Fix permissions and prepare admin login for deploy
- Admin-only: list contacts, create/edit campaigns and compositions - Public: submit contact, mine contacts by email/phone, read campaigns/compositions - Add admin_response field on ContactUs - Update Postman base_url to https://zoneco.org/api with token save Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Shayan Azadi
216
api/tests.py
216
api/tests.py
@@ -6,13 +6,13 @@ from django.core.files.uploadedfile import SimpleUploadedFile
|
||||
from django.utils import timezone
|
||||
from PIL import Image
|
||||
from rest_framework import status
|
||||
from rest_framework.authtoken.models import Token
|
||||
from rest_framework.test import APITestCase
|
||||
|
||||
from .models import Campaign, Composition, CompositionImage, ContactUs
|
||||
|
||||
|
||||
def make_test_image(name='test.jpg', color='red', size=(100, 100)):
|
||||
"""Create a minimal valid JPEG for upload tests."""
|
||||
buffer = io.BytesIO()
|
||||
Image.new('RGB', size, color=color).save(buffer, format='JPEG')
|
||||
buffer.seek(0)
|
||||
@@ -21,6 +21,14 @@ def make_test_image(name='test.jpg', color='red', size=(100, 100)):
|
||||
|
||||
class ContactUsAPITests(APITestCase):
|
||||
def setUp(self):
|
||||
User = get_user_model()
|
||||
self.admin = User.objects.create_user(
|
||||
username='admin_test',
|
||||
password='test_admin_pass_123',
|
||||
is_staff=True,
|
||||
is_superuser=True,
|
||||
)
|
||||
self.token = Token.objects.create(user=self.admin)
|
||||
self.contact = ContactUs.objects.create(
|
||||
name='Ali Reza',
|
||||
email_or_phone='ali@example.com',
|
||||
@@ -28,12 +36,20 @@ class ContactUsAPITests(APITestCase):
|
||||
category='پشتیبانی',
|
||||
)
|
||||
|
||||
def test_list_contacts(self):
|
||||
def test_list_contacts_requires_admin(self):
|
||||
response = self.client.get('/api/contact-us/')
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
status.HTTP_403_FORBIDDEN,
|
||||
))
|
||||
|
||||
def test_list_contacts_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
response = self.client.get('/api/contact-us/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['count'], 1)
|
||||
|
||||
def test_create_contact(self):
|
||||
def test_create_contact_public(self):
|
||||
payload = {
|
||||
'name': 'Sara',
|
||||
'email_or_phone': '09121234567',
|
||||
@@ -43,69 +59,101 @@ class ContactUsAPITests(APITestCase):
|
||||
response = self.client.post('/api/contact-us/', payload, format='json')
|
||||
self.assertEqual(response.status_code, status.HTTP_201_CREATED)
|
||||
self.assertEqual(ContactUs.objects.count(), 2)
|
||||
self.assertEqual(response.data.get('admin_response'), '')
|
||||
|
||||
def test_retrieve_contact(self):
|
||||
response = self.client.get(f'/api/contact-us/{self.contact.id}/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['name'], 'Ali Reza')
|
||||
def test_public_cannot_set_admin_response_on_create(self):
|
||||
payload = {
|
||||
'name': 'Sara',
|
||||
'email_or_phone': 'sara@example.com',
|
||||
'description': 'Hello',
|
||||
'category': 'سایر',
|
||||
'admin_response': 'should be ignored',
|
||||
}
|
||||
response = self.client.post('/api/contact-us/', payload, format='json')
|
||||
self.assertEqual(response.status_code, status.HTTP_201_CREATED)
|
||||
contact = ContactUs.objects.get(pk=response.data['id'])
|
||||
self.assertEqual(contact.admin_response, '')
|
||||
|
||||
def test_by_category(self):
|
||||
response = self.client.get('/api/contact-us/by_category/?category=پشتیبانی')
|
||||
def test_mine_contacts(self):
|
||||
ContactUs.objects.create(
|
||||
name='Other',
|
||||
email_or_phone='other@example.com',
|
||||
description='x',
|
||||
category='سایر',
|
||||
)
|
||||
response = self.client.get(
|
||||
'/api/contact-us/mine/?email_or_phone=ali@example.com'
|
||||
)
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(len(response.data), 1)
