def test_private_stream(self) -> None:
# When we test stream permissions, it's very common to use at least
# two users, so that you can see how different users are impacted.
# We commonly use Othello to represent the "other" user from the primary user.
cordelia = self.example_user("cordelia")
othello = self.example_user("othello")
realm = cordelia.realm
stream_name = "Some private stream"
# Use the invite_only flag in make_stream to make a stream "private".
stream = self.make_stream(stream_name=stream_name, invite_only=True)
self.subscribe(cordelia, stream_name)
self.assertEqual(set(self.users_subscribed_to_stream(stream_name, realm)), {cordelia})
stream = get_stream(stream_name, realm)
self.assertEqual(stream.name, stream_name)
self.assertTrue(stream.invite_only)
# We will now observe that Cordelia can access the stream...
access_stream_for_send_message(cordelia, stream, forwarder_user_profile=None)
# ...but Othello can't.
with self.assertRaisesRegex(JsonableError, "Not authorized to send to stream"):
access_stream_for_send_message(othello, stream, forwarder_user_profile=None)
def send_notification_backend(
request: HttpRequest,
user_profile: UserProfile,
message_type: str = REQ(
"type", str_validator=check_string_in(VALID_MESSAGE_TYPES), default="private"
),
operator: str = REQ("op", str_validator=check_string_in(VALID_OPERATOR_TYPES)),
notification_to: List[int] = REQ("to", json_validator=check_list(check_int)),
topic: Optional[str] = REQ("topic", default=None),
) -> HttpResponse:
to_length = len(notification_to)
if to_length == 0:
raise JsonableError(_("Empty 'to' list"))
if message_type == "stream":
if to_length > 1:
raise JsonableError(_("Cannot send to multiple streams"))
if topic is None:
raise JsonableError(_("Missing topic"))
stream_id = notification_to[0]
# Verify that the user has access to the stream and has
# permission to send messages to it.
stream = access_stream_by_id(user_profile, stream_id)[0]
access_stream_for_send_message(user_profile, stream, forwarder_user_profile=None)
do_send_stream_typing_notification(user_profile, operator, stream, topic)
else:
user_ids = notification_to
check_send_typing_notification(user_profile, user_ids, operator)
return json_success()