Add test that views have oauth scope thing

Author: AlanCoding

test_app/tests/oauth2_provider/test_oauth2_scope_permission_coverage.py

@@ -0,0 +1,157 @@
+# Generated by Claude Sonnet 4
+
+from django.core.checks import ERROR
+
+from ansible_base.oauth2_provider.checks.permisssions_check import oauth2_permission_scope_check
+
+
+def test_all_ansible_base_views_have_oauth2_scope_permission():
+    """
+    Test that all ansible_base views (especially rbac/service_api and resource_registry)
+    have OAuth2ScopePermission when checked against the real URL configuration.
+
+    This complements the mocked tests in test_permissions_check.py by ensuring
+    production views are covered against the real URL configuration.
+    """
+    from django.core.checks import ERROR
+
+    from ansible_base.oauth2_provider.checks.permisssions_check import oauth2_permission_scope_check
+
+    # Call the check function against real URLs (no mocking)
+    messages = oauth2_permission_scope_check(None)
+
+    # Filter to only error messages (missing OAuth2ScopePermission)
+    error_messages = [m for m in messages if m.level == ERROR]
+
+    # Filter to ansible_base views only
+    ansible_base_errors = []
+    for error in error_messages:
+        view_class = error.obj
+        if view_class.__module__.startswith('ansible_base'):
+            ansible_base_errors.append(f"{view_class.__module__}.{view_class.__name__}")
+
+    # If there are any ansible_base views missing OAuth2ScopePermission, fail with complete list
+    if ansible_base_errors:
+        error_list = "\n".join(f"  - {view}" for view in sorted(ansible_base_errors))
+        assert False, f"The following ansible_base views do not have OAuth2ScopePermission:\n{error_list}"
+
+
+def test_ansible_base_views_allowing_write_operations_have_oauth2_scope_permission():
+    """
+    Test that ansible_base views allowing destructive operations (POST, PUT, PATCH, DELETE)
+    have OAuth2ScopePermission. This is critical because read-only tokens should not be able
+    to perform write operations.
+
+    Focuses on views that could allow a read-only token to perform writes if OAuth2ScopePermission
+    is missing.
+    """
+    # Call the check function against real URLs (no mocking)
+    messages = oauth2_permission_scope_check(None)
+
+    # Filter to only error messages (missing OAuth2ScopePermission)
+    error_messages = [m for m in messages if m.level == ERROR]
+
+    # Debug: Print all ansible_base errors and their write capability
+    ansible_base_errors = []
+    debug_info = []
+    for error in error_messages:
+        view_class = error.obj
+        if not view_class.__module__.startswith('ansible_base'):
+            continue
+
+        view_name = f"{view_class.__module__}.{view_class.__name__}"
+        allows_writes = _view_allows_write_operations(view_class)
+        debug_info.append(f"{view_name} - allows_writes: {allows_writes}")
+
+        if allows_writes:
+            ansible_base_errors.append(view_name)
+
+    print("\nDEBUG: All ansible_base views missing OAuth2ScopePermission:")
+    for info in debug_info:
+        print(f"  {info}")
+
+    # Filter to ansible_base views that allow write operations
+    write_capable_errors = ansible_base_errors
+
+    # If there are any write-capable ansible_base views missing OAuth2ScopePermission, fail
+    if write_capable_errors:
+        error_list = "\n".join(f"  - {view}" for view in sorted(write_capable_errors))
+        assert False, f"The following ansible_base views allow write operations but do not have OAuth2ScopePermission:\n{error_list}"
+
+
+def _view_allows_write_operations(view_class):
+    """
+    Determine if a view class allows write operations (POST, PUT, PATCH, DELETE).
+
+    Returns True if the view could potentially allow destructive operations.
+    """
+    from rest_framework import mixins
+    from rest_framework.viewsets import ViewSet
+
+    # Check if it's a standard ViewSet (which typically allows all operations)
+    if issubclass(view_class, ViewSet) and not hasattr(view_class, 'queryset'):
+        # Standard ViewSet - check if it has write methods defined
+        write_methods = {'post', 'put', 'patch', 'delete', 'create', 'update', 'partial_update', 'destroy'}
+        view_methods = {method.lower() for method in dir(view_class)}
+        if write_methods.intersection(view_methods):
+            return True
+
+    # Check for DRF mixins that enable write operations
+    write_mixins = [
+        mixins.CreateModelMixin,
+        mixins.UpdateModelMixin,
+        mixins.DestroyModelMixin,
+    ]
+
+    for mixin in write_mixins:
+        if issubclass(view_class, mixin):
+            return True
+
+    # Check for custom action decorators that might allow POST
+    if hasattr(view_class, 'get_extra_actions'):
+        try:
+            actions = view_class.get_extra_actions()
+            for action in actions:
+                # Check if action allows POST/PUT/PATCH/DELETE
+                if hasattr(action, 'methods'):
+                    methods = [m.upper() for m in action.methods]
+                    if any(method in ['POST', 'PUT', 'PATCH', 'DELETE'] for method in methods):
+                        return True
+        except Exception:
+            # If we can't determine actions, err on the side of caution
+            pass
+
+    # If we can't determine or it only has read methods, assume it's read-only
+    return False
+
+
+def test_missing_permission_detection():
+    """
+    Test that the test correctly identifies views missing OAuth2ScopePermission.
+    This test temporarily patches a view to remove the permission and ensures it gets detected.
+    """
+    import copy
+    from unittest import mock
+
+    from django.core.checks import ERROR
+    from rest_framework.permissions import IsAuthenticated
+
+    from ansible_base.oauth2_provider.checks.permisssions_check import oauth2_permission_scope_check
+    from test_app.views import UserViewSet
+
+    # Create a patched version of UserViewSet without OAuth2ScopePermission
+    PatchedUserViewSet = copy.deepcopy(UserViewSet)
+    PatchedUserViewSet.permission_classes = [IsAuthenticated]  # Remove OAuth2ScopePermission
+
+    # Mock the UserViewSet in test_app.views to use our patched version
+    with mock.patch("test_app.views.UserViewSet", PatchedUserViewSet):
+        # Call the check function
+        messages = oauth2_permission_scope_check(None)
+
+        # Filter to only error messages
+        error_messages = [m for m in messages if m.level == ERROR]
+
+        # Check that our patched UserViewSet is detected as missing the permission
+        user_viewset_errors = [error for error in error_messages if error.obj.__name__ == 'UserViewSet' and 'test_app' in error.obj.__module__]
+
+        assert len(user_viewset_errors) == 1, f"Expected exactly 1 error for test_app.views.UserViewSet, but got {len(user_viewset_errors)}"