65 lines
2.7 KiB
Python
65 lines
2.7 KiB
Python
from django.contrib.auth.models import User
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
from django.utils import timezone
|
|
|
|
from rides.models import Fahrgast, Profile, Ride, RideStatus, Role
|
|
|
|
SECRET = "PFLEGEHINWEIS-GEHEIM-XYZ"
|
|
|
|
|
|
class VisibilityTests(TestCase):
|
|
def setUp(self):
|
|
self.pilot_a = User.objects.create_user("pilot_a", first_name="Anton")
|
|
self.pilot_b = User.objects.create_user("pilot_b", first_name="Berta")
|
|
Profile.objects.create(user=self.pilot_a, role=Role.PILOT)
|
|
Profile.objects.create(user=self.pilot_b, role=Role.PILOT)
|
|
self.fahrgast = Fahrgast.objects.create(name="Herr K.", mobility_notes=SECRET)
|
|
self.ride = Ride.objects.create(
|
|
fahrgast=self.fahrgast,
|
|
scheduled_at=timezone.now(),
|
|
assigned_pilot=self.pilot_a,
|
|
status=RideStatus.CLAIMED,
|
|
pickup_label="A",
|
|
pickup_lat=49.25,
|
|
pickup_lng=6.96,
|
|
dest_label="B",
|
|
dest_lat=49.23,
|
|
dest_lng=6.99,
|
|
)
|
|
|
|
def test_foreign_pilot_cannot_view_assigned_ride(self):
|
|
self.client.force_login(self.pilot_b)
|
|
resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
|
|
self.assertEqual(resp.status_code, 403)
|
|
|
|
def test_foreign_pilot_never_sees_notes(self):
|
|
self.client.force_login(self.pilot_b)
|
|
resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
|
|
self.assertNotContains(resp, SECRET, status_code=403)
|
|
|
|
def test_assigned_pilot_sees_notes(self):
|
|
self.client.force_login(self.pilot_a)
|
|
resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
|
|
self.assertContains(resp, SECRET)
|
|
|
|
def test_open_ride_visible_to_any_pilot(self):
|
|
self.ride.assigned_pilot = None
|
|
self.ride.status = RideStatus.REQUESTED
|
|
self.ride.save()
|
|
self.client.force_login(self.pilot_b)
|
|
resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
|
|
self.assertEqual(resp.status_code, 200)
|
|
|
|
def test_geojson_respects_visibility(self):
|
|
# Eine fremde, vergebene Fahrt darf NICHT in der Karten-API eines
|
|
# anderen Piloten auftauchen (HIGH-Finding aus dem Code-Review).
|
|
self.ride.pickup_label = "GEHEIM-ABHOLORT"
|
|
self.ride.save()
|
|
self.client.force_login(self.pilot_b)
|
|
resp = self.client.get(reverse("rides_geojson"))
|
|
self.assertNotContains(resp, "GEHEIM-ABHOLORT")
|
|
# die zugeteilte Pilot:in sieht sie sehr wohl
|
|
self.client.force_login(self.pilot_a)
|
|
resp = self.client.get(reverse("rides_geojson"))
|
|
self.assertContains(resp, "GEHEIM-ABHOLORT")
|