External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-19 14:57:39 -02:30
Code Issues Packages Projects Releases Wiki Activity

Added remaining sec tests for adding subobjects to collection.

Browse Source
This commit is contained in:
Michael DeHaan
2013-03-23 15:08:02 -04:00
parent a1c614500c
commit 284c495c11
4 changed files with 21 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/main/base_views.py
View File

@@ -54,7 +54,7 @@ class BaseSubList(BaseList):
relationship = getattr(main, self.__class__.relationship) relationship = getattr(main, self.__class__.relationship)
if not 'disassociate' in request.DATA: if not 'disassociate' in request.DATA:
if not request.user.is_superuser or not self.__class__.parent_model.can_user_attach(request.user, main, sub, self.__class__.relationship): if not request.user.is_superuser and not self.__class__.parent_model.can_user_attach(request.user, main, sub, self.__class__.relationship):
raise PermissionDenied() raise PermissionDenied()
if sub in relationship.all(): if sub in relationship.all():
return Response(status=status.HTTP_409_CONFLICT) return Response(status=status.HTTP_409_CONFLICT)

14
lib/main/models/__init__.py
View File

@@ -53,15 +53,14 @@ class CommonModel(models.Model):
''' whether you can add sub_obj to obj using the relationship type in a subobject view ''' ''' whether you can add sub_obj to obj using the relationship type in a subobject view '''
if relationship in [ 'projects', 'admins', 'users' ]: if relationship in [ 'projects', 'admins', 'users' ]:
if not sub_obj.can_user_read(user, sub_obj): if not sub_obj.can_user_read(user, sub_obj):
print "DEBUG: can't attach"
return False return False
print "DEBUG: defer" rc = cls.can_user_administrate(user, obj)
return cls.can_user_administrate(user, obj) return rc
raise Exception("unknown relationship type: %s" % relationship) raise Exception("unknown relationship type: %s" % relationship)
@classmethod @classmethod
def can_user_unattach(cls, user, obj, sub_obj, relationship): def can_user_unattach(cls, user, obj, sub_obj, relationship):
print "DEBUG: CUA?"
return cls.can_user_administrate(user, obj) return cls.can_user_administrate(user, obj)
class Tag(models.Model): class Tag(models.Model):
@@ -120,13 +119,14 @@ class Organization(CommonModel):
# FIXME: super user checks should be higher up so we don't have to repeat them # FIXME: super user checks should be higher up so we don't have to repeat them
if user.is_superuser: if user.is_superuser:
return True return True
if obj.created_by == user:
return True
rc = user in obj.admins.all() rc = user in obj.admins.all()
return rc return rc
@classmethod @classmethod
def can_user_read(cls, user, obj): def can_user_read(cls, user, obj):
rc = cls.can_user_administrate(user,obj) or user in obj.users.all() return cls.can_user_administrate(user,obj) or user in obj.users.all()
return rc
@classmethod @classmethod
def can_user_delete(cls, user, obj): def can_user_delete(cls, user, obj):
@@ -250,6 +250,8 @@ class Project(CommonModel):
def can_user_administrate(cls, user, obj): def can_user_administrate(cls, user, obj):
if user.is_superuser: if user.is_superuser:
return True return True
if obj.created_by == user:
return True
organizations = Organization.objects.filter(admins__in = [ user ], projects__in = [ obj ]) organizations = Organization.objects.filter(admins__in = [ user ], projects__in = [ obj ])
for org in organizations: for org in organizations:
if org in project.organizations(): if org in project.organizations():

4
lib/main/rbac.py
View File

@@ -13,7 +13,6 @@ class CustomRbac(permissions.BasePermission):
# no anonymous users # no anonymous users
if request.user.is_anonymous(): if request.user.is_anonymous():
# 401, not 403, hence no raised exception # 401, not 403, hence no raised exception
print "PD4"
return False return False
# superusers are always good # superusers are always good
if request.user.is_superuser: if request.user.is_superuser:
@@ -31,7 +30,6 @@ class CustomRbac(permissions.BasePermission):
if request.user.is_superuser: if request.user.is_superuser:
return True return True
if not view.list_permissions_check(request): if not view.list_permissions_check(request):
print "DEBUG: PD1"
raise PermissionDenied() raise PermissionDenied()
elif not getattr(view, 'item_permissions_check', None): elif not getattr(view, 'item_permissions_check', None):
raise Exception("internal error, list_permissions_check or item_permissions_check must be defined") raise Exception("internal error, list_permissions_check or item_permissions_check must be defined")
@@ -44,11 +42,9 @@ class CustomRbac(permissions.BasePermission):
if request.user.is_superuser: if request.user.is_superuser:
return True return True
if not self._common_user_check(request): if not self._common_user_check(request):
print "DEBUG: PD2"
return False return False
if not obj.active: if not obj.active:
raise Http404() raise Http404()
if not view.item_permissions_check(request, obj): if not view.item_permissions_check(request, obj):
print "DEBUG: PD3"
raise PermissionDenied() raise PermissionDenied()
return True return True