|
||||
self.assertEqual(response.data[0]['email_or_phone'], 'ali@example.com')
|
||||
|
||||
def test_by_category_missing_param(self):
|
||||
response = self.client.get('/api/contact-us/by_category/')
|
||||
def test_mine_requires_email_or_phone(self):
|
||||
response = self.client.get('/api/contact-us/mine/')
|
||||
self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
def test_update_requires_auth(self):
|
||||
response = self.client.patch(
|
||||
f'/api/contact-us/{self.contact.id}/',
|
||||
{'name': 'Updated'},
|
||||
format='json',
|
||||
)
|
||||
def test_by_category_requires_admin(self):
|
||||
response = self.client.get('/api/contact-us/by_category/?category=پشتیبانی')
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
status.HTTP_403_FORBIDDEN,
|
||||
))
|
||||
|
||||
def test_admin_can_reply(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
response = self.client.patch(
|
||||
f'/api/contact-us/{self.contact.id}/',
|
||||
{'admin_response': 'We will help you.'},
|
||||
format='json',
|
||||
)
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['admin_response'], 'We will help you.')
|
||||
|
||||
|
||||
class CompositionAPITests(APITestCase):
|
||||
def setUp(self):
|
||||
User = get_user_model()
|
||||
self.admin = User.objects.create_user(
|
||||
username='testadmin', password='testpass123', is_staff=True
|
||||
username='admin_test',
|
||||
password='test_admin_pass_123',
|
||||
is_staff=True,
|
||||
)
|
||||
self.token = Token.objects.create(user=self.admin)
|
||||
self.composition = Composition.objects.create(
|
||||
name='Test Composition',
|
||||
description='Test description',
|
||||
)
|
||||
|
||||
def test_list_compositions(self):
|
||||
def test_list_compositions_public(self):
|
||||
response = self.client.get('/api/compositions/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['count'], 1)
|
||||
|
||||
def test_create_composition_json(self):
|
||||
def test_create_composition_requires_admin(self):
|
||||
payload = {'name': 'New Comp', 'description': 'Desc'}
|
||||
response = self.client.post('/api/compositions/', payload, format='json')
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
status.HTTP_403_FORBIDDEN,
|
||||
))
|
||||
|
||||
def test_create_composition_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
payload = {'name': 'New Comp', 'description': 'Desc'}
|
||||
response = self.client.post('/api/compositions/', payload, format='json')
|
||||
self.assertEqual(response.status_code, status.HTTP_201_CREATED)
|
||||
self.assertEqual(response.data['name'], 'New Comp')
|
||||
self.assertEqual(response.data['images'], [])
|
||||
|
||||
def test_retrieve_composition(self):
|
||||
def test_retrieve_composition_public(self):
|
||||
response = self.client.get(f'/api/compositions/{self.composition.id}/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertIn('images', response.data)
|
||||
self.assertIn('main_image', response.data)
|
||||
self.assertIn('created_at', response.data)
|
||||
|
||||
def test_by_created_at(self):
|
||||
def test_by_created_at_public(self):
|
||||
now = timezone.now()
|
||||
Composition.objects.create(
|
||||
name='Old Composition',
|
||||
description='Old',
|
||||
)
|
||||
Composition.objects.create(name='Old Composition', description='Old')
|
||||
Composition.objects.filter(name='Old Composition').update(
|
||||
created_at=now - timedelta(days=10)
|
||||
)
|
||||
@@ -118,17 +166,8 @@ class CompositionAPITests(APITestCase):
|
||||
self.assertIn('Test Composition', names)
|
||||
self.assertNotIn('Old Composition', names)
|
||||
|
||||
def test_by_created_at_missing_params(self):
|
||||
response = self.client.get('/api/compositions/by-created-at/')
|
||||
self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
def test_by_created_at_invalid_datetime(self):
|
||||
response = self.client.get(
