Aurélien Warnon
3c88e75c86
Purpose ======= Handle publishing of the slide.slide/slide.channel accordingly to the new 'can_publish' field in the website published mixin.
162 lines
7.1 KiB
Python
162 lines
7.1 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.addons.website_slides.tests import common
|
|
from odoo.exceptions import AccessError, UserError
|
|
from odoo.tests import tagged
|
|
from odoo.tests.common import users
|
|
from odoo.tools import mute_logger
|
|
|
|
|
|
@tagged('security')
|
|
class TestAccess(common.SlidesCase):
|
|
|
|
@mute_logger('odoo.models', 'odoo.addons.base.models.ir_rule')
|
|
def test_access_channel_invite(self):
|
|
""" Invite channels don't give visibility if not member """
|
|
self.channel.write({'visibility': 'invite'})
|
|
|
|
self.channel.sudo(self.user_publisher).read(['name'])
|
|
self.channel.sudo(self.user_emp).read(['name'])
|
|
self.channel.sudo(self.user_portal).read(['name'])
|
|
self.channel.sudo(self.user_public).read(['name'])
|
|
|
|
self.slide.sudo(self.user_publisher).read(['name'])
|
|
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_portal).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_portal).read(['name'])
|
|
|
|
# if member -> can read
|
|
membership = self.env['slide.channel.partner'].create({
|
|
'channel_id': self.channel.id,
|
|
'partner_id': self.user_emp.partner_id.id,
|
|
})
|
|
self.channel.sudo(self.user_emp).read(['name'])
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
|
|
# not member anymore -> cannot read
|
|
membership.unlink()
|
|
self.channel.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
|
|
@mute_logger('odoo.models', 'odoo.addons.base.models.ir_rule')
|
|
def test_access_channel_public(self):
|
|
""" Public channels don't give visibility if not member """
|
|
self.channel.write({'visibility': 'public'})
|
|
|
|
self.channel.sudo(self.user_publisher).read(['name'])
|
|
self.channel.sudo(self.user_emp).read(['name'])
|
|
self.channel.sudo(self.user_portal).read(['name'])
|
|
self.channel.sudo(self.user_public).read(['name'])
|
|
|
|
self.slide.sudo(self.user_publisher).read(['name'])
|
|
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_portal).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_public).read(['name'])
|
|
|
|
@mute_logger('odoo.models', 'odoo.addons.base.models.ir_rule')
|
|
def test_access_channel_publish(self):
|
|
""" Unpublished channels and their content are visible only to website people """
|
|
self.channel.write({'website_published': False, 'visibility': 'public'})
|
|
|
|
# channel available only to website
|
|
self.channel.sudo(self.user_publisher).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.channel.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.channel.sudo(self.user_portal).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.channel.sudo(self.user_public).read(['name'])
|
|
|
|
# slide available only to website
|
|
self.slide.sudo(self.user_publisher).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_portal).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_public).read(['name'])
|
|
|
|
# even members cannot see unpublished content
|
|
self.env['slide.channel.partner'].create({
|
|
'channel_id': self.channel.id,
|
|
'partner_id': self.user_emp.partner_id.id,
|
|
})
|
|
with self.assertRaises(AccessError):
|
|
self.channel.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
|
|
# publish channel but content unpublished (even if can be previewed) still unavailable
|
|
self.channel.write({'website_published': True})
|
|
self.slide.write({
|
|
'is_preview': True,
|
|
'website_published': False,
|
|
})
|
|
|
|
self.slide.sudo(self.user_publisher).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_portal).read(['name'])
|
|
with self.assertRaises(AccessError):
|
|
self.slide.sudo(self.user_public).read(['name'])
|
|
|
|
@mute_logger('odoo.models', 'odoo.addons.base.models.ir_rule')
|
|
def test_access_slide_preview(self):
|
|
""" Slides with preview flag are always visible even to non members if published """
|
|
self.channel.write({'visibility': 'invite'})
|
|
self.slide.write({'is_preview': True})
|
|
|
|
self.slide.sudo(self.user_publisher).read(['name'])
|
|
self.slide.sudo(self.user_emp).read(['name'])
|
|
self.slide.sudo(self.user_portal).read(['name'])
|
|
self.slide.sudo(self.user_public).read(['name'])
|
|
|
|
@mute_logger('odoo.models', 'odoo.addons.base.models.ir_rule')
|
|
def test_channel_features(self):
|
|
channel_publisher = self.channel.sudo(self.user_publisher)
|
|
self.assertEqual(channel_publisher.user_id, self.user_publisher)
|
|
self.assertTrue(channel_publisher.can_upload)
|
|
self.assertTrue(channel_publisher.can_publish)
|
|
|
|
# test upload group limitation
|
|
channel_publisher.write({'upload_group_ids': [(4, self.ref('base.group_system'))]})
|
|
self.assertFalse(channel_publisher.can_upload)
|
|
self.assertFalse(channel_publisher.can_publish)
|
|
channel_publisher.write({'upload_group_ids': [(5, 0)]})
|
|
self.assertTrue(channel_publisher.can_upload)
|
|
self.assertTrue(channel_publisher.can_publish)
|
|
|
|
# share people cannot upload / publish even without limitations
|
|
channel_portal = self.channel.sudo(self.user_portal)
|
|
self.assertFalse(channel_portal.can_upload)
|
|
self.assertFalse(channel_portal.can_publish)
|
|
|
|
# standard people can upload if groups are ok but not publish
|
|
channel_emp = self.channel.sudo(self.user_emp)
|
|
self.assertTrue(channel_emp.can_upload)
|
|
self.assertFalse(channel_emp.can_publish)
|
|
|
|
# test training type limitation (responsible only publish)
|
|
channel_publisher.write({'channel_type': 'training', 'user_id': self.user_emp.id})
|
|
self.assertTrue(channel_publisher.can_upload)
|
|
self.assertFalse(channel_publisher.can_publish)
|
|
# standard people should not be responsible as they still cannot publish
|
|
self.assertTrue(channel_emp.can_upload)
|
|
self.assertFalse(channel_emp.can_publish)
|
|
|
|
# superuser should always be able to publish even if he's not the responsible
|
|
channel_superuser = self.channel.sudo()
|
|
self.assertTrue(channel_superuser.can_upload)
|
|
self.assertTrue(channel_superuser.can_publish)
|