feat(reviews): implement Review endpoints with serializers and enhanced testing

- Added ReviewViewSet for handling review operations on products
- Implemented ReviewSerializer for review data validation and transformation
- Established complete CRUD endpoints for product reviews
- Improved documentation for better clarity on review functionality
- Rebuilt and enhanced test suites across all apps to reflect recent improvements
- Ensured test coverage accounts for latest changes from previous pushes

The review system is now fully integrated with products, providing users
the ability to create, read, update, and delete their product reviews.

Author: Yosef-AlSabbah

.gitignore

@@ -15,7 +15,7 @@
 
 class CartTests(TestCase):
     def setUp(self):
-        self.user = User.objects.create_user(username='testuser', password='testpass')
+        self.user = User.objects.create_user(username='testuser', password='testpass', email='[email protected]')
         self.category = Category.objects.create(name='Test Category')
         self.product = Product.objects.create(
             user=self.user,
@@ -53,7 +53,7 @@ def test_get_total_price(self):
 
 class CartAPITests(APITestCase):
     def setUp(self):
-        self.user = User.objects.create_user(username='testuser', password='testpass')
+        self.user = User.objects.create_user(username='testuser', password='testpass', email='[email protected]')
         self.category = Category.objects.create(name='Test Category')
         self.product = Product.objects.create(
             user=self.user,
@@ -62,7 +62,7 @@ def setUp(self):
             stock=100,
             category=self.category
         )
-        self.cart_url = reverse('api-v1:cart')
+        self.cart_url = reverse('api-v1:cart-list')
         self.client.login(username='testuser', password='testpass')
 
     def test_get_cart(self):
@@ -73,17 +73,17 @@ def test_get_cart(self):
 
     def test_add_product_to_cart(self):
         response = self.client.post(
-            reverse('api-v1:cart-product', kwargs={'product_id': self.product.product_id}),
+            reverse('api-v1:cart-add-to-cart', kwargs={'product_id': self.product.product_id}),
             data={'quantity': 2}
         )
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data['message'], 'Product added/updated in cart')
 
     def test_remove_product_from_cart(self):
         self.client.post(
-            reverse('api-v1:cart-product', kwargs={'product_id': self.product.product_id}),
+            reverse('api-v1:cart-add-to-cart', kwargs={'product_id': self.product.product_id}),
             data={'quantity': 2}
         )
-        response = self.client.delete(reverse('api-v1:cart-product', kwargs={'product_id': self.product.product_id}))
+        response = self.client.delete(reverse('api-v1:cart-remove-from-cart', kwargs={'product_id': self.product.product_id}))
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data['message'], 'Product removed from cart')

cart/tests.py

@@ -1,9 +1,10 @@
 [uwsgi]
-socket=/code/ecommerce_api/uwsgi_app.sock
-chdir = /code/ecommerce_api/
-module=ecommerce_api.wsgi:application
-master=true
-chmod-socket=666
-uid=www-data
-gid=www-data
-vacuum=true
+socket = /code/ecommerce_api/uwsgi_app.sock
+http = :8000
+chdir = /code
+module = ecommerce_api.wsgi:application
+master = true
+chmod-socket = 666
+uid = www-data
+gid = www-data
+vacuum = true

config/uwsgi/uwsgi.ini

@@ -280,6 +280,10 @@
             "name": "Cart",
             "description": "Endpoints for managing the shopping cart."
         },
+        {
+            "name": "Reviews",
+            "description": "Endpoints for managing product reviews."
+        }
     ],
     # Authentication configuration
     "SECURITY": [
@@ -298,7 +302,7 @@
 CACHES = {
     "default": {
         "BACKEND": "django_redis.cache.RedisCache",
-        "LOCATION": "redis://cache:6379/1",  # use 'cache' service name
+        "LOCATION": f"redis://{config('REDIS_HOST')}:6379/1",  # use 'cache' service name
         "OPTIONS": {
             "CLIENT_CLASS": "django_redis.client.DefaultClient",
         }
@@ -309,7 +313,7 @@
     'default': {
         'BACKEND': 'channels_redis.core.RedisChannelLayer',
         'CONFIG': {
-            'hosts': [('cache', 6379)],  # use 'cache' service name
+            'hosts': [(config('REDIS_HOST'), 6379)],  # use 'cache' service name
         },
     },
 }
@@ -413,4 +417,4 @@
 DOMAIN = config('DOMAIN')
 SITE_NAME = config('SITE_NAME')
 