23
lib/main/tests.py
View File

@@ -16,6 +16,7 @@ import django.test
from django.test.client import Client from django.test.client import Client
from lib.main.models import * from lib.main.models import *
class BaseTest(django.test.TestCase): class BaseTest(django.test.TestCase):
def make_user(self, username, password, super_user=False): def make_user(self, username, password, super_user=False):
@@ -29,8 +30,9 @@ class BaseTest(django.test.TestCase):
def make_organizations(self, created_by, count=1): def make_organizations(self, created_by, count=1):
results = [] results = []
for x in range(0, count): for x in range(0, count):
self.object_ctr = self.object_ctr + 1
results.append(Organization.objects.create( results.append(Organization.objects.create(
name="org%s" % x, name="org%s-%s" % (x, self.object_ctr),
description="org%s" % x, description="org%s" % x,
created_by=created_by created_by=created_by
)) ))
@@ -39,8 +41,9 @@ class BaseTest(django.test.TestCase):
def make_projects(self, created_by, count=1): def make_projects(self, created_by, count=1):
results = [] results = []
for x in range(0, count): for x in range(0, count):
self.object_ctr = self.object_ctr + 1
results.append(Project.objects.create( results.append(Project.objects.create(
name="proj%s" % x, name="proj%s-%s" % (x, self.object_ctr),
description="proj%s" % x, description="proj%s" % x,
scm_type='git', scm_type='git',
default_playbook='foo.yml', default_playbook='foo.yml',
@@ -127,6 +130,7 @@ class OrganizationsTest(BaseTest):
return '/api/v1/organizations/' return '/api/v1/organizations/'
def setUp(self): def setUp(self):
self.object_ctr = 0
self.setup_users() self.setup_users()
self.organizations = self.make_organizations(self.super_django_user, 10) self.organizations = self.make_organizations(self.super_django_user, 10)
@@ -274,7 +278,7 @@ class OrganizationsTest(BaseTest):
# find projects attached to the first org # find projects attached to the first org
projects0_url = orgs['results'][0]['related']['projects'] projects0_url = orgs['results'][0]['related']['projects']
projects1_url = orgs['results'][1]['related']['projects'] projects1_url = orgs['results'][1]['related']['projects']
projects2_url = orgs['results'][1]['related']['projects'] projects2_url = orgs['results'][2]['related']['projects']
# get all the projects on the first org # get all the projects on the first org
projects0 = self.get(projects0_url, expect=200, auth=self.get_super_credentials()) projects0 = self.get(projects0_url, expect=200, auth=self.get_super_credentials())
@@ -301,12 +305,9 @@ class OrganizationsTest(BaseTest):
self.assertEquals(projects1['count'], 5) self.assertEquals(projects1['count'], 5)
# FIXME: need to add tests for associating and disassocating from a non-priveledged acct # FIXME: need to add tests for associating and disassocating from a non-priveledged acct
print projects1_url
a_project = projects1['results'][-1] a_project = projects1['results'][-1]
a_project['disassociate'] = 1 a_project['disassociate'] = 1
projects1 = self.get(projects1_url, expect=200, auth=self.get_super_credentials()) projects1 = self.get(projects1_url, expect=200, auth=self.get_super_credentials())
print "GOT: %s" % projects1
print "POSTING: %s" % a_project
self.post(projects1_url, a_project, expect=204, auth=self.get_normal_credentials()) self.post(projects1_url, a_project, expect=204, auth=self.get_normal_credentials())
projects1 = self.get(projects1_url, expect=200, auth=self.get_super_credentials()) projects1 = self.get(projects1_url, expect=200, auth=self.get_super_credentials())
self.assertEquals(projects1['count'], 4) self.assertEquals(projects1['count'], 4)
@@ -314,16 +315,16 @@ class OrganizationsTest(BaseTest):
new_project_a = self.make_projects(self.normal_django_user, 1)[0] new_project_a = self.make_projects(self.normal_django_user, 1)[0]
new_project_b = self.make_projects(self.other_django_user, 1)[0] new_project_b = self.make_projects(self.other_django_user, 1)[0]
# admin of org can add projects he can read # admin of org can add projects that he can read
self.post(projects1_url, dict(id=new_project_a['id']), expect=204, auth=self.get_normal_credentials()) self.post(projects1_url, dict(id=new_project_a.pk), expect=204, auth=self.get_normal_credentials())
# but not those he cannot # but not those he cannot
self.post(projects1_url, dict(id=new_project_b['id']), expect=403, auth=self.get_normal_credentials()) self.post(projects1_url, dict(id=new_project_b.pk), expect=403, auth=self.get_normal_credentials())
# and can't post a project he can read to an org he cannot # and can't post a project he can read to an org he cannot
self.post(projects2_url, dict(id=new_project_a['id']), expect=403, auth=self.get_normal_credentials()) # self.post(projects2_url, dict(id=new_project_a.pk), expect=403, auth=self.get_normal_credentials())
# and can't do post a project he can read to an organization he cannot # and can't do post a project he can read to an organization he cannot
self.post(projects2_url, dict(id=new_project_a['id']), expect=403, auth=self.get_normal_credentials()) self.post(projects2_url, dict(id=new_project_a.pk), expect=403, auth=self.get_normal_credentials())
def test_post_item_subobjects_users(self): def test_post_item_subobjects_users(self):