|
||||
'/api/compositions/by-created-at/?from=not-a-date'
|
||||
)
|
||||
self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
def test_create_with_multiple_images(self):
|
||||
def test_create_with_multiple_images_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
img1 = make_test_image('img1.jpg', 'red')
|
||||
img2 = make_test_image('img2.jpg', 'blue')
|
||||
response = self.client.post(
|
||||
@@ -145,12 +184,8 @@ class CompositionAPITests(APITestCase):
|
||||
self.assertEqual(len(response.data['images']), 2)
|
||||
self.assertTrue(response.data['main_image']['is_main'])
|
||||
|
||||
composition = Composition.objects.get(name='Multi Image')
|
||||
self.assertEqual(composition.images.count(), 2)
|
||||
self.assertEqual(composition.main_image.is_main, True)
|
||||
|
||||
def test_add_images(self):
|
||||
self.client.force_authenticate(user=self.admin)
|
||||
def test_add_images_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
img = make_test_image('added.jpg', 'green')
|
||||
response = self.client.post(
|
||||
f'/api/compositions/{self.composition.id}/add-images/',
|
||||
@@ -159,10 +194,9 @@ class CompositionAPITests(APITestCase):
|
||||
)
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(len(response.data['images']), 1)
|
||||
self.assertTrue(response.data['main_image']['is_main'])
|
||||
|
||||
def test_set_main_image(self):
|
||||
self.client.force_authenticate(user=self.admin)
|
||||
def test_set_main_image_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
img1 = CompositionImage.objects.create(
|
||||
composition=self.composition,
|
||||
image=make_test_image('a.jpg'),
|
||||
@@ -184,8 +218,8 @@ class CompositionAPITests(APITestCase):
|
||||
self.assertFalse(img1.is_main)
|
||||
self.assertTrue(img2.is_main)
|
||||
|
||||
def test_delete_image(self):
|
||||
self.client.force_authenticate(user=self.admin)
|
||||
def test_delete_image_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
img = CompositionImage.objects.create(
|
||||
composition=self.composition,
|
||||
image=make_test_image('del.jpg'),
|
||||
@@ -197,20 +231,16 @@ class CompositionAPITests(APITestCase):
|
||||
self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
|
||||
self.assertFalse(CompositionImage.objects.filter(pk=img.id).exists())
|
||||
|
||||
def test_update_requires_auth(self):
|
||||
response = self.client.patch(
|
||||
f'/api/compositions/{self.composition.id}/',
|
||||
{'name': 'Updated'},
|
||||
format='json',
|
||||
)
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
status.HTTP_403_FORBIDDEN,
|
||||
))
|
||||
|
||||
|
||||
class CampaignAPITests(APITestCase):
|
||||
def setUp(self):
|
||||
User = get_user_model()
|
||||
self.admin = User.objects.create_user(
|
||||
username='admin_test',
|
||||
password='test_admin_pass_123',
|
||||
is_staff=True,
|
||||
)
|
||||
self.token = Token.objects.create(user=self.admin)
|
||||
now = timezone.now()
|
||||
self.active = Campaign.objects.create(
|
||||
name='Active Campaign',
|
||||
@@ -231,12 +261,27 @@ class CampaignAPITests(APITestCase):
|
||||
end_time=now - timedelta(days=5),
|
||||
)
|
||||
|
||||
def test_list_campaigns(self):
|
||||
def test_list_campaigns_public(self):
|
||||
response = self.client.get('/api/campaigns/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['count'], 3)
|
||||
|
||||
def test_create_campaign(self):
|
||||
def test_create_campaign_requires_admin(self):
|
||||
now = timezone.now()
|
||||
payload = {
|
||||
'name': 'New Campaign',
|
||||
'description': 'Desc',
|
||||
'start_time': (now + timedelta(days=1)).isoformat(),
|
||||
'end_time': (now + timedelta(days=3)).isoformat(),
|
||||
}
|
||||
response = self.client.post('/api/campaigns/', payload, format='json')
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
status.HTTP_403_FORBIDDEN,
|
||||
))
|
||||
|
||||
