1
1
import json
2
+ from unittest import skipIf
2
3
3
4
from unittest .mock import patch
4
5
from django .test import override_settings
9
10
10
11
from oscarapi .basket .operations import get_basket , get_user_basket
11
12
from oscarapi .tests .utils import APITest
13
+ from oscarapi import settings
12
14
13
15
14
16
Basket = get_model ("basket" , "Basket" )
@@ -49,7 +51,8 @@ def test_basket_api_create_not_possible(self):
49
51
50
52
# authenticated
51
53
self .login ("nobody" , "nobody" )
52
- data = {"owner" : "http://testserver%s" % reverse ("user-detail" , args = [2 ])}
54
+ data = {"owner" : "http://testserver%s" %
55
+ reverse ("user-detail" , args = [2 ])}
53
56
54
57
self .response = self .client .post (
55
58
url , json .dumps (data ), content_type = "application/json"
@@ -61,7 +64,8 @@ def test_basket_api_create_not_possible(self):
61
64
# admin
62
65
self .login ("admin" , "admin" )
63
66
64
- data = {"owner" : "http://testserver%s" % reverse ("user-detail" , args = [1 ])}
67
+ data = {"owner" : "http://testserver%s" %
68
+ reverse ("user-detail" , args = [1 ])}
65
69
self .response = self .client .post (
66
70
url , json .dumps (data ), content_type = "application/json"
67
71
)
@@ -124,23 +128,27 @@ def test_retrieve_basket_header(self):
124
128
125
129
# authenticated
126
130
self .hlogin ("nobody" , "nobody" , session_id = "nobody" )
127
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
131
+ self .response = self .get (
132
+ "api-basket" , session_id = "nobody" , authenticated = True )
128
133
self .response .assertStatusEqual (200 )
129
134
self .response .assertObjectIdEqual ("owner" , 2 )
130
135
basket_id = self .response ["id" ]
131
136
132
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
137
+ self .response = self .get (
138
+ "api-basket" , session_id = "nobody" , authenticated = True )
133
139
self .response .assertStatusEqual (200 )
134
140
self .response .assertValueEqual ("id" , basket_id )
135
141
136
142
# admin
137
143
self .hlogin ("admin" , "admin" , session_id = "admin" )
138
- self .response = self .get ("api-basket" , session_id = "admin" , authenticated = True )
144
+ self .response = self .get (
145
+ "api-basket" , session_id = "admin" , authenticated = True )
139
146
self .response .assertStatusEqual (200 )
140
147
self .response .assertObjectIdEqual ("owner" , 1 )
141
148
basket_id = self .response ["id" ]
142
149
143
- self .response = self .get ("api-basket" , session_id = "admin" , authenticated = True )
150
+ self .response = self .get (
151
+ "api-basket" , session_id = "admin" , authenticated = True )
144
152
self .response .assertStatusEqual (200 )
145
153
self .response .assertValueEqual ("id" , basket_id )
146
154
@@ -234,7 +242,8 @@ def test_basket_read_permissions(self):
234
242
235
243
url = reverse ("basket-lines-list" , args = (1 ,))
236
244
self .response = self .client .get (url )
237
- self .response .assertStatusEqual (403 , "Users not access other peoples baskets." )
245
+ self .response .assertStatusEqual (
246
+ 403 , "Users not access other peoples baskets." )
238
247
239
248
self .assertEqual (
240
249
Basket .objects .count (),
@@ -286,7 +295,8 @@ def test_basket_read_permissions_header(self):
286
295
287
296
# now try for authenticated user.
288
297
self .hlogin ("nobody" , "nobody" , session_id = "nobody" )
289
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
298
+ self .response = self .get (
299
+ "api-basket" , session_id = "nobody" , authenticated = True )
290
300
self .response .assertStatusEqual (200 )
291
301
292
302
# try to access the urls in the response.
@@ -321,7 +331,8 @@ def test_basket_read_permissions_header(self):
321
331
)
322
332
323
333
self .hlogin ("admin" , "admin" , session_id = "admin" )
324
- self .response = self .get ("api-basket" , session_id = "admin" , authenticated = True )
334
+ self .response = self .get (
335
+ "api-basket" , session_id = "admin" , authenticated = True )
325
336
self .response .assertStatusEqual (200 )
326
337
327
338
# try to access the urls in the response.
@@ -560,7 +571,8 @@ def test_basket_write_permissions_header_authenticated(self):
