def test_private_node_with_public_comment_level_non_contributor_cannot_comment(self):
""" Test non-contributors cannot comment on a private project
with comment_level == 'public' """
project = ProjectFactory(is_public=False, creator=self.user)
project.comment_level = "public"
project.save()
url = "/{}nodes/{}/comments/".format(API_BASE, project._id)
res = self.app.post_json_api(url, self.payload, auth=self.non_contributor.auth, expect_errors=True)
assert_equal(res.status_code, 403)
def test_public_node_non_contributor_commenter_cannot_update_own_comment_if_comment_level_private(self):
project = ProjectFactory(is_public=True, comment_level='public')
comment = CommentFactory(node=project, user=self.non_contributor)
project.comment_level = 'private'
project.save()
url = '/{}comments/{}/'.format(API_BASE, comment._id)
payload = self._set_up_payload(comment._id)
res = self.app.put_json_api(url, payload, auth=self.non_contributor.auth, expect_errors=True)
assert_equal(res.status_code, 403)
assert_equal(res.json['errors'][0]['detail'], 'You do not have permission to perform this action.')
def test_public_node_non_contributor_commenter_cannot_update_own_comment_if_comment_level_private(self):
project = ProjectFactory(is_public=True, comment_level='public')
comment = CommentFactory(node=project, user=self.non_contributor)
project.comment_level = 'private'
project.save()
url = '/{}comments/{}/'.format(API_BASE, comment._id)
payload = self._set_up_payload(comment._id)
res = self.app.put_json_api(url, payload, auth=self.non_contributor.auth, expect_errors=True)
assert_equal(res.status_code, 403)
assert_equal(res.json['errors'][0]['detail'], 'You do not have permission to perform this action.')
def test_public_node_non_contributor_commenter_cannot_update_own_comment_if_comment_level_private(self):
project = ProjectFactory(is_public=True, comment_level='public')
comment = CommentFactory(node=project, target=project, user=self.non_contributor)
project.comment_level = 'private'
project.save()
url = '/{}comments/{}/'.format(API_BASE, comment._id)
payload = {
'data': {
'id': comment._id,
'type': 'comments',
'attributes': {
'content': 'Updating this comment',
'deleted': False
}
}
}
res = self.app.put_json_api(url, payload, auth=self.non_contributor.auth, expect_errors=True)
assert_equal(res.status_code, 403)
assert_equal(res.json['errors'][0]['detail'], 'You do not have permission to perform this action.')
