def test_document_update_status_check(self, document_type, from_status,
expected_status):
"""Move Assessment from '{1}' to '{2}' update document of type {0}"""
with factories.single_commit():
assessment = factories.AssessmentFactory(status=from_status)
document = factories.DocumentFactory(document_type=document_type,
title='google.com',
link='google.com')
factories.RelationshipFactory(destination=assessment, source=document)
assessment_id = assessment.id
response = self.api.modify_object(document, {
'title': 'New document',
'link': 'New document',
})
assessment = self.refresh_object(assessment, assessment_id)
self.assert200(response)
self.assertEqual(expected_status, assessment.status)
def test_filter_by_dt_field(self, field, aliases):
"""Control Snapshots are filtered by datetime fields"""
program = factories.ProgramFactory()
control = factories.ControlFactory()
datetime_value = getattr(control, field)
factories.RelationshipFactory(source=program, destination=control)
self._create_audit(program=program, title="some title")
for date_string in self.generate_date_strings(datetime_value):
for alias in aliases:
query_dict = self._make_snapshot_query_dict(
"Control", expression=[alias, "=", date_string])
filtered_controls = self._get_first_result_set(
query_dict, "Snapshot")
self.assertEqual(
filtered_controls["count"], 1,
"empty results for alias {} and value {}".format(
alias, date_string))
def test_delete_audit_asmnt(self):
"""Check inability to delete audit in relation with assessment."""
with factories.single_commit():
audit = factories.AuditFactory()
assessment = factories.AssessmentFactory(audit=audit)
factories.RelationshipFactory(
source=audit,
destination=assessment,
)
response = self.api.delete(audit)
self.assertStatus(response, 409)
self.assertEqual(
response.json["message"],
"The audit cannot be deleted due to mapped assessment(s) to this "
"audit. Please delete assessment(s) mapped to this audit first "
"before deleting the audit.",
)
def test_mapping_issue_not_change_status(self, from_status):
"""Assessment '{0}' NOT changed when Map Issue."""
with factories.single_commit():
audit = factories.AuditFactory()
assessment = factories.AssessmentFactory(
audit=audit, status=from_status, assessment_type='Contract')
factories.RelationshipFactory(source=audit, destination=assessment)
issue = factories.IssueFactory(title='test Issue')
response, _ = self.objgen.generate_relationship(
source=assessment,
destination=issue,
context=None,
)
assessment = self.refresh_object(assessment)
self.assertStatus(response, 201)
self.assertEqual(from_status, assessment.status)
def test_remove_snapshot(self):
"""Test remove snapshot action."""
assessment, snapshot = _create_snapshot()
rel_id = factories.RelationshipFactory(source=assessment,
destination=snapshot).id
response = self.api.put(
assessment, {
"actions": {
"remove_related": [{
"id": snapshot.id,
"type": "Snapshot",
}]
}
})
self.assert200(response)
snapshot = all_models.Relationship.query.get(rel_id)
self.assertIsNone(snapshot)
def test_put_status_evidence(self, kind, from_status, evidence_from_status,
evidence_to_status):
"""Test put evidence status and assessment status changed"""
expected_status = models.Assessment.PROGRESS_STATE
with factories.single_commit():
assessment = factories.AssessmentFactory(status=from_status)
assessment_id = assessment.id
evidence = factories.EvidenceFactory(kind=kind,
status=evidence_from_status)
evidence_id = evidence.id
factories.RelationshipFactory(destination=assessment,
source=evidence)
self.api.put(evidence, {'status': evidence_to_status})
assessment = self.refresh_object(assessment, assessment_id)
evidence = self.refresh_object(evidence, evidence_id)
self.assertEqual(assessment.status, expected_status)
self.assertEqual(evidence.status, evidence_to_status)
def test_export_assesments_without_map_control(self):
"""Test export assesment without related control instance"""
audit = factories.AuditFactory()
assessment = factories.AssessmentFactory(audit=audit)
factories.RelationshipFactory(source=audit, destination=assessment)
control = factories.ControlFactory()
revision = all_models.Revision.query.filter(
all_models.Revision.resource_id == control.id,
all_models.Revision.resource_type ==
control.__class__.__name__).order_by(
all_models.Revision.id.desc()).first()
factories.SnapshotFactory(parent=audit,
child_id=control.id,
child_type=control.__class__.__name__,
revision_id=revision.id)
db.session.commit()
self.assertColumnExportedValue("", assessment, "map:control versions")
def test_get_parent_obj_audit_type(self):
"""Test parent object audit"""
audit = factories.AuditFactory()
evidence = factories.EvidenceFactory(
title='Simple title',
kind=all_models.Evidence.FILE,
link='some_url.com',
description='mega description',
source_gdrive_id='qwerqwer',
parent_obj={
'id': audit.id,
'type': 'Audit'
}
)
factories.RelationshipFactory(source=audit, destination=evidence)
rel_asses = evidence.related_objects(_types=[audit.type])
self.assertEqual(audit, rel_asses.pop())
def setup_assessments(self, asmnt_count, issue_id=None, enabled=True):
"""Create Audit with couple of Assessments and linked IssueTrackerIssues.
