79 lines
4.2 KiB
Python
79 lines
4.2 KiB
Python
|
"""Real HTTP coverage for scoped cultural and property records."""
|
||
|
|
import json
|
||
|
|
import unittest
|
||
|
|
from test_app import app
|
||
|
|
import test_households as fixture
|
||
|
|
|
||
|
|
|
||
|
|
class HeritageTests(unittest.TestCase):
|
||
|
|
setUp = fixture.HouseholdTests.setUp
|
||
|
|
stop_server = fixture.HouseholdTests.stop_server
|
||
|
|
request = fixture.HouseholdTests.request
|
||
|
|
|
||
|
|
def create(self, **fields):
|
||
|
|
data = dict(name='家书', kind='culture'); data.update(fields)
|
||
|
|
code, row = self.request('/api/heritage', data=data)
|
||
|
|
self.assertEqual(code, 200, row)
|
||
|
|
return row
|
||
|
|
|
||
|
|
def allow(self, level):
|
||
|
|
user = app.get_object('users', self.members[self.aid]['id'])
|
||
|
|
user['heritageAccess'] = level
|
||
|
|
app.save_object('users', user)
|
||
|
|
return user
|
||
|
|
|
||
|
|
def test_genealogy_access_does_not_grant_property_access(self):
|
||
|
|
self.create()
|
||
|
|
member = self.members[self.aid]
|
||
|
|
self.assertEqual(self.request('/api/family', member)[0], 200)
|
||
|
|
self.assertEqual(self.request('/api/heritage', member)[0], 403)
|
||
|
|
self.assertEqual(self.request('/api/heritage', member, dict(name='x', kind='asset'))[0], 403)
|
||
|
|
reader = self.allow('read')
|
||
|
|
self.assertEqual(len(self.request('/api/heritage', reader)[1]['entries']), 1)
|
||
|
|
self.assertFalse(self.request('/api/heritage', reader)[1]['canEdit'])
|
||
|
|
self.assertEqual(self.request('/api/heritage', reader, dict(name='x', kind='asset'))[0], 403)
|
||
|
|
|
||
|
|
def test_cross_household_reads_edits_and_device_references_are_rejected(self):
|
||
|
|
row = self.create()
|
||
|
|
self.assertEqual(self.request('/api/heritage', self.other)[1]['entries'], [])
|
||
|
|
self.assertIn(self.request('/api/heritage', self.other, row)[0], (403,404))
|
||
|
|
self.assertEqual(self.request('/api/heritage', data=dict(name='x', kind='culture',
|
||
|
|
deviceId=self.assets[self.bid]['id'], deviceSource='camera'))[0], 404)
|
||
|
|
self.assertEqual(self.request('/api/heritage', self.owner, home=self.bid)[0], 403)
|
||
|
|
|
||
|
|
def test_revision_archive_and_restore(self):
|
||
|
|
row = self.create()
|
||
|
|
editor = self.allow('edit')
|
||
|
|
code, archived = self.request('/api/heritage', editor, dict(row, archived=True))
|
||
|
|
self.assertEqual(code, 200);self.assertEqual(archived['revision'], 2)
|
||
|
|
self.assertEqual(self.request('/api/heritage', editor, row)[0], 409)
|
||
|
|
code, restored = self.request('/api/heritage', editor, dict(archived, archived=False))
|
||
|
|
self.assertEqual(code, 200);self.assertFalse(restored['archived'])
|
||
|
|
self.assertEqual(restored['revision'], 3)
|
||
|
|
|
||
|
|
def test_validation_and_non_home_scope(self):
|
||
|
|
for values in [dict(sourceUrl='javascript:alert(1)'),dict(sourceUrl='https://user:pass@example.com'),
|
||
|
|
dict(date='2026-02-30'),dict(archived='false'),dict(kind='unsupported')]:
|
||
|
|
data=dict(name='x',kind='culture');data.update(values)
|
||
|
|
self.assertEqual(self.request('/api/heritage',data=data)[0],400)
|
||
|
|
home=app.get_object('households',self.bid)
|
||
|
|
app.HOUSEHOLDS.save(dict(home,kind='office'),self.root)
|
||
|
|
self.assertEqual(self.request('/api/heritage',self.other)[0],403)
|
||
|
|
|
||
|
|
def test_handover_intent_never_changes_accounts_or_device_ownership(self):
|
||
|
|
users=json.dumps(app.objects('users'),sort_keys=True)
|
||
|
|
devices=json.dumps(app.objects('assets'),sort_keys=True)
|
||
|
|
row=self.create(kind='asset',ownerName='甲',custodianName='乙',successorName='丙',handoverNote='记录意愿')
|
||
|
|
self.assertEqual(row['successorName'],'丙')
|
||
|
|
self.assertEqual(json.dumps(app.objects('users'),sort_keys=True),users)
|
||
|
|
self.assertEqual(json.dumps(app.objects('assets'),sort_keys=True),devices)
|
||
|
|
|
||
|
|
def test_new_permission_revokes_session_and_editor_needs_device_grant(self):
|
||
|
|
member=app.get_object('users',self.members[self.aid]['id'])
|
||
|
|
app.ACCOUNTS.save(dict(member,heritageAccess='edit'),self.root)
|
||
|
|
self.assertEqual(self.request('/api/heritage',member)[0],401)
|
||
|
|
member=app.get_object('users',member['id']);member['siteIds']=[]
|
||
|
|
app.save_object('users',member)
|
||
|
|
with self.assertRaises(app.Problem):
|
||
|
|
app.HERITAGE.save(dict(name='未授权设备',kind='asset',deviceSource='camera',deviceId=self.assets[self.aid]['id']),member)
|