def test_create_campaign_as_admin(self):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {self.token.key}')
|
||||
now = timezone.now()
|
||||
payload = {
|
||||
'name': 'New Campaign',
|
||||
@@ -247,19 +292,16 @@ class CampaignAPITests(APITestCase):
|
||||
response = self.client.post('/api/campaigns/', payload, format='json')
|
||||
self.assertEqual(response.status_code, status.HTTP_201_CREATED)
|
||||
|
||||
def test_retrieve_campaign(self):
|
||||
def test_retrieve_campaign_public(self):
|
||||
response = self.client.get(f'/api/campaigns/{self.active.id}/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertTrue(response.data['is_active'])
|
||||
self.assertFalse(response.data['is_upcoming'])
|
||||
self.assertFalse(response.data['is_ended'])
|
||||
|
||||
def test_active_campaigns(self):
|
||||
response = self.client.get('/api/campaigns/active/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
names = [item['name'] for item in response.data]
|
||||
self.assertIn('Active Campaign', names)
|
||||
self.assertNotIn('Upcoming Campaign', names)
|
||||
|
||||
def test_upcoming_campaigns(self):
|
||||
response = self.client.get('/api/campaigns/upcoming/')
|
||||
@@ -273,17 +315,6 @@ class CampaignAPITests(APITestCase):
|
||||
names = [item['name'] for item in response.data]
|
||||
self.assertIn('Ended Campaign', names)
|
||||
|
||||
def test_create_campaign_invalid_dates(self):
|
||||
now = timezone.now()
|
||||
payload = {
|
||||
'name': 'Bad Dates',
|
||||
'description': 'Desc',
|
||||
'start_time': (now + timedelta(days=3)).isoformat(),
|
||||
'end_time': (now + timedelta(days=1)).isoformat(),
|
||||
}
|
||||
response = self.client.post('/api/campaigns/', payload, format='json')
|
||||
self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
|
||||
class AdminLoginAPITests(APITestCase):
|
||||
def setUp(self):
|
||||
@@ -311,7 +342,6 @@ class AdminLoginAPITests(APITestCase):
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertIn('token', response.data)
|
||||
self.assertEqual(response.data['user']['username'], self.admin_username)
|
||||
self.assertTrue(response.data['user']['is_staff'])
|
||||
|
||||
def test_admin_login_wrong_password(self):
|
||||
response = self.client.post(
|
||||
@@ -341,34 +371,6 @@ class AdminLoginAPITests(APITestCase):
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['username'], self.admin_username)
|
||||
|
||||
def test_admin_me_requires_auth(self):
|
||||
response = self.client.get('/api/admin/me/')
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
status.HTTP_403_FORBIDDEN,
|
||||
))
|
||||
|
||||
def test_token_allows_protected_update(self):
|
||||
contact = ContactUs.objects.create(
|
||||
name='Old Name',
|
||||
email_or_phone='a@b.com',
|
||||
description='msg',
|
||||
category='سایر',
|
||||
)
|
||||
login = self.client.post(
|
||||
'/api/admin/login/',
|
||||
{'username': self.admin_username, 'password': self.admin_password},
|
||||
format='json',
|
||||
)
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {login.data["token"]}')
|
||||
response = self.client.patch(
|
||||
f'/api/contact-us/{contact.id}/',
|
||||
{'name': 'New Name'},
|
||||
format='json',
|
||||
)
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
self.assertEqual(response.data['name'], 'New Name')
|
||||
|
||||
def test_admin_logout(self):
|
||||
login = self.client.post(
|
||||
'/api/admin/login/',
|
||||
@@ -379,8 +381,6 @@ class AdminLoginAPITests(APITestCase):
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f'Token {token}')
|
||||
response = self.client.post('/api/admin/logout/')
|
||||
self.assertEqual(response.status_code, status.HTTP_200_OK)
|
||||
|
||||
# Token should no longer work
|
||||
response = self.client.get('/api/admin/me/')
|
||||
self.assertIn(response.status_code, (
|
||||
status.HTTP_401_UNAUTHORIZED,
|
||||
|
||||
Reference in New Issue
Block a user