Args:
asmnt_count: Count of Assessments in Audit.
Returns:
Tuple with Audit id and list of Assessment ids.
"""
with factories.single_commit():
audit = factories.AuditFactory()
factories.AccessControlListFactory(
object=audit,
ac_role=role.get_ac_roles_for(audit.type)["Audit Captains"],
person=self.role_people["Audit Captains"],
)
factories.IssueTrackerIssueFactory(
enabled=enabled,
issue_tracked_obj=audit,
issue_id=issue_id,
issue_type="BUG",
component_id=12345,
hotlist_id=12345,
issue_priority="P2",
issue_severity="S2",
)
assessment_ids = []
for _ in range(asmnt_count):
asmnt = factories.AssessmentFactory(audit=audit)
factories.RelationshipFactory(source=audit, destination=asmnt)
for role_name in ["Creators", "Assignees", "Verifiers"]:
factories.AccessControlListFactory(
object=asmnt,
ac_role=role.get_ac_roles_for(asmnt.type)[role_name],
person=self.role_people[role_name],
)
factories.IssueTrackerIssueFactory(
enabled=enabled,
issue_tracked_obj=asmnt,
issue_id=issue_id,
title=None,
)
assessment_ids.append(asmnt.id)
return audit.id, assessment_ids
def test_cycle_task_objects(self):
"""Test cycle task and various objects."""
with freeze_time("2017-03-07"):
workflow = wf_factories.WorkflowFactory()
task_group = wf_factories.TaskGroupFactory(workflow=workflow)
wf_factories.TaskGroupTaskFactory(task_group=task_group)
wf_factories.TaskGroupTaskFactory(task_group=task_group)
policy = factories.PolicyFactory()
policy_slug = policy.slug
factories.RelationshipFactory(source=task_group, destination=policy)
self.wf_generator.generate_cycle(workflow)
self.wf_generator.activate_workflow(workflow)
data = [
{
"object_name": "CycleTaskGroupObjectTask",
"filters": {
"expression": {
"op": {"name": "relevant"},
"object_name": "Policy",
"slugs": [policy_slug],
},
},
"fields": "all",
}, {
"object_name": "Policy",
"filters": {
"expression": {
"op": {"name": "relevant"},
"object_name": "__previous__",
"ids": ["0"],
},
},
"fields": ["slug", "title"],
},
]
response = self.export_csv(data)
self.assert200(response)
response_data = response.data
self.assertEqual(2, response_data.count("CYCLETASK-"))
self.assertEqual(3, response_data.count(policy_slug))
def test_put_acl_null_evidence(self, kind, status):
"""Test put acl null of evidence data assessment status changed"""
expected_status = models.Assessment.PROGRESS_STATE
with factories.single_commit():
assessment = factories.AssessmentFactory(status=status)
assessment_id = assessment.id
evidence = factories.EvidenceFactory(kind=kind)
factories.RelationshipFactory(destination=assessment,
source=evidence)
person = factories.PersonFactory()
role = models.AccessControlRole.query.filter(
models.AccessControlRole.object_type == "Evidence",
models.AccessControlRole.name == 'Admin',
).one()
evidence.add_person_with_role(person, role)
self.api.put(evidence, {"access_control_list": []})
assessment = self.refresh_object(assessment, assessment_id)
self.assertEqual(assessment.status, expected_status)
def _create_snapshot():
"""Create snapshot for test"""
audit = factories.AuditFactory()
assessment = factories.AssessmentFactory(audit=audit)
context = factories.ContextFactory(related_object=assessment)
assessment.context = context
