def test_render_all_reject_requirements(self):
"""Testing MyAccountView renders all forms when a user has rejected all
consent decisions
"""
settings = {
'privacy_enable_user_consent': True,
}
user = User.objects.get(username='******')
get_consent_tracker().record_consent_data_list(user, [
requirement.build_consent_data(granted=False)
for requirement in get_consent_requirements_registry()
])
request = RequestFactory().get('/account/preferences')
request.user = User.objects.get(username='******')
view = MyAccountView()
self.client.login(username='******', password='******')
with self.siteconfig_settings(settings):
rsp = self.client.get('/account/preferences/')
self.assertEqual(rsp.status_code, 200)
context = rsp.context
self.assertEqual(context['render_sidebar'], True)
self.assertEqual(
{type(page)
for page in context['pages']}, {
account_page
for account_page in AccountPage.registry
if account_page(view, request, request.user).is_visible()
})
def test_mixin_reject_policy(self):
"""Testing CheckPendingConsentMixin when the user has rejected the
policy requirement
"""
policy_requirement = PolicyConsentRequirement(
'https://example.com/',
'https://example.com/',
reject_instructions='Obey.')
self.registry.register(policy_requirement)
request = self.request_factory.get('/')
request.user = User.objects.create_user(username='******',
email='*****@*****.**')
get_consent_tracker().record_consent_data_list(
request.user,
[
ConsentData(BenevolentConsentRequirement.requirement_id,
granted=True),
ConsentData(NefariousConsentRequirement.requirement_id,
granted=False),
policy_requirement.build_consent_data(granted=False),
])
rsp = MixinView.as_view()(request)
self.assertIsInstance(rsp, HttpResponseRedirect)
self.assertEqual(rsp.url, '/consent')
def test_for_user_with_consent_checks_and_consent_granted(self):
"""Testing AvatarServiceRegistry.for_user with consent checks enabled
and consent granted
"""
class DummyAvatarServiceRegistry(AvatarServiceRegistry):
settings_manager_class = DummySettingsManager(
GravatarService.avatar_service_id, {})
default_avatar_service_classes = [
GravatarService,
DummyAvatarService,
]
registry = DummyAvatarServiceRegistry()
registry.enable_service(GravatarService, save=False)
registry.enable_service(DummyAvatarService, save=False)
registry.set_default_service(DummyAvatarService, save=False)
user = User.objects.create(username='******')
settings = {
AvatarServiceRegistry.ENABLE_CONSENT_CHECKS: True,
}
get_consent_tracker().record_consent_data(
user,
ConsentData(requirement_id=GravatarService.consent_requirement_id,
granted=True))
with self.siteconfig_settings(settings):
self.assertIsInstance(registry.for_user(user), GravatarService)
def test_render_only_privacy_form_if_reject_policy_reject_others(self):
"""Testing MyAccountView only renders privacy policy when a user has
rejected the privacy policy/terms of service and rejected all other
requirements
"""
settings = {
'privacy_enable_user_consent': True,
'privacy_policy_url': 'https://example.com',
'terms_of_service_url': 'https://example.com',
}
user = User.objects.get(username='******')
# Accept all consent requirements *except* the policy.
get_consent_tracker().record_consent_data_list(user, [
requirement.build_consent_data(granted=False)
for requirement in get_consent_requirements_registry()
])
self.client.login(username='******', password='******')
with self.siteconfig_settings(settings):
rsp = self.client.get('/account/preferences/')
self.assertEqual(rsp.status_code, 200)
context = rsp.context
self.assertEqual(context['render_sidebar'], False)
self.assertEqual(len(context['forms']), 1)
self.assertIsInstance(context['forms'][0], PrivacyForm)
def test_render_only_privacy_form_if_reject_policy_reject_others(self):
"""Testing MyAccountView only renders privacy policy when a user has
rejected the privacy policy/terms of service and rejected all other
requirements
"""
settings = {
'privacy_enable_user_consent': True,
'privacy_policy_url': 'https://example.com',
'terms_of_service_url': 'https://example.com',
}
user = User.objects.get(username='******')
