def test_create_attachment_by_external_user_without_comment_permission(client): issue = f.create_issue() user = f.UserFactory() assert issue.owner != user assert issue.project.owner != user url = reverse("issue-attachments-list") data = {"description": "test", "object_id": issue.pk, "project": issue.project.id, "attached_file": SimpleUploadedFile("test.txt", b"test"), "from_comment": True} client.login(user) response = client.post(url, data) assert response.status_code == 403