def test_get_serializer_class_non_staff_user_allow_to_modify_non_read_only_fields(self):
data = {
'user': self.simple_user,
'status': STATUS.new,
'reason': REASON.illness,
'start_date': Day().date,
'end_date': Day().date,
}
absence = AbsenceFactory(**data)
self.client.force_authenticate(self.simple_user)
user, decision_by = UserFactory(), UserFactory()
data = {
'user': {'id': user.id},
'decision_by': {'id': decision_by.id},
'status': STATUS.verifying,
'reason': REASON.other,
'start_date': Day(ago=5).date,
'end_date': Day(ago=4).date,
'notes': self.fake.text(),
}
response = self.client.patch(self.get_detail_url(absence.id), data=data)
assert response.status_code == HTTP_403_FORBIDDEN
absence.refresh_from_db()
assert absence.user.id != data['user']['id']
assert absence.decision_by.id != data['decision_by']['id']
data.pop('user'), data.pop('decision_by')
for field in data.keys():
assert getattr(absence, field) != data[field]
data = {
'status': STATUS.verifying,
'reason': REASON.other,
'start_date': Day(ago=5).date,
'end_date': Day(ago=4).date,
}
response = self.client.patch(self.get_detail_url(absence.id), data=data)
assert response.status_code == HTTP_200_OK
absence.refresh_from_db()
for field in data.keys():
assert getattr(absence, field) == data[field]
def test_get_serializer_class__staff_user_allow_to_modify_all_fields(self):
absence = AbsenceFactory(status=STATUS.new, reason=REASON.illness, start_date=Day().date, end_date=Day().date)
self.client.force_authenticate(self.staff_user)
user, decision_by = UserFactory(), UserFactory()
data = {
'user': {'id': user.id},
'decision_by': {'id': decision_by.id},
'status': STATUS.verifying,
'reason': REASON.other,
'start_date': Day(ago=5).date,
'end_date': Day(ago=4).date,
'notes': self.fake.text(),
}
response = self.client.patch(self.get_detail_url(absence.id), data=data)
absence.refresh_from_db()
assert absence.user.id == data['user']['id']
assert absence.decision_by.id == data['decision_by']['id']
assert response.data['user']['id'] == data['user']['id']
assert response.data['decision_by']['id'] == data['decision_by']['id']
data.pop('user'), data.pop('decision_by')
for field in data.keys():
assert response.data[field] == (format(data[field]) if isinstance(data[field], date) else data[field])
assert getattr(absence, field) == data[field]