# Accept all consent requirements *except* the policy.
get_consent_tracker().record_consent_data_list(
user,
[
requirement.build_consent_data(granted=False)
for requirement in get_consent_requirements_registry()
])
self.client.login(username='******', password='******')
with self.siteconfig_settings(settings):
rsp = self.client.get('/account/preferences/')
self.assertEqual(rsp.status_code, 200)
context = rsp.context
self.assertEqual(context['render_sidebar'], False)
self.assertEqual(len(context['forms']), 1)
self.assertIsInstance(context['forms'][0], PrivacyForm)
def test_init(self):
"""Testing ConsentConfigPageFormMixin.__init__ defines field"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement_2.build_consent_data(granted=False))
form = MyForm(page=self.page,
request=self.request,
user=self.user)
self.assertIn('consent', form.fields)
field = form.fields['consent']
self.assertEqual(field.initial, [Consent.UNSET, Consent.DENIED])
self.assertEqual(
field.consent_requirements,
[self.consent_requirement_1, self.consent_requirement_2])
for subfield in field.fields:
self.assertEqual(subfield.consent_source,
'http://testserver/consent/')
self.assertEqual(
subfield.extra_consent_data,
{
'test': True,
})
def test_mixin_reject_policy(self):
"""Testing CheckPendingConsentMixin when the user has rejected the
policy requirement
"""
policy_requirement = PolicyConsentRequirement(
'https://example.com/',
'https://example.com/',
reject_instructions='Obey.')
self.registry.register(policy_requirement)
request = self.request_factory.get('/')
request.user = User.objects.create_user(username='******',
email='*****@*****.**')
get_consent_tracker().record_consent_data_list(request.user, [
ConsentData(BenevolentConsentRequirement.requirement_id,
granted=True),
ConsentData(NefariousConsentRequirement.requirement_id,
granted=False),
policy_requirement.build_consent_data(granted=False),
])
rsp = MixinView.as_view()(request)
self.assertIsInstance(rsp, HttpResponseRedirect)
self.assertEqual(rsp.url, '/consent')
def test_for_user_with_consent_checks_and_consent_denied(self):
"""Testing AvatarServiceRegistry.for_user with consent checks enabled
and consent denied
"""
class DummyAvatarServiceRegistry(AvatarServiceRegistry):
settings_manager_class = DummySettingsManager(
GravatarService.avatar_service_id, {})
default_avatar_service_classes = [
GravatarService,
DummyAvatarService,
]
registry = DummyAvatarServiceRegistry()
registry.enable_service(GravatarService, save=False)
registry.enable_service(DummyAvatarService, save=False)
registry.set_default_service(DummyAvatarService, save=False)
user = User.objects.create(username='******')
settings = {
AvatarServiceRegistry.ENABLE_CONSENT_CHECKS: True,
}
get_consent_tracker().record_consent_data(
user,
ConsentData(requirement_id=GravatarService.consent_requirement_id,
granted=False))
with self.siteconfig_settings(settings):
self.assertIsInstance(registry.for_user(user), DummyAvatarService)
def test_set_initial_from_user(self):
"""Testing ConsentRequirementField.set_initial_from_user"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement.build_consent_data(granted=False))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, Consent.DENIED)
def test_set_initial_from_user(self):
"""Testing MultiConsentRequirementsField.set_initial_from_user"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement_2.build_consent_data(granted=True))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, [Consent.UNSET, Consent.GRANTED])
def test_set_initial_from_user(self):
"""Testing MultiConsentRequirementsField.set_initial_from_user"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement_2.build_consent_data(granted=True))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, [Consent.UNSET, Consent.GRANTED])
def test_set_initial_from_user(self):
"""Testing ConsentRequirementField.set_initial_from_user"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement.build_consent_data(granted=False))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, Consent.DENIED)
def test_init_with_user_and_existing_consent(self):
"""Testing ConsentRequirementField.__init__ with user and existing
consent data
"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement.build_consent_data(granted=True))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, Consent.GRANTED)
def test_init_with_user_and_existing_consent(self):
"""Testing ConsentRequirementField.__init__ with user and existing
consent data
"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement.build_consent_data(granted=True))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, Consent.GRANTED)
def save_consent(self, user):
"""Save the consent information recorded in the form.