factories.RelationshipFactory(source=audit, destination=assessment)
control = factories.ControlFactory(description='control-9')
revision = all_models.Revision.query.filter(
all_models.Revision.resource_id == control.id,
all_models.Revision.resource_type ==
control.__class__.__name__).order_by(
all_models.Revision.id.desc()).first()
snapshot = factories.SnapshotFactory(parent=audit,
child_id=control.id,
child_type=control.__class__.__name__,
revision_id=revision.id)
return assessment, snapshot
def test_unmap_document_as_src(self):
"""Test unmapping of documents set as relationship source."""
assessment = factories.AssessmentFactory()
document = factories.DocumentFactory()
rel_id = factories.RelationshipFactory(destination=assessment,
source=document).id
response = self.api.put(
assessment, {
"actions": {
"remove_related": [{
"id": document.id,
"type": "Document",
}]
}
})
self.assert200(response)
relationship = all_models.Relationship.query.get(rel_id)
self.assertIsNone(relationship)
def test_create_audit_with_control(self):
"""Test import of new Audit with mapped Control Snapshot."""
with factories.single_commit():
program = factories.ProgramFactory()
control = factories.ControlFactory()
factories.RelationshipFactory(source=program, destination=control)
response = self.import_data(OrderedDict([
("object_type", "Audit"),
("Code*", ""),
("Title", "New Audit"),
("State", "Planned"),
("Audit Captains", "*****@*****.**"),
("Program", program.slug),
("map:control versions", control.slug),
]))
self._check_csv_response(response, {})
self.assertEqual(all_models.Audit.query.count(), 1)
def test_asmnt_mapped_similar(self, obj_types, asmnt_types, similar):
"""Test similar assessments for assessments linked through mapped objs."""
with factories.single_commit():
obj1 = get_model_factory(obj_types[0])()
obj2 = get_model_factory(obj_types[1])()
factories.RelationshipFactory(source=obj1, destination=obj2)
audit = factories.AuditFactory()
assessment1 = factories.AssessmentFactory(
audit=audit, assessment_type=asmnt_types[0]
)
assessment2 = factories.AssessmentFactory(
audit=audit, assessment_type=asmnt_types[1]
)
snapshots = self._create_snapshots(audit, [obj1, obj2])
factories.RelationshipFactory(source=audit, destination=assessment1)
factories.RelationshipFactory(source=audit, destination=assessment2)
factories.RelationshipFactory(source=audit, destination=snapshots[0])
factories.RelationshipFactory(source=audit, destination=snapshots[1])
factories.RelationshipFactory(
source=snapshots[0], destination=assessment1
)
factories.RelationshipFactory(
source=snapshots[1], destination=assessment2
)
expected_ids = [assessment2.id] if similar else []
# Check related assessments for first assessment
query = [{
"object_name": "Assessment",
"type": "ids",
"filters": {
"expression": {
"op": {"name": "similar"},
"object_name": "Assessment",
"ids": [assessment1.id],
},
},
}]
response = self.client.post(
"/query",
data=json.dumps(query),
headers={"Content-Type": "application/json"},
)
self.assertStatus(response, 200)
self.assertListEqual(response.json[0]["Assessment"]["ids"], expected_ids)
def test_preconditions_failed_with_present_mandatory_url(self):
"""No preconditions failed if url required by CA is present."""