560
571
561
572
# now try for authenticated user.
562
573
self .hlogin ("nobody" , "nobody" , session_id = "nobody" )
563
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
574
+ self .response = self .get (
575
+ "api-basket" , session_id = "nobody" , authenticated = True )
564
576
self .response .assertStatusEqual (200 )
565
577
566
578
# try to access the urls in the response.
@@ -606,11 +618,13 @@ def test_basket_write_permissions_header_authenticated(self):
606
618
self .response .assertStatusEqual (201 )
607
619
608
620
# throw the basket away
609
- self .response = self .delete (url , session_id = "nobody" , authenticated = True )
621
+ self .response = self .delete (
622
+ url , session_id = "nobody" , authenticated = True )
610
623
self .response .assertStatusEqual (204 )
611
624
612
625
# now lets start messing around
613
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
626
+ self .response = self .get (
627
+ "api-basket" , session_id = "nobody" , authenticated = True )
614
628
self .response .assertStatusEqual (200 )
615
629
basket_id = self .response ["id" ]
616
630
@@ -650,7 +664,8 @@ def test_basket_write_permissions_header_authenticated(self):
650
664
self .response .assertStatusEqual (403 )
651
665
652
666
# try to delete someone else's basket
653
- self .response = self .delete (url , session_id = "nobody" , authenticated = True )
667
+ self .response = self .delete (
668
+ url , session_id = "nobody" , authenticated = True )
654
669
self .response .assertStatusEqual (403 )
655
670
656
671
# try adding lines to someone else's basket
@@ -739,7 +754,8 @@ def test_basket_write_permissions_admin(self):
739
754
740
755
# try to write to someone else's basket by sending the primary key
741
756
# along.
742
- self .response = self .put (url , status = "Saved" , id = somebody_basket_id )
757
+ self .response = self .put (
758
+ url , status = "Saved" , id = somebody_basket_id )
743
759
self .response .assertStatusEqual (200 )
744
760
self .response .assertValueEqual (
745
761
"id" , basket_id , "Primary key value can not be changed."
@@ -775,7 +791,8 @@ def test_basket_write_permissions_header_admin(self):
775
791
776
792
# now try for authenticated user.
777
793
self .hlogin ("admin" , "admin" , session_id = "admin" )
778
- self .response = self .get ("api-basket" , session_id = "admin" , authenticated = True )
794
+ self .response = self .get (
795
+ "api-basket" , session_id = "admin" , authenticated = True )
779
796
self .response .assertStatusEqual (200 )
780
797
781
798
# try to access the urls in the response.
@@ -821,11 +838,13 @@ def test_basket_write_permissions_header_admin(self):
821
838
self .response .assertStatusEqual (201 )
822
839
823
840
# throw the basket away
824
- self .response = self .delete (url , session_id = "admin" , authenticated = True )
841
+ self .response = self .delete (
842
+ url , session_id = "admin" , authenticated = True )
825
843
self .response .assertStatusEqual (204 )
826
844
827
845
# now lets start messing around
828
- self .response = self .get ("api-basket" , session_id = "admin" , authenticated = True )
846
+ self .response = self .get (
847
+ "api-basket" , session_id = "admin" , authenticated = True )
829
848
self .response .assertStatusEqual (200 )
830
849
basket_id = self .response ["id" ]
831
850
@@ -882,7 +901,8 @@ def test_basket_write_permissions_header_admin(self):
882
901
self .response .assertStatusEqual (403 )
883
902
884
903
# try to delete someone else's basket
885
- self .response = self .delete (url , session_id = "admin" , authenticated = True )
904
+ self .response = self .delete (
905
+ url , session_id = "admin" , authenticated = True )
886
906
self .response .assertStatusEqual (403 )
887
907
888
908
def test_add_product_anonymous (self ):
@@ -929,7 +949,8 @@ def test_add_product_basket_addition_signal_send(self, mock):
929
949
self .assertTrue (mock .called )
930
950
931
951
signal_arguments = mock .call_args [1 ]
932
- self .assertEqual (signal_arguments ["product" ], Product .objects .get (pk = 1 ))
952
+ self .assertEqual (
953
+ signal_arguments ["product" ], Product .objects .get (pk = 1 ))
933
954