Args:
user (django.contrib.auth.models.User):
The user who made the consent decisions.
"""
assert self.is_valid()
assert user
assert user.is_authenticated()
get_consent_tracker().record_consent_data_list(
user, self.cleaned_data[self.consent_field_name])
def save_consent(self, user):
"""Save the consent information recorded in the form.
Args:
user (django.contrib.auth.models.User):
The user who made the consent decisions.
"""
assert self.is_valid()
assert user
assert user.is_authenticated()
get_consent_tracker().record_consent_data_list(
user,
self.cleaned_data[self.consent_field_name])
def is_consent_missing(user):
"""Return whether the user is missing any consent requirements.
Args:
user (django.contrib.auth.models.User):
The user in question.
Returns:
bool:
Whether or not the user is missing any consent requirements.
"""
siteconfig = SiteConfiguration.objects.get_current()
if not siteconfig.get('privacy_enable_user_consent'):
return False
consent_tracker = get_consent_tracker()
pending_consent = consent_tracker.get_pending_consent_requirements(
user)
needs_accept_policies = (
(siteconfig.get('privacy_policy_url') or
siteconfig.get('terms_of_service_url')) and
(consent_tracker.get_consent(
user,
PolicyConsentRequirement.requirement_id) !=
Consent.GRANTED)
)
return needs_accept_policies or pending_consent
def decorated(request, *args, **kwargs):
user = request.user
if user.is_authenticated():
pending_requirements = \
get_consent_tracker().get_pending_consent_requirements(user)
policy_requirement = \
get_consent_requirements_registry().get_consent_requirement(
PolicyConsentRequirement.requirement_id)
if (pending_requirements or
(policy_requirement is not None and
(policy_requirement.get_consent(user) !=
Consent.GRANTED))):
redirect_url = getattr(settings, _CONSENT_REDIRECT_SETTING,
None)
if redirect_url is None:
raise ImproperlyConfigured(
'settings.%s must be set.' % _CONSENT_REDIRECT_SETTING
)
if callable(redirect_url):
redirect_url = redirect_url(request)
return HttpResponseRedirect(redirect_url)
return view(request, *args, **kwargs)
def is_consent_missing(user):
"""Return whether the user is missing any consent requirements.
Args:
user (django.contrib.auth.models.User):
The user in question.
Returns:
bool:
Whether or not the user is missing any consent requirements.