ca = CustomAttributeMock(
self.assessment,
attribute_type="Dropdown",
dropdown_parameters=("foo,url_required", "0,4"),
value="url_required",
)
url = factories.UrlTypeDocumentFactory(title="Mandatory url", )
factories.RelationshipFactory(
source=self.assessment,
destination=url,
)
preconditions_failed = self.assessment.preconditions_failed
self.assertFalse(preconditions_failed)
self.assertFalse(ca.value.preconditions_failed)
def test_put_ignored_and_status_attr(self, kind, evidence_from_status,
evidence_to_status):
"""Test put ignored and status evidence data assessment status changed"""
expected_status = models.Assessment.PROGRESS_STATE
with factories.single_commit():
evidence = factories.EvidenceFactory(kind=kind,
status=evidence_from_status)
evidence_id = evidence.id
factories.RelationshipFactory(destination=self.assessment,
source=evidence)
self.api.put(evidence, {
'status': evidence_to_status,
'notes': "test text",
})
assessment = self.refresh_object(self.assessment, self.assessment_id)
evidence = self.refresh_object(evidence, evidence_id)
self.assertEqual(assessment.status, expected_status)
self.assertEqual(evidence.status, evidence_to_status)
def test_delete_audit_with_issue_and_snapshot(self):
"""Audit can be deleted if mapped to Issue mapped to Snapshot."""
issue_id = self.issue_mapped.id
audit_id = self.audit.id
factories.RelationshipFactory(source=self.snapshot,
destination=self.issue_mapped,
context=self.audit.context)
response = self.generator.api.delete(self.audit)
self.issue_mapped = self.refresh_object(self.issue_mapped, id_=issue_id)
self.audit = self.refresh_object(self.audit, id_=audit_id)
self.assert200(response)
self.assertIsNone(self.audit)
self.assertIsNotNone(self.issue_mapped)
self.assertIsNone(self.issue_mapped.context_id)
self.assertIsNone(self.issue_mapped.audit_id)
def test_collect_mapped(self):
"""Test collecting of mapped objects"""
related_objs = []
templates = []
# pylint: disable=protected-access
with factories.single_commit():
for _ in range(3):
template = factories.AssessmentTemplateFactory()
templates.append(template)
for _ in range(3):
control = factories.ControlFactory()
factories.RelationshipFactory(source=template,
destination=control)
related_objs.append((template, control))
result = models.AssessmentTemplate._collect_mapped(
templates, ["Control"])
self.assertEquals(result, related_objs)
def test_remove_comment(self):
"""Test remove comment action."""
assessment = factories.AssessmentFactory()
comment = factories.CommentFactory(description="123")
rel_id = factories.RelationshipFactory(source=assessment,
destination=comment).id
response = self.api.put(
assessment, {
"actions": {
"remove_related": [{
"id": comment.id,
"type": "Comment",
}]
}
})
self.assert200(response)
relationship = all_models.Relationship.query.get(rel_id)
self.assertIsNone(relationship)
def test_archived_assessment(self, archived):
"""Test evidence archived if assessment archived"""
with factories.single_commit():
audit = factories.AuditFactory(archived=archived)
control = factories.ControlFactory()
snapshot = self._create_snapshots(audit, [control])[0]
assessment = factories.AssessmentFactory(audit=audit)
factories.RelationshipFactory(source=assessment,
destination=snapshot)
evidence = factories.EvidenceFactory(title='Simple title',
kind=all_models.Evidence.URL,
link='some link',
parent_obj={
'id': assessment.id,
'type': 'Assessment'
})
self.assertEquals(archived, evidence.archived)
def test_order_by_test(self, desc):
"""Order by fultext attr"""
expected_ids = []
with factories.single_commit():
assessments = [factories.AssessmentFactory() for _ in range(10)]
random.shuffle(assessments)
with factories.single_commit():
for idx, assessment in enumerate(assessments):
comment = factories.CommentFactory(description=str(idx))
factories.RelationshipFactory(source=assessment, destination=comment)
expected_ids.append(assessment.id)
query = self._make_query_dict(
"Assessment", order_by=[{"name": "comment", "desc": desc}]
)
if desc:
expected_ids = expected_ids[::-1]
results = self._get_first_result_set(query, "Assessment", "values")
self.assertEqual(expected_ids, [i['id'] for i in results])
def test_evidence_update_status_check(self, kind, from_status,
expected_status):
"""Move Assessment from '{1}' to '{2}' update evidence of type {0}"""
with factories.single_commit():
assessment = factories.AssessmentFactory(status=from_status)
evidence = factories.EvidenceFactory(kind=kind,
title='google.com',
link='google.com',
source_gdrive_id='some_id')
factories.RelationshipFactory(destination=assessment, source=evidence)
assessment_id = assessment.id
response = self.api.modify_object(evidence, {
'title': 'New evidence',
'link': 'New evidence',
})
assessment = self.refresh_object(assessment, assessment_id)
self.assert200(response)
self.assertEqual(expected_status, assessment.status)
def test_preconditions_failed_with_present_mandatory_evidence(self):
"""No preconditions failed if evidence required by CA is present."""
