Misago/misago/users/tests/test_rest_permissions.py

from django.urls import reverse

from ..models import Ban
from ..test import UserTestCase


class UnbannedOnlyTests(UserTestCase):
    def setUp(self):
        self.user = self.get_authenticated_user()

    def test_api_allows_guests(self):
        """policy allows guests"""
        response = self.client.post(
            reverse("misago:api:send-password-form"), data={"email": self.user.email}
        )
        self.assertEqual(response.status_code, 200)

    def test_api_allows_authenticated(self):
        """policy allows authenticated"""
        self.login_user(self.user)

        response = self.client.post(
            reverse("misago:api:send-password-form"), data={"email": self.user.email}
        )
        self.assertEqual(response.status_code, 200)

    def test_api_blocks_banned(self):
        """policy blocked banned ip"""
        Ban.objects.create(
            check_type=Ban.IP, banned_value="127.*", user_message="Ya got banned!"
        )

        response = self.client.post(
            reverse("misago:api:send-password-form"), data={"email": self.user.email}
        )
        self.assertEqual(response.status_code, 403)


class UnbannedAnonOnlyTests(UserTestCase):
    def setUp(self):
        self.user = self.get_authenticated_user()

    def test_api_allows_guests(self):
        """policy allows guests"""
        self.user.requires_activation = 1
        self.user.save()

        response = self.client.post(
            reverse("misago:api:send-activation"), data={"email": self.user.email}
        )
        self.assertEqual(response.status_code, 200)

    def test_api_allows_authenticated(self):
        """policy blocks authenticated"""
        self.login_user(self.user)

        response = self.client.post(
            reverse("misago:api:send-activation"), data={"email": self.user.email}
        )
        self.assertEqual(response.status_code, 403)

    def test_api_blocks_banned(self):
        """policy blocked banned ip"""
        Ban.objects.create(
            check_type=Ban.IP, banned_value="127.*", user_message="Ya got banned!"
        )

        response = self.client.post(
            reverse("misago:api:send-activation"), data={"email": self.user.email}
        )
        self.assertEqual(response.status_code, 403)