"""
siteconfig = SiteConfiguration.objects.get_current()
if not siteconfig.get('privacy_enable_user_consent'):
return False
consent_tracker = get_consent_tracker()
pending_consent = consent_tracker.get_pending_consent_requirements(
user)
needs_accept_policies = (
(siteconfig.get('privacy_policy_url') or
siteconfig.get('terms_of_service_url')) and
(consent_tracker.get_consent(
user,
PolicyConsentRequirement.requirement_id) !=
Consent.GRANTED)
)
return needs_accept_policies or pending_consent
def decorated(request, *args, **kwargs):
user = request.user
if user.is_authenticated():
pending_requirements = \
get_consent_tracker().get_pending_consent_requirements(user)
policy_requirement = \
get_consent_requirements_registry().get_consent_requirement(
PolicyConsentRequirement.requirement_id)
if (pending_requirements or
(policy_requirement is not None and
(policy_requirement.get_consent(user) != Consent.GRANTED))):
redirect_url = getattr(settings, _CONSENT_REDIRECT_SETTING,
None)
if redirect_url is None:
raise ImproperlyConfigured('settings.%s must be set.' %
_CONSENT_REDIRECT_SETTING)
if callable(redirect_url):
redirect_url = redirect_url(request)
return HttpResponseRedirect(redirect_url)
return view(request, *args, **kwargs)
def test_mixin_some_met(self):
"""Testing CheckPendingConsentMixin when a user has some pending
consent decisions
"""
request = self.request_factory.get('/')
request.user = User.objects.create_user(
username='******', email='*****@*****.**')
get_consent_tracker().record_consent_data(
request.user,
ConsentData(BenevolentConsentRequirement.requirement_id,
granted=True))
rsp = MixinView.as_view()(request)
self.assertIsInstance(rsp, HttpResponseRedirect)
self.assertEqual(rsp.url, '/consent')
def test_mixin_some_met(self):
"""Testing CheckPendingConsentMixin when a user has some pending
consent decisions
"""
request = self.request_factory.get('/')
request.user = User.objects.create_user(username='******',
email='*****@*****.**')
get_consent_tracker().record_consent_data(
request.user,
ConsentData(BenevolentConsentRequirement.requirement_id,
granted=True))
rsp = MixinView.as_view()(request)
self.assertIsInstance(rsp, HttpResponseRedirect)
self.assertEqual(rsp.url, '/consent')
def for_user(self, user, service_id=None, allow_consent_checks=True):
"""Return the requested avatar service for the given user.
The following options will be tried:
* The requested avatar service (if it is enabled)
* The user's chosen avatar service (if it is enabled)
* The default avatar service (which may be ``None``)
Args:
user (django.contrib.auth.models.User):
The user to retrieve the avatar service for.
service_id (unicode, optional):
The unique identifier of the service that is to be retrieved.
If this is ``None``, the default service will be used.
allow_consent_checks (bool, optional):
Whether to allow consent checks to take place, if required
by the application settings and avatar backends. This should
only be disabled if presenting configuration options or
similar.
Returns:
djblets.avatars.services.base.AvatarService:
An avatar service, or ``None`` if one could not be found.
"""
settings_manager = self.settings_manager_class(user)
user_service_id = settings_manager.avatar_service_id
siteconfig = SiteConfiguration.objects.get_current()
services = []
for sid in (service_id, user_service_id):
if sid is None or not self.has_service(sid):
continue
if self.is_enabled(self.get('avatar_service_id', sid)):
services.append(self.get_avatar_service(sid))
services.append(self.default_service)
if (allow_consent_checks and siteconfig.get(
AvatarServiceRegistry.ENABLE_CONSENT_CHECKS)):
# Filter out any services requiring consent that the user has not
# consented to.
consent_tracker = get_consent_tracker()
services = [
service for service in services
if (not service.consent_requirement_id or consent_tracker.