ca = CustomAttributeMock(
self.assessment,
attribute_type="Dropdown",
dropdown_parameters=("foo,evidence_required", "0,2"),
value="evidence_required",
)
evidence = factories.EvidenceFactory(title="Mandatory evidence", )
factories.RelationshipFactory(
source=self.assessment,
destination=evidence,
)
preconditions_failed = self.assessment.preconditions_failed
self.assertEqual(preconditions_failed, False)
self.assertFalse(ca.value.preconditions_failed)
def test_asmt_state_updating_verifiers_with_map_fields(
self, map_factory, map_column_name, new_verifier
):
"""Test assessment In Progress after updating Verifiers and map fields"""
with factories.single_commit():
audit = factories.AuditFactory()
map_object = map_factory()
spanpshot = factories.SnapshotFactory(
parent=audit,
child_id=map_object.id,
child_type=map_object.__class__.__name__,
revision=factories.RevisionFactory()
)
assessment = factories.AssessmentFactory(
audit=audit,
status=all_models.Assessment.DONE_STATE,
)
person = factories.PersonFactory(email="*****@*****.**")
factories.RelationshipFactory(source=assessment, destination=spanpshot)
factories.AccessControlPersonFactory(
ac_list=assessment.acr_name_acl_map["Verifiers"],
person=person,
)
self.assertEqual(
all_models.Assessment.query.get(assessment.id).status,
all_models.Assessment.DONE_STATE)
response = self.import_data(OrderedDict([
("object_type", "Assessment"),
("Code", assessment.slug),
("Verifiers", new_verifier),
(map_column_name, map_object.slug),
]))
expected_response = {
"Assessment": {
"row_warnings": {
errors.STATE_WILL_BE_IGNORED.format(line=3),
}
}
}
self._check_csv_response(response, expected_response)
assessment = all_models.Assessment.query.get(assessment.id)
verifiers = [v.email for v in assessment.verifiers]
self.assertEqual(assessment.status, all_models.Assessment.PROGRESS_STATE)
self.assertEqual(verifiers or [""], [new_verifier])
def test_put_mapped_roles(self):
"""Test mapped roles creation when assessment updated"""
with factories.single_commit():
person = factories.PersonFactory()
person_email = person.email
audit = factories.AuditFactory()
assessment = factories.AssessmentFactory(audit=audit)
factories.AccessControlListFactory(
ac_role_id=self.assignee_roles["Assignees"],
person=person,
object=assessment)
factories.AccessControlListFactory(
ac_role_id=self.assignee_roles["Creators"],
person=person,
object=assessment)
factories.RelationshipFactory(source=audit, destination=assessment)
verifiers = all_models.AccessControlList.query.join(
all_models.AccessControlRole,
all_models.AccessControlList.ac_role_id ==
all_models.AccessControlRole.id).filter(
all_models.AccessControlRole.name == "Verifiers Mapped",
all_models.AccessControlList.person == person,
all_models.AccessControlList.object_id == assessment.id,
all_models.AccessControlList.object_type == assessment.type,
)
# Check there is no Verified Mapped roles in db
self.assertEqual(verifiers.count(), 0)
# Add verifier to Assessment
response = self.api.put(
assessment, {
"access_control_list": [{
"ac_role_id": role_id,
"person": {
"id": person.id
}
} for role_id in self.assignee_roles.values()]
})
self.assertEqual(response.status_code, 200)