-TAGGIT_CASE_INSENSITIVE = True
+TAGGIT_CASE_INSENSITIVE = True

ecommerce_api/settings/base.py

@@ -0,0 +1,11 @@
+from rest_framework import permissions
+
+
+class IsAdminOrOwner(permissions.BasePermission):
+    def has_object_permission(self, request, view, obj):
+        if request.user and request.user.is_staff:
+            return True
+        return obj.user == request.user
+
+    def has_permission(self, request, view):
+        return request.user and request.user.is_authenticated

orders/permissions.py

@@ -8,6 +8,7 @@
 from django.utils import timezone
 from rest_framework import status
 from rest_framework.test import APITestCase
+from rest_framework_simplejwt.tokens import RefreshToken
 
 from coupons.models import Coupon
 from orders.models import Order, OrderItem
@@ -17,11 +18,12 @@
 
 
 class OrderAPITests(APITestCase):
+
     def setUp(self):
         self.admin = User.objects.create_superuser(
             username='admin', password='pass', email='[email protected]'
         )
-        self.user = User.objects.create_user(username='user', password='pass')
+        self.user = User.objects.create_user(username='user', password='pass', email='[email protected]')
         self.category = Category.objects.create(name='Test Category')
         self.product1 = Product.objects.create(
             user=self.admin,
@@ -41,8 +43,11 @@ def setUp(self):
         self.url = reverse('api-v1:order-list')
         self.cart_session_id = getattr(settings, 'CART_SESSION_ID', 'cart')
 
+        # Set JWT token for admin by default
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
+
     def prepare_cart_session(self, products):
-        """Helper method to prepare cart session data"""
         session = self.client.session
         session[self.cart_session_id] = {}
         for product, quantity in products:
@@ -54,7 +59,8 @@ def prepare_cart_session(self, products):
         session.save()
 
     def test_create_order_empty_cart(self):
-        self.client.login(username='admin', password='pass')
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         session = self.client.session
         if self.cart_session_id in session:
             del session[self.cart_session_id]
@@ -65,7 +71,8 @@ def test_create_order_empty_cart(self):
         self.assertEqual(response.data['error'], "You cannot place an order with an empty cart.")
 
     def test_create_order_with_cart(self):
-        self.client.login(username='admin', password='pass')
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         self.prepare_cart_session([(self.product1, 2)])
 
         with patch('orders.views.send_order_confirmation_email.delay') as mock_task:
@@ -82,34 +89,35 @@ def test_create_order_with_cart(self):
         mock_task.assert_called_once_with(order.order_id)
 
     def test_create_order_with_multiple_products(self):
-        self.client.login(username='admin', password='pass')
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         self.prepare_cart_session([(self.product1, 1), (self.product2, 3)])
 
         response = self.client.post(self.url)
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
 
         order = Order.objects.get(order_id=response.data['order_id'])
         self.assertEqual(order.items.count(), 2)
-        self.assertEqual(order.quantity, 4)  # Number of distinct products
-        self.assertEqual(order.get_total_cost_before_discount(), decimal.Decimal('140.00'))  # 50 + (30*3)
-
+        self.assertEqual(order.quantity, 4)
+        self.assertEqual(order.get_total_cost_before_discount(), decimal.Decimal('140.00'))
 
     def test_order_list_filtered_by_user(self):
-        # Create orders for both users
         order1 = Order.objects.create(user=self.admin, quantity=1)
         OrderItem.objects.create(order=order1, product=self.product1, quantity=1)
 
         order2 = Order.objects.create(user=self.user, quantity=1)
         OrderItem.objects.create(order=order2, product=self.product2, quantity=1)
 
-        # Test admin can see all orders
-        self.client.login(username='admin', password='pass')
+        # Admin can see all orders
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.get(self.url)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(len(response.data['data']), 2)
 