self .assertEqual (signal_arguments ["user" ].username , "nobody" )
934
955
935
956
# see if we can get the basket from the request
@@ -953,7 +974,8 @@ def test_basket_line_permissions(self):
953
974
954
975
self .response = self .get (line0url )
955
976
self .response .assertStatusEqual (200 )
956
- self .response .assertValueEqual ("product" , "http://testserver/api/products/1/" )
977
+ self .response .assertValueEqual (
978
+ "product" , "http://testserver/api/products/1/" )
957
979
self .response .assertValueEqual ("quantity" , 5 )
958
980
959
981
# now let's try to cheat
@@ -964,7 +986,8 @@ def test_basket_line_permissions(self):
964
986
def test_basket_line_permissions_header (self ):
965
987
"A user's Basket lines can not be viewed by another user in any way, even with header authentication"
966
988
self .hlogin ("nobody" , "nobody" , session_id = "nobody" )
967
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
989
+ self .response = self .get (
990
+ "api-basket" , session_id = "nobody" , authenticated = True )
968
991
self .response .assertStatusEqual (200 )
969
992
970
993
self .response = self .post (
@@ -981,14 +1004,17 @@ def test_basket_line_permissions_header(self):
981
1004
line0 = self .response .body [0 ]
982
1005
line0url = line0 ["url" ]
983
1006
984
- self .response = self .get (line0url , session_id = "nobody" , authenticated = True )
1007
+ self .response = self .get (
1008
+ line0url , session_id = "nobody" , authenticated = True )
985
1009
self .response .assertStatusEqual (200 )
986
- self .response .assertValueEqual ("product" , "http://testserver/api/products/1/" )
1010
+ self .response .assertValueEqual (
1011
+ "product" , "http://testserver/api/products/1/" )
987
1012
self .response .assertValueEqual ("quantity" , 5 )
988
1013
989
1014
# now let's try to cheat
990
1015
self .hlogin ("somebody" , "somebody" , session_id = "somebody" )
991
- self .response = self .get (line0url , session_id = "somebody" , authenticated = True )
1016
+ self .response = self .get (
1017
+ line0url , session_id = "somebody" , authenticated = True )
992
1018
self .response .assertStatusEqual (404 )
993
1019
994
1020
def test_frozen_basket_can_not_be_accessed (self ):
@@ -1009,7 +1035,8 @@ def test_frozen_basket_can_not_be_accessed(self):
1009
1035
def test_frozen_basket_can_not_be_accessed_header (self ):
1010
1036
"Prove that frozen baskets can no longer be accessed by the user, even with header authentication"
1011
1037
self .hlogin ("nobody" , "nobody" , session_id = "nobody" )
1012
- self .response = self .get ("api-basket" , session_id = "nobody" , authenticated = True )
1038
+ self .response = self .get (
1039
+ "api-basket" , session_id = "nobody" , authenticated = True )
1013
1040
self .response .assertStatusEqual (200 )
1014
1041
self .response .assertValueEqual ("status" , "Open" )
1015
1042
@@ -1149,6 +1176,7 @@ def test_get_user_basket_with_multiple_baskets(self):
1149
1176
self .assertEqual (user_basket , Basket .open .first ())
1150
1177
1151
1178
1179
+ @skipIf (settings .BLOCK_ADMIN_API_ACCESS , "Admin API is enabled" )
1152
1180
class BasketAdminTest (APITest ):
1153
1181
"""
1154
1182
Test suite for admin basket list operations.
@@ -1349,15 +1377,17 @@ def test_basket_login_logout(self):
1349
1377
self .client .cookies ,
1350
1378
"An basket cookie should have been created" ,
1351
1379
)
1352
- self .assertStartsWith (self .client .cookies ["oscar_open_basket" ].value , "1" )
1380
+ self .assertStartsWith (
1381
+ self .client .cookies ["oscar_open_basket" ].value , "1" )
1353
1382
1354
1383
# retrieve the basket with oscarapi.
1355
1384
self .response = self .get ("api-basket" )
1356
1385
self .response .assertValueEqual (
1357
1386
"owner" , None , "The basket should not have an owner"
1358
1387
)
1359
1388
self .response .assertValueEqual ("id" , 1 )
1360
- self .assertStartsWith (self .client .cookies ["oscar_open_basket" ].value , "1" )
1389
+ self .assertStartsWith (
1390
+ self .client .cookies ["oscar_open_basket" ].value , "1" )
1361
1391
1362
1392
# now lets log in with oscarapi
1363
1393
response = self .post ("api-login" , username = "nobody" , password = "nobody" )
0 commit comments