Misago/misago/users/tests/test_rest_permissions.py

from django.urls import reverse

from misago.users.models import Ban
from misago.users.testutils import UserTestCase


class UnbannedOnlyTests(UserTestCase):
    def setUp(self):
        self.user = self.get_authenticated_user()

    def test_api_allows_guests(self):
        """policy allows guests"""
        response = self.client.post(
            reverse('misago:api:send-password-form'),
            data={
                'email': self.user.email,
            },
        )
        self.assertEqual(response.status_code, 200)

    def test_api_allows_authenticated(self):
        """policy allows authenticated"""
        self.login_user(self.user)

        response = self.client.post(
            reverse('misago:api:send-password-form'),
            data={
                'email': self.user.email,
            },
        )
        self.assertEqual(response.status_code, 200)

    def test_api_blocks_banned(self):
        """policy blocked banned ip"""
        Ban.objects.create(
            check_type=Ban.IP,
            banned_value='127.*',
            user_message='Ya got banned!',
        )

        response = self.client.post(
            reverse('misago:api:send-password-form'),
            data={
                'email': self.user.email,
            },
        )
        self.assertEqual(response.status_code, 403)


class UnbannedAnonOnlyTests(UserTestCase):
    def setUp(self):
        self.user = self.get_authenticated_user()

    def test_api_allows_guests(self):
        """policy allows guests"""
        self.user.requires_activation = 1
        self.user.save()

        response = self.client.post(
            reverse('misago:api:send-activation'),
            data={
                'email': self.user.email,
            },
        )
        self.assertEqual(response.status_code, 200)

    def test_api_allows_authenticated(self):
        """policy blocks authenticated"""
        self.login_user(self.user)

        response = self.client.post(
            reverse('misago:api:send-activation'),
            data={
                'email': self.user.email,
            },
        )
        self.assertEqual(response.status_code, 403)

    def test_api_blocks_banned(self):
        """policy blocked banned ip"""
        Ban.objects.create(
            check_type=Ban.IP,
            banned_value='127.*',
            user_message='Ya got banned!',
        )

        response = self.client.post(
            reverse('misago:api:send-activation'),
            data={
                'email': self.user.email,
            },
        )
        self.assertEqual(response.status_code, 403)