def test_private_stream(self) -> None: # When we test stream permissions, it's very common to use at least # two users, so that you can see how different users are impacted. # We commonly use Othello to represent the "other" user from the primary user. cordelia = self.example_user("cordelia") othello = self.example_user("othello") realm = cordelia.realm stream_name = "Some private stream" # Use the invite_only flag in make_stream to make a stream "private". stream = self.make_stream(stream_name=stream_name, invite_only=True) self.subscribe(cordelia, stream_name) self.assertEqual(set(self.users_subscribed_to_stream(stream_name, realm)), {cordelia}) stream = get_stream(stream_name, realm) self.assertEqual(stream.name, stream_name) self.assertTrue(stream.invite_only) # We will now observe that Cordelia can access the stream... access_stream_for_send_message(cordelia, stream, forwarder_user_profile=None) # ...but Othello can't. with self.assertRaisesRegex(JsonableError, "Not authorized to send to stream"): access_stream_for_send_message(othello, stream, forwarder_user_profile=None)
def send_notification_backend( request: HttpRequest, user_profile: UserProfile, message_type: str = REQ( "type", str_validator=check_string_in(VALID_MESSAGE_TYPES), default="private" ), operator: str = REQ("op", str_validator=check_string_in(VALID_OPERATOR_TYPES)), notification_to: List[int] = REQ("to", json_validator=check_list(check_int)), topic: Optional[str] = REQ("topic", default=None), ) -> HttpResponse: to_length = len(notification_to) if to_length == 0: raise JsonableError(_("Empty 'to' list")) if message_type == "stream": if to_length > 1: raise JsonableError(_("Cannot send to multiple streams")) if topic is None: raise JsonableError(_("Missing topic")) stream_id = notification_to[0] # Verify that the user has access to the stream and has # permission to send messages to it. stream = access_stream_by_id(user_profile, stream_id)[0] access_stream_for_send_message(user_profile, stream, forwarder_user_profile=None) do_send_stream_typing_notification(user_profile, operator, stream, topic) else: user_ids = notification_to check_send_typing_notification(user_profile, user_ids, operator) return json_success()