|
@@ -5,6 +5,7 @@ from django.utils import timezone
|
|
|
|
|
|
from misago.threads import testutils
|
|
|
from misago.threads.models import Post, Thread
|
|
|
+from misago.threads.test import patch_category_acl
|
|
|
|
|
|
from .test_threads_api import ThreadsApiTestCase
|
|
|
|
|
@@ -33,24 +34,22 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This action is not available to guests.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({'can_hide_posts': 1, 'can_hide_own_posts': 1})
|
|
|
def test_no_permission(self):
|
|
|
"""api validates permission to delete post"""
|
|
|
- self.override_acl({'can_hide_own_posts': 1, 'can_hide_posts': 1})
|
|
|
-
|
|
|
response = self.client.delete(self.api_link)
|
|
|
self.assertEqual(response.status_code, 403)
|
|
|
self.assertEqual(response.json(), {
|
|
|
"detail": "You can't delete posts in this category.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 1,
|
|
|
+ 'can_hide_own_posts': 2,
|
|
|
+ 'post_edit_time': 0,
|
|
|
+ })
|
|
|
def test_delete_other_user_post_no_permission(self):
|
|
|
"""api valdiates if user can delete other users posts"""
|
|
|
- self.override_acl({
|
|
|
- 'post_edit_time': 0,
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.post.poster = None
|
|
|
self.post.save()
|
|
|
|
|
@@ -60,14 +59,13 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "You can't delete other users posts in this category.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 1,
|
|
|
+ 'can_hide_own_posts': 2,
|
|
|
+ 'post_edit_time': 0,
|
|
|
+ })
|
|
|
def test_delete_protected_post_no_permission(self):
|
|
|
"""api validates if user can delete protected post"""
|
|
|
- self.override_acl({
|
|
|
- 'can_protect_posts': 0,
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.post.is_protected = True
|
|
|
self.post.save()
|
|
|
|
|
@@ -77,14 +75,13 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This post is protected. You can't delete it.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 1,
|
|
|
+ 'can_hide_own_posts': 2,
|
|
|
+ 'post_edit_time': 1,
|
|
|
+ })
|
|
|
def test_delete_protected_post_after_edit_time(self):
|
|
|
"""api validates if user can delete delete post after edit time"""
|
|
|
- self.override_acl({
|
|
|
- 'post_edit_time': 1,
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.post.posted_on = timezone.now() - timedelta(minutes=10)
|
|
|
self.post.save()
|
|
|
|
|
@@ -94,13 +91,14 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "You can't delete posts that are older than 1 minute.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 0,
|
|
|
+ 'can_hide_own_posts': 2,
|
|
|
+ 'post_edit_time': 0,
|
|
|
+ 'can_close_threads': False,
|
|
|
+ })
|
|
|
def test_delete_post_closed_thread_no_permission(self):
|
|
|
"""api valdiates if user can delete posts in closed threads"""
|
|
|
- self.override_acl({
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.thread.is_closed = True
|
|
|
self.thread.save()
|
|
|
|
|
@@ -110,13 +108,14 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This thread is closed. You can't delete posts in it.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 0,
|
|
|
+ 'can_hide_own_posts': 2,
|
|
|
+ 'post_edit_time': 0,
|
|
|
+ 'can_close_threads': False,
|
|
|
+ })
|
|
|
def test_delete_post_closed_category_no_permission(self):
|
|
|
"""api valdiates if user can delete posts in closed categories"""
|
|
|
- self.override_acl({
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.category.is_closed = True
|
|
|
self.category.save()
|
|
|
|
|
@@ -126,10 +125,9 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This category is closed. You can't delete posts in it.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({'can_hide_posts': 2, 'can_hide_own_posts': 2})
|
|
|
def test_delete_first_post(self):
|
|
|
"""api disallows first post deletion"""
|
|
|
- self.override_acl({'can_hide_own_posts': 2, 'can_hide_posts': 2})
|
|
|
-
|
|
|
api_link = reverse(
|
|
|