-        # Test regular user can only see their own orders
-        self.client.login(username='user', password='pass')
+        # Regular user can only see their own orders
+        refresh = RefreshToken.for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.get(self.url)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(len(response.data['data']), 1)
@@ -120,30 +128,34 @@ def test_order_retrieve(self):
         OrderItem.objects.create(order=order, product=self.product1, quantity=2)
         detail_url = reverse('api-v1:order-detail', kwargs={'pk': order.order_id})
 
-        # Test admin can retrieve any order
-        self.client.login(username='admin', password='pass')
+        # Admin can retrieve any order
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.get(detail_url)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data['order_id'], str(order.order_id))
 
-        # Test regular user cannot retrieve other user's order
-        self.client.login(username='user', password='pass')
+        # Regular user cannot retrieve other user's order
+        refresh = RefreshToken.for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.get(detail_url)
         self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
 
     def test_order_update_permissions(self):
         order = Order.objects.create(user=self.admin, quantity=1)
         OrderItem.objects.create(order=order, product=self.product1, quantity=1)
         detail_url = reverse('api-v1:order-detail', kwargs={'pk': order.order_id})
-        data = {'status': 'CO'}  # Completed
+        data = {'status': 'CO'}
 
-        # Test regular user cannot update
-        self.client.login(username='user', password='pass')
+        # Regular user cannot update
+        refresh = RefreshToken.for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.patch(detail_url, data)
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
-        # Test admin can update
-        self.client.login(username='admin', password='pass')
+        # Admin can update
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.patch(detail_url, data)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         order.refresh_from_db()
@@ -154,13 +166,15 @@ def test_order_delete_permissions(self):
         OrderItem.objects.create(order=order, product=self.product1, quantity=1)
         detail_url = reverse('api-v1:order-detail', kwargs={'pk': order.order_id})
 
-        # Test regular user cannot delete
-        self.client.login(username='user', password='pass')
+        # Regular user cannot delete
+        refresh = RefreshToken.for_user(self.user)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.delete(detail_url)
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
-        # Test admin can delete
-        self.client.login(username='admin', password='pass')
+        # Admin can delete
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.delete(detail_url)
         self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
         self.assertFalse(Order.objects.filter(pk=order.order_id).exists())
@@ -170,7 +184,8 @@ def test_order_serializer_fields(self):
         OrderItem.objects.create(order=order, product=self.product1, quantity=2)
         detail_url = reverse('api-v1:order-detail', kwargs={'pk': order.order_id})
 
-        self.client.login(username='admin', password='pass')
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.get(detail_url)
 
         self.assertEqual(response.status_code, status.HTTP_200_OK)
@@ -183,7 +198,7 @@ def test_order_serializer_fields(self):
         self.assertIn('original_price', data)
         self.assertEqual(data['original_price'], '100.00')
         self.assertIn('total_price', data)
-        self.assertEqual(data['total_price'], '90.00')  # With 10% coupon
+        self.assertEqual(data['total_price'], '90.00')
         self.assertIn('coupon', data)
         self.assertEqual(data['coupon'], 'TEST10')
         self.assertIn('discount', data)
@@ -193,22 +208,25 @@ def test_order_status_choices(self):
         order = Order.objects.create(user=self.admin, quantity=1)
         detail_url = reverse('api-v1:order-detail', kwargs={'pk': order.order_id})
 
-        self.client.login(username='admin', password='pass')
+        refresh = RefreshToken.for_user(self.admin)
+        self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {str(refresh.access_token)}')
         response = self.client.get(detail_url)
-        self.assertEqual(response.data['status'], 'PE')  # Pending by default
+        self.assertEqual(response.data['status'], 'PE')
 
-        # Test valid status update
-        data = {'status': 'CO'}  # Completed
+        # Valid status update
+        data = {'status': 'CO'}
         response = self.client.patch(detail_url, data)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.assertEqual(response.data['status'], 'CO')
 
-        # Test invalid status
+        # Invalid status
         data = {'status': 'INVALID'}
         response = self.client.patch(detail_url, data)
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
 
     def test_unauthenticated_access(self):
+        self.client.credentials()  # Remove authentication
+
         # List
         response = self.client.get(self.url