72 lines
3.2 KiB
Python
72 lines
3.2 KiB
Python
"""Workspaces und Mandantentrennung (→ Konzept 6.2, 15: fremde Workspaces nicht abrufbar)."""
|
|
|
|
from helpers import connect_repo, create_workspace
|
|
|
|
|
|
def test_workspace_anlegen_macht_ersteller_zum_admin(browser, people):
|
|
anna = browser("anna")
|
|
workspace_id = create_workspace(anna, people["team_demo"])
|
|
page = anna.get(f"/workspaces/{workspace_id}")
|
|
assert page.status_code == 200
|
|
assert "Admin" in page.text and "Projekt X" in page.text
|
|
|
|
|
|
def test_nur_fuer_eigene_teams(browser, people):
|
|
response = browser("anna").post("/workspaces", {"team_id": people["team_other"], "name": "Fremd"})
|
|
assert response.status_code == 400
|
|
assert "eigene Teams" in response.text
|
|
|
|
|
|
def test_fremder_workspace_ist_404(browser, people):
|
|
workspace_id = create_workspace(browser("anna"), people["team_demo"])
|
|
# dora ist in einem anderen Team, ben im selben Team, aber kein Mitglied
|
|
for username in ("dora", "ben"):
|
|
assert browser(username).get(f"/workspaces/{workspace_id}").status_code == 404
|
|
|
|
|
|
def test_globaler_admin_sieht_fremde_workspaces_nicht(browser, people, db):
|
|
from app.identity.models import User
|
|
with db.session() as session:
|
|
session.get(User, people["dora"]).is_admin = True
|
|
workspace_id = create_workspace(browser("anna"), people["team_demo"])
|
|
assert browser("dora").get(f"/workspaces/{workspace_id}").status_code == 404
|
|
|
|
|
|
def test_mitglied_hinzufuegen_nur_aus_dem_team(browser, people):
|
|
anna = browser("anna")
|
|
workspace_id = create_workspace(anna, people["team_demo"])
|
|
assert anna.post(f"/workspaces/{workspace_id}/members", {"username": "ben", "role": "member"}).status_code == 303
|
|
assert browser("ben").get(f"/workspaces/{workspace_id}").status_code == 200
|
|
response = anna.post(f"/workspaces/{workspace_id}/members", {"username": "dora", "role": "member"})
|
|
assert response.status_code == 400
|
|
|
|
|
|
def test_mitglied_darf_nicht_verwalten(browser, people, git_repo):
|
|
anna = browser("anna")
|
|
workspace_id = create_workspace(anna, people["team_demo"])
|
|
anna.post(f"/workspaces/{workspace_id}/members", {"username": "ben", "role": "member"})
|
|
ben = browser("ben")
|
|
assert ben.post(f"/workspaces/{workspace_id}/members", {"username": "clara", "role": "admin"}).status_code == 403
|
|
response = ben.post(f"/workspaces/{workspace_id}/sources",
|
|
{"name": "R", "url": git_repo, "exposure_confirmed": "1"})
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_letzter_admin_bleibt(browser, people):
|
|
anna = browser("anna")
|
|
workspace_id = create_workspace(anna, people["team_demo"])
|
|
response = anna.post(f"/workspaces/{workspace_id}/members", {"username": "anna", "role": "member"})
|
|
assert response.status_code == 400
|
|
|
|
|
|
def test_audit_eintraege(browser, people, db, git_repo):
|
|
from sqlalchemy import select
|
|
|
|
from app.audit.models import AuditEvent
|
|
anna = browser("anna")
|
|
workspace_id = create_workspace(anna, people["team_demo"])
|
|
connect_repo(anna, workspace_id, git_repo)
|
|
with db.session() as session:
|
|
actions = set(session.scalars(select(AuditEvent.action)))
|
|
assert {"auth.login", "workspace.created", "source.created", "source.exposure_confirmed",
|
|
"source.tested"} <= actions
|