db.session.add_all([audit, assessment])
self.assert_mapped_role("Verifiers", person_email, assessment)
self.assert_mapped_role("Verifiers Mapped", person_email, audit)
def test_audit_role_propagation_not_delete(self):
"""Audit user with role Auditors can NOT delete related evidence"""
role_name = "Auditors"
_, reader = self.generator.generate_person(user_role="Reader")
with factories.single_commit():
audit = factories.AuditFactory()
audit.add_person_with_role_name(reader, role_name)
evidence = factories.EvidenceFactory()
evidence_id = evidence.id
factories.RelationshipFactory(source=audit, destination=evidence)
self.api.set_user(reader)
evidence = all_models.Evidence.query.get(evidence_id)
resp = self.api.delete(evidence)
self.assertStatus(resp, 403)
evidence = all_models.Evidence.query.get(evidence_id)
self.assertTrue(evidence)
def test_changelog_access(self, link, revision_count):
"""Test accessing changelog under GC user who is assigned to object"""
with factories.single_commit():
audit = factories.AuditFactory()
asmnt = factories.AssessmentFactory(audit=audit)
asmnt_id = asmnt.id
factories.RelationshipFactory(source=audit, destination=asmnt)
factories.AccessControlPersonFactory(
ac_list=asmnt.acr_name_acl_map["Verifiers"],
person=self.users["creator"],
)
self.api.set_user(self.users["creator"])
response = self.api.client.get(link.format("Assessment", asmnt_id))
self.assert200(response)
self.assertEqual(
len(
response.json.get("revisions_collection",
{}).get("revisions")), revision_count)
def test_unmap_evidence_as_src_assessment(self):
"""Test unmapping of evidence set as relationship source on
assessment."""
assessment = factories.AssessmentFactory()
evidence = factories.EvidenceUrlFactory()
rel_id = factories.RelationshipFactory(destination=assessment,
source=evidence).id
response = self.api.put(
assessment, {
"actions": {
"remove_related": [{
"id": evidence.id,
"type": "Evidence",
}]
}
})
self.assert200(response)
relationship = all_models.Relationship.query.get(rel_id)
self.assertIsNone(relationship)
def setup_assessments(self, asmnt_count, issue_id=None, enabled=True):
"""Create Audit with couple of Assessments and linked IssueTrackerIssues.
Args:
asmnt_count: Count of Assessments in Audit.
Returns:
Tuple with Audit id and list of Assessment ids.
"""
with factories.single_commit():
audit = factories.AuditFactory()
audit.add_person_with_role_name(
self.role_people["Audit Captains"],
"Audit Captains",
)
factories.IssueTrackerIssueFactory(
enabled=enabled,
issue_tracked_obj=audit,
issue_id=issue_id,
issue_type=constants.DEFAULT_ISSUETRACKER_VALUES['issue_type'],
component_id=12345,
hotlist_id=12345,
issue_priority="P2",
issue_severity="S2",
)
assessment_ids = []
for _ in range(asmnt_count):
asmnt = factories.AssessmentFactory(audit=audit)
factories.RelationshipFactory(source=audit, destination=asmnt)
for role_name in ["Creators", "Assignees", "Verifiers"]:
asmnt.add_person_with_role_name(
self.role_people[role_name],
role_name,
)
factories.IssueTrackerIssueFactory(
enabled=enabled,
issue_tracked_obj=asmnt,
issue_id=issue_id,
title=None,
)
assessment_ids.append(asmnt.id)
return audit.id, assessment_ids