get_consent(user, service.consent_requirement_id) ==
Consent.GRANTED)
]
if services:
return services[0]
return None
def test_get_consent(self):
"""Testing BaseConsentRequirement.get_consent"""
requirement = MyConsentRequirement()
timestamp = datetime(2018, 1, 2, 13, 14, 15, tzinfo=timezone.utc)
user = User.objects.create(username='******')
consent_data = ConsentData(
requirement_id='my-requirement',
granted=True,
timestamp=timestamp,
source='http://example.com/account/profile/#consent',
extra_data={
'test': True,
})
get_consent_tracker().record_consent_data(user, consent_data)
self.assertEqual(requirement.get_consent(user), Consent.GRANTED)
def test_get_consent(self):
"""Testing BaseConsentRequirement.get_consent"""
requirement = MyConsentRequirement()
timestamp = datetime(2018, 1, 2, 13, 14, 15, tzinfo=timezone.utc)
user = User.objects.create(username='******')
consent_data = ConsentData(
requirement_id='my-requirement',
granted=True,
timestamp=timestamp,
source='http://example.com/account/profile/#consent',
extra_data={
'test': True,
})
get_consent_tracker().record_consent_data(user, consent_data)
self.assertEqual(requirement.get_consent(user), Consent.GRANTED)
def test_mixin_all_met(self):
"""Testing CheckPendingConsentMixin when a user has no pending consent
decisions
"""
request = self.request_factory.get('/')
request.user = User.objects.create_user(username='******',
email='*****@*****.**')
get_consent_tracker().record_consent_data_list(request.user, [
ConsentData(BenevolentConsentRequirement.requirement_id,
granted=True),
ConsentData(NefariousConsentRequirement.requirement_id,
granted=False),
])
rsp = MixinView.as_view()(request)
self.assertNotIsInstance(rsp, HttpResponseRedirect)
self.assertIsInstance(rsp, HttpResponse)
self.assertEqual(rsp.content, b'ok')
def test_init(self):
"""Testing ConsentConfigPageFormMixin.__init__ defines field"""
get_consent_tracker().record_consent_data(
self.user,
self.consent_requirement_2.build_consent_data(granted=False))
form = MyForm(page=self.page, request=self.request, user=self.user)
self.assertIn('consent', form.fields)
field = form.fields['consent']
self.assertEqual(field.initial, [Consent.UNSET, Consent.DENIED])
self.assertEqual(
field.consent_requirements,
[self.consent_requirement_1, self.consent_requirement_2])
for subfield in field.fields:
self.assertEqual(subfield.consent_source,
'http://testserver/consent/')
self.assertEqual(subfield.extra_consent_data, {
'test': True,
})
def test_render_all_accept_requirements(self):
"""Testing MyAccountView renders all forms when a user has accepted all
requirements
"""
settings = {
'privacy_enable_user_consent': True,
}
user = User.objects.get(username='******')
get_consent_tracker().record_consent_data_list(
user,
[
requirement.build_consent_data(granted=True)
for requirement in get_consent_requirements_registry()
])
request = RequestFactory().get('/account/preferences')
request.user = User.objects.get(username='******')
view = MyAccountView()
self.client.login(username='******', password='******')
with self.siteconfig_settings(settings):
rsp = self.client.get('/account/preferences/')
self.assertEqual(rsp.status_code, 200)
context = rsp.context
self.assertEqual(context['render_sidebar'], True)
self.assertEqual(
{
type(page)
for page in context['pages']
if page.is_visible()
},
{
account_page
for account_page in AccountPage.registry
if account_page(view, request, request.user).is_visible()
})
def test_mixin_all_met(self):
"""Testing CheckPendingConsentMixin when a user has no pending consent
decisions
"""
request = self.request_factory.get('/')
request.user = User.objects.create_user(username='******',
email='*****@*****.**')
get_consent_tracker().record_consent_data_list(
request.user,
[
ConsentData(BenevolentConsentRequirement.requirement_id,
granted=True),
ConsentData(NefariousConsentRequirement.requirement_id,
granted=False),
])
rsp = MixinView.as_view()(request)
self.assertNotIsInstance(rsp, HttpResponseRedirect)
self.assertIsInstance(rsp, HttpResponse)
self.assertEqual(rsp.content, b'ok')
def test_init_with_user_and_existing_consent(self):
"""Testing MultiConsentRequirementsField.__init__ with user and
existing consent data
"""
tracker = get_consent_tracker()
tracker.record_consent_data(
self.user,
self.consent_requirement_1.build_consent_data(granted=True))
tracker.record_consent_data(
self.user,
