def test_organisation_user_delete_view_doesnt_let_user_delete_others(self):
org_user_delete_view = CustomOrganizationUserDelete()
org_user = OrganizationUserFactory()
org = org_user.organization
user_1 = org_user.user
user_2 = UserFactory()
assign_perm(GUARDIAN_PERMISSION, user_1, org)
request = RequestFactory().post("/", {'submit': "Delete"})
request.user = user_1
org_user_delete_view.get_object = lambda: org_user
response = org_user_delete_view.dispatch(
request, organization_pk=unicode(org.pk), user_pk=unicode(user_2.pk))
self.assertIsInstance(response, HttpResponseForbidden)
def test_organisation_user_delete_view_doesnt_let_user_delete_others(self):
org_user_delete_view = CustomOrganizationUserDelete()
org_user = OrganizationUserFactory()
org = org_user.organization
user_1 = org_user.user
user_2 = UserFactory()
assign_perm(GUARDIAN_PERMISSION, user_1, org)
request = RequestFactory().post("/", {'submit': "Delete"})
request.user = user_1
org_user_delete_view.get_object = lambda: org_user
response = org_user_delete_view.dispatch(
request, organization_pk=unicode(org.pk), user_pk=unicode(user_2.pk))
self.assertIsInstance(response, HttpResponseForbidden)
def test_organisation_user_delete_view_is_accessible_to_admin(self):
org_user_delete_view = CustomOrganizationUserDelete()
org_user = OrganizationUserFactory(is_admin=True)
org = org_user.organization
user_1 = org_user.user
user_2 = UserFactory()
assign_perm(GUARDIAN_PERMISSION, user_1, org)
request = RequestFactory().post("/", {'submit': "Delete"})
request.user = user_1
org_user_delete_view.get_object = lambda: org_user
response = org_user_delete_view.dispatch(
request, organization_pk=org.pk, user_pk=user_2.pk)
self.assertEqual(
reverse('organization_user_list', args=[org.pk]), response['Location'])
def test_organisation_user_delete_view_is_accessible_to_admin(self):
org_user_delete_view = CustomOrganizationUserDelete()
org_user = OrganizationUserFactory(is_admin=True)
org = org_user.organization
user_1 = org_user.user
user_2 = UserFactory()
assign_perm(GUARDIAN_PERMISSION, user_1, org)
request = RequestFactory().post("/", {'submit': "Delete"})
request.user = user_1
org_user_delete_view.get_object = lambda: org_user
response = org_user_delete_view.dispatch(
request, organization_pk=org.pk, user_pk=user_2.pk)
self.assertEqual(
reverse('organization_user_list', args=[org.pk]), response['Location'])