def test_get_statements_matching_action(self): cooks = Group.objects.create(name="cooks") user = User.objects.create(id=5) user.groups.add(cooks) statements = [ { "principal": ["id:5"], "action": ["create"] }, { "principal": ["group:dev"], "action": ["delete"] }, { "principal": ["group:cooks"], "action": ["do_something"] }, { "principal": ["*"], "action": ["*"] }, { "principal": ["id:79"], "action": ["vote"] }, ] policy = AccessPolicy() result = policy._get_statements_matching_action("delete", statements) self.assertEqual(len(result), 2) self.assertEqual(result[0]["action"], ["delete"]) self.assertEqual(result[1]["action"], ["*"])
def test_get_statements_matching_action_when_method_safe(self): cooks = Group.objects.create(name="cooks") user = User.objects.create(id=5) user.groups.add(cooks) statements = [ { "principal": ["*"], "action": ["list"] }, { "principal": ["id:5"], "action": ["*"] }, { "principal": ["group:cooks"], "action": ["<safe_methods>"] }, { "principal": ["group:devs"], "action": ["destroy"] }, ] policy = AccessPolicy() result = policy._get_statements_matching_action( FakeRequest(user, method="GET"), "list", statements) self.assertEqual(len(result), 3) self.assertEqual(result[0]["principal"], ["*"]) self.assertEqual(result[1]["principal"], ["id:5"]) self.assertEqual(result[2]["principal"], ["group:cooks"])
def test_get_statements_matching_action_when_using_http_method_placeholder( self): cooks = Group.objects.create(name="cooks") user = User.objects.create(id=5) user.groups.add(cooks) statements = [ { "principal": ["*"], "action": ["create"] }, { "principal": ["group:cooks"], "action": ["<method:post>"] }, { "principal": ["group:devs"], "action": ["destroy"] }, ] policy = AccessPolicy() result = policy._get_statements_matching_action( FakeRequest(user, method="POST"), "an action that won't match", statements) self.assertEqual(len(result), 1) self.assertEqual(result[0]["principal"], ["group:cooks"])
def test_get_statements_matching_action_when_method_unsafe(self): cooks = Group.objects.create(name="cooks") user = User.objects.create(id=5) user.groups.add(cooks) statements = [ { "principal": ["id:5"], "action": ["create"] }, { "principal": ["group:dev"], "action": ["destroy"] }, { "principal": ["group:cooks"], "action": ["do_something"] }, { "principal": ["*"], "action": ["*"] }, { "principal": ["id:79"], "action": ["vote"] }, { "principal": ["id:900"], "action": ["<safe_methods>"] }, ] policy = AccessPolicy() result = policy._get_statements_matching_action( FakeRequest(user, method="DELETE"), "destroy", statements) self.assertEqual(len(result), 2) self.assertEqual(result[0]["action"], ["destroy"]) self.assertEqual(result[1]["action"], ["*"])