self.consent_requirement_2.build_consent_data(granted=False))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, [Consent.GRANTED, Consent.DENIED])
def test_with_consent_required_and_consent_pending(self):
"""Testing @valid_prefs_required with privacy_enable_user_consent=True
and pending consent
"""
Profile.objects.create(user=self.user)
consent_tracker = get_consent_tracker()
all_consent = consent_tracker.get_all_consent(self.user)
self.assertEqual(all_consent, {})
with self.siteconfig_settings({'privacy_enable_user_consent': True}):
response = self._view_func(self.request)
self.assertIs(type(response), HttpResponseRedirect)
self.assertEqual(response.url, '/account/preferences/?next=/')
def test_init_with_user_and_existing_consent(self):
"""Testing MultiConsentRequirementsField.__init__ with user and
existing consent data
"""
tracker = get_consent_tracker()
tracker.record_consent_data(
self.user,
self.consent_requirement_1.build_consent_data(granted=True))
tracker.record_consent_data(
self.user,
self.consent_requirement_2.build_consent_data(granted=False))
self.field.set_initial_from_user(self.user)
self.assertEqual(self.field.initial, [Consent.GRANTED, Consent.DENIED])
def test_with_consent_required_and_consent_pending(self):
"""Testing @valid_prefs_required with privacy_enable_user_consent=True
and pending consent
"""
Profile.objects.create(user=self.user)
consent_tracker = get_consent_tracker()
all_consent = consent_tracker.get_all_consent(self.user)
self.assertEqual(all_consent, {})
with self.siteconfig_settings({'privacy_enable_user_consent': True}):
response = self._view_func(self.request)
self.assertIs(type(response), HttpResponseRedirect)
self.assertEqual(response.url, '/account/preferences/?next=/')
def accept_policies(self, user):
"""Accept the linked policies for the given user.
Args:
user (django.contrib.auth.models.User):
The user who has accepted the privacy policy and/or terms of
service.
"""
if self.policies_enabled:
consent_registry = get_consent_requirements_registry()
requirement = consent_registry.get_consent_requirement(
PolicyConsentRequirement.requirement_id)
consent_tracker = get_consent_tracker()
consent_tracker.record_consent_data(
user, requirement.build_consent_data(granted=True))
def accept_policies(self, user):
"""Accept the linked policies for the given user.
Args:
user (django.contrib.auth.models.User):
The user who has accepted the privacy policy and/or terms of
service.
"""
if self.policies_enabled:
consent_registry = get_consent_requirements_registry()
requirement = consent_registry.get_consent_requirement(
PolicyConsentRequirement.requirement_id)
consent_tracker = get_consent_tracker()
consent_tracker.record_consent_data(
user, requirement.build_consent_data(granted=True))
def test_with_consent_required_and_no_consent_pending(self):
"""Testing @valid_prefs_required with privacy_enable_user_consent=True
and no pending consent
"""
Profile.objects.create(user=self.user)
consent_tracker = get_consent_tracker()
consent_tracker.record_consent_data_list(self.user, [
consent_requirement.build_consent_data(granted=True)
for consent_requirement in get_consent_requirements_registry()
])
all_consent = consent_tracker.get_all_consent(self.user)
self.assertNotEqual(all_consent, {})
with self.siteconfig_settings({'privacy_enable_user_consent': True}):
response = self._view_func(self.request)
self.assertIs(type(response), HttpResponse)
def test_with_consent_required_and_no_consent_pending(self):
"""Testing @valid_prefs_required with privacy_enable_user_consent=True
and no pending consent
"""
Profile.objects.create(user=self.user)
consent_tracker = get_consent_tracker()
consent_tracker.record_consent_data_list(
self.user,
[
consent_requirement.build_consent_data(granted=True)
for consent_requirement in get_consent_requirements_registry()
])
all_consent = consent_tracker.get_all_consent(self.user)
self.assertNotEqual(all_consent, {})
with self.siteconfig_settings({'privacy_enable_user_consent': True}):
response = self._view_func(self.request)
self.assertIs(type(response), HttpResponse)
def test_get_consent_tracker_with_custom(self):
"""Testing get_consent_tracker with custom tracker"""
self.assertIsInstance(get_consent_tracker(), CustomConsentTracker)
def test_get_consent_tracker_with_default(self):
"""Testing get_consent_tracker with default tracker"""
self.assertIsInstance(get_consent_tracker(), DatabaseConsentTracker)