'misago:api:thread-post-detail',
|
|
|
kwargs={
|
|
@@ -144,10 +142,9 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "You can't delete thread's first post.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({'can_hide_posts': 2, 'can_hide_own_posts': 2})
|
|
|
def test_delete_best_answer(self):
|
|
|
"""api disallows best answer deletion"""
|
|
|
- self.override_acl({'can_hide_own_posts': 2, 'can_hide_posts': 2})
|
|
|
-
|
|
|
self.thread.set_best_answer(self.user, self.post)
|
|
|
self.thread.save()
|
|
|
|
|
@@ -157,14 +154,13 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
'detail': "You can't delete this post because its marked as best answer.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 0,
|
|
|
+ 'can_hide_own_posts': 2,
|
|
|
+ 'post_edit_time': 0
|
|
|
+ })
|
|
|
def test_delete_owned_post(self):
|
|
|
"""api deletes owned thread post"""
|
|
|
- self.override_acl({
|
|
|
- 'post_edit_time': 0,
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- })
|
|
|
-
|
|
|
response = self.client.delete(self.api_link)
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
|
@@ -174,10 +170,9 @@ class PostDeleteApiTests(ThreadsApiTestCase):
|
|
|
with self.assertRaises(Post.DoesNotExist):
|
|
|
self.thread.post_set.get(pk=self.post.pk)
|
|
|
|
|
|
+ @patch_category_acl({'can_hide_posts': 2, 'can_hide_own_posts': 0})
|
|
|
def test_delete_post(self):
|
|
|
"""api deletes thread post"""
|
|
|
- self.override_acl({'can_hide_own_posts': 0, 'can_hide_posts': 2})
|
|
|
-
|
|
|
response = self.client.delete(self.api_link)
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
|
@@ -212,27 +207,27 @@ class EventDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This action is not available to guests.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 2,
|
|
|
+ 'can_hide_own_posts': 0,
|
|
|
+ 'can_hide_events': 0,
|
|
|
+ })
|
|
|
def test_no_permission(self):
|
|
|
"""api validates permission to delete event"""
|
|
|
- self.override_acl({
|
|
|
- 'can_hide_own_posts': 2,
|
|
|
- 'can_hide_posts': 2,
|
|
|
- 'can_hide_events': 0,
|
|
|
- })
|
|
|
-
|
|
|
response = self.client.delete(self.api_link)
|
|
|
self.assertEqual(response.status_code, 403)
|
|
|
self.assertEqual(response.json(), {
|
|
|
"detail": "You can't delete events in this category.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 2,
|
|
|
+ 'can_hide_own_posts': 0,
|
|
|
+ 'can_hide_events': 2,
|
|
|
+ 'can_close_threads': False,
|
|
|
+ })
|
|
|
def test_delete_event_closed_thread_no_permission(self):
|
|
|
"""api valdiates if user can delete events in closed threads"""
|
|
|
- self.override_acl({
|
|
|
- 'can_hide_events': 2,
|
|
|
- 'can_close_threads': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.thread.is_closed = True
|
|
|
self.thread.save()
|
|
|
|
|
@@ -242,13 +237,13 @@ class EventDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This thread is closed. You can't delete events in it.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({
|
|
|
+ 'can_hide_posts': 2,
|
|
|
+ 'can_hide_events': 2,
|
|
|
+ 'can_close_threads': False,
|
|
|
+ })
|
|
|
def test_delete_event_closed_category_no_permission(self):
|
|
|
"""api valdiates if user can delete events in closed categories"""
|
|
|
- self.override_acl({
|
|
|
- 'can_hide_events': 2,
|
|
|
- 'can_close_threads': 0,
|
|
|
- })
|
|
|
-
|
|
|
self.category.is_closed = True
|
|
|
self.category.save()
|
|
|
|
|
@@ -258,14 +253,9 @@ class EventDeleteApiTests(ThreadsApiTestCase):
|
|
|
"detail": "This category is closed. You can't delete events in it.",
|
|
|
})
|
|
|
|
|
|
+ @patch_category_acl({'can_hide_posts': 0, 'can_hide_events': 2})
|
|
|
def test_delete_event(self):
|
|
|
"""api differs posts from events"""
|
|
|
- self.override_acl({
|
|
|
- 'can_hide_own_posts': 0,
|
|
|
- 'can_hide_posts': 0,
|
|
|
- 'can_hide_events': 2,
|
|
|
- })
|
|
|
-
|
|
|
response = self.client.delete(self.api_link)
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|