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
             'posted_on': serialize_datetime(poll.posted_on),
             'length': 40,
             'question': "Select two best colors",
@@ -429,7 +434,6 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
             'allow_revotes': True,
             'votes': 4,
             'is_public': False,
-            'acl': poll.acl,
             'choices': [
                 {
                     'hash': 'aaaaaaaaaaaa',
@@ -456,13 +460,6 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
                     'selected': True,
                 },
             ],
-            'api': {
-                'index': poll.get_api_url(),
-                'votes': poll.get_votes_api_url(),
-            },
-            'url': {
-                'poster': self.user.get_absolute_url(),
-            },
         })
 
         # no votes were removed
@@ -500,11 +497,14 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
         self.assertEqual(response.status_code, 200)
 
         poll = Poll.objects.all()[0]
-        add_acl(self.user, poll)
 
         self.assertEqual(response.json(), {
             'id': poll.id,
-            'poster_name': self.user.username,
+            'poster': {
+                'id': self.user.id,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
             'posted_on': serialize_datetime(poll.posted_on),
             'length': 40,
             'question': "Select two best colors",
@@ -512,7 +512,6 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
             'allow_revotes': True,
             'votes': 1,
             'is_public': False,
-            'acl': poll.acl,
             'choices': [
                 {
                     'hash': 'aaaaaaaaaaaa',
@@ -533,13 +532,6 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
                     'selected': False,
                 },
             ],
-            'api': {
-                'index': poll.get_api_url(),
-                'votes': poll.get_votes_api_url(),
-            },
-            'url': {
-                'poster': self.user.get_absolute_url(),
-            },
         })
 
         # no votes were removed
@@ -578,7 +570,6 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
         self.assertEqual(response.status_code, 200)
 
         poll = Poll.objects.all()[0]
-        add_acl(self.user, poll)
 
         expected_choices = []
         for choice in poll.choices:
@@ -588,7 +579,11 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
 
         self.assertEqual(response.json(), {
             'id': poll.id,
-            'poster_name': self.user.username,
+            'poster': {
+                'id': None,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
             'posted_on': serialize_datetime(poll.posted_on),
             'length': 40,
             'question': "Select two best colors",
@@ -596,15 +591,7 @@ class ThreadPollEditTests(ThreadPollApiTestCase):
             'allow_revotes': True,
             'votes': 0,
             'is_public': False,
-            'acl': poll.acl,
             'choices': expected_choices,
-            'api': {
-                'index': poll.get_api_url(),
-                'votes': poll.get_votes_api_url(),
-            },
-            'url': {
-                'poster': None,
-            },
         })
         
         # votes were removed

misago/threads/tests/test_thread_pollvotes_api.py

@@ -4,7 +4,6 @@ from django.contrib.auth import get_user_model
 from django.urls import reverse
 from django.utils import timezone
 
-from misago.acl import add_acl
 from misago.core.utils import serialize_datetime
 from misago.threads.models import Poll
 
@@ -35,15 +34,11 @@ class ThreadGetVotesTests(ThreadPollApiTestCase):
         choices_votes = {choice['hash']: [] for choice in self.poll.choices}
         queryset = self.poll.pollvote_set.order_by('-id').select_related()
         for vote in queryset:
-            if vote.voter:
-                url = vote.voter.get_absolute_url()
-            else:
-                url = None
-
             choices_votes[vote.choice_hash].append({
+                'id': vote.voter_id,
                 'username': vote.voter_name,
+                'slug': vote.voter_slug,
                 'voted_on': serialize_datetime(vote.voted_on),
-                'url': url
             })
         return choices_votes
 
@@ -432,14 +427,15 @@ class ThreadPostVotesTests(ThreadPollApiTestCase):
         """api handles first vote in poll"""
         self.delete_user_votes()
 
