def test_edit_if_owner(self):
"""
Users are allowed to edit their own profile
"""
perm = CanEditIfOwner()
for method in ('POST', 'PATCH', 'PUT'):
with mute_signals(post_save):
profile = ProfileFactory.create()
request = Mock(method=method, user=profile.user)
assert perm.has_object_permission(request, None, profile)
def test_allow_nonedit(self):
"""
Users are allowed to use safe methods without owning the profile.
"""
perm = CanEditIfOwner()
for method in ('GET', 'HEAD', 'OPTIONS'):
request = Mock(method=method)
with mute_signals(post_save):
profile = ProfileFactory.create()
assert perm.has_object_permission(request, None, profile)
def test_edit_if_owner(self):
"""
Users are allowed to edit their own profile
"""
perm = CanEditIfOwner()
for method in ('POST', 'PATCH', 'PUT'):
with mute_signals(post_save):
profile = ProfileFactory.create()
request = Mock(method=method, user=profile.user)
assert perm.has_object_permission(request, None, profile)
def test_allow_nonedit(self):
"""
Users are allowed to use safe methods without owning the profile.
"""
perm = CanEditIfOwner()
for method in ('GET', 'HEAD', 'OPTIONS'):
request = Mock(method=method)
with mute_signals(post_save):
profile = ProfileFactory.create()
assert perm.has_object_permission(request, None, profile)
def test_cant_edit_if_not_owner(self):
"""
Users are not allowed to edit if it's not their profile.
"""
perm = CanEditIfOwner()
other_user = UserFactory.create()
for method in ('POST', 'PATCH', 'PUT'):
with mute_signals(post_save):
profile = ProfileFactory.create(account_privacy=Profile.PUBLIC_TO_MM)
request = Mock(method=method, user=other_user)
assert not perm.has_object_permission(request, None, profile)
def test_cant_edit_if_not_owner(self):
"""
Users are not allowed to edit if it's not their profile.
"""
perm = CanEditIfOwner()
other_user = UserFactory.create()
for method in ('POST', 'PATCH', 'PUT'):
with mute_signals(post_save):
profile = ProfileFactory.create(account_privacy=Profile.PUBLIC_TO_MM)
request = Mock(method=method, user=other_user)
assert not perm.has_object_permission(request, None, profile)