-        add_acl(self.user, self.poll)
-        self.poll.acl['can_vote'] = False
-
         response = self.post(self.api_link, data=['aaaaaaaaaaaa', 'bbbbbbbbbbbb'])
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.json(), {
             'id': self.poll.id,
-            'poster_name': self.user.username,
+            'poster': {
+                'id': self.user.id,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
             'posted_on': serialize_datetime(self.poll.posted_on),
             'length': 0,
             'question': "Lorem ipsum dolor met?",
@@ -447,7 +443,6 @@ class ThreadPostVotesTests(ThreadPollApiTestCase):
             'allow_revotes': False,
             'votes': 4,
             'is_public': False,
-            'acl': self.poll.acl,
             'choices': [
                 {
                     'hash': 'aaaaaaaaaaaa',
@@ -474,13 +469,6 @@ class ThreadPostVotesTests(ThreadPollApiTestCase):
                     'votes': 0
                 },
             ],
-            'api': {
-                'index': self.poll.get_api_url(),
-                'votes': self.poll.get_votes_api_url(),
-            },
-            'url': {
-                'poster': self.user.get_absolute_url(),
-            },
         })
 
         # validate state change
@@ -523,13 +511,15 @@ class ThreadPostVotesTests(ThreadPollApiTestCase):
         self.poll.allow_revotes = True
         self.poll.save()
 
-        add_acl(self.user, self.poll)
-
         response = self.post(self.api_link, data=['aaaaaaaaaaaa', 'bbbbbbbbbbbb'])
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.json(), {
             'id': self.poll.id,
-            'poster_name': self.user.username,
+            'poster': {
+                'id': self.user.id,
+                'username': self.user.username,
+                'slug': self.user.slug,
+            },
             'posted_on': serialize_datetime(self.poll.posted_on),
             'length': 0,
             'question': "Lorem ipsum dolor met?",
@@ -537,7 +527,6 @@ class ThreadPostVotesTests(ThreadPollApiTestCase):
             'allow_revotes': True,
             'votes': 4,
             'is_public': False,
-            'acl': self.poll.acl,
             'choices': [
                 {
                     'hash': 'aaaaaaaaaaaa',
@@ -564,13 +553,6 @@ class ThreadPostVotesTests(ThreadPollApiTestCase):
                     'votes': 0
                 },
             ],
-            'api': {
-                'index': self.poll.get_api_url(),
-                'votes': self.poll.get_votes_api_url(),
-            },
-            'url': {
-                'poster': self.user.get_absolute_url(),
-            },
         })
 
         # validate state change

misago/threads/tests/test_thread_postlikes_api.py

@@ -60,16 +60,16 @@ class ThreadPostLikesApiTestCase(ThreadsApiTestCase):
                     'liked_on': serialize_datetime(other_like.liked_on),
                     'liker_id': self.user.id,
                     'username': self.user.username,
+                    'slug': self.user.slug,
                     'avatars': self.user.avatars,
-                    'url': self.user.get_absolute_url(),
                 },
                 {
                     'id': like.id,
                     'liked_on': serialize_datetime(like.liked_on),
                     'liker_id': self.user.id,
                     'username': self.user.username,
+                    'slug': self.user.slug,
                     'avatars': self.user.avatars,
-                    'url': self.user.get_absolute_url(),
                 },
             ]
         )
@@ -90,16 +90,16 @@ class ThreadPostLikesApiTestCase(ThreadsApiTestCase):
                     'liked_on': serialize_datetime(other_like.liked_on),
                     'liker_id': None,
                     'username': self.user.username,
+                    'slug': self.user.slug,
                     'avatars': None,
-                    'url': None,
                 },
                 {
                     'id': like.id,
                     'liked_on': serialize_datetime(like.liked_on),
                     'liker_id': None,
                     'username': self.user.username,
+                    'slug': self.user.slug,
                     'avatars': None,
-                    'url': None,
                 },
             ]
         )

misago/threads/tests/test_threads_api.py

@@ -149,22 +149,20 @@ class ThreadRetrieveApiTests(ThreadsApiTestCase):
             response, hidden_post.parsed
         )  # hidden post's body is visible with permission
 
-        self.override_acl({'can_approve_content': 0})
-
         # unapproved posts shouldn't show at all
         unapproved_post = testutils.reply_thread(
             self.thread,
             is_unapproved=True,
         )
 
+        self.override_acl({'can_approve_content': 0})
         response = self.client.get(self.tested_links[1])
         self.assertNotContains(response, unapproved_post.get_absolute_url())
 
         # add permission to see unapproved posts
         self.override_acl({'can_approve_content': 1})
-
         response = self.client.get(self.tested_links[1])
-        self.assertContains(response, unapproved_post.get_absolute_url())
+        self.assertContains(response, unapproved_post.parsed)
 
     def test_api_validates_has_unapproved_posts_visibility(self):
         """api checks acl before exposing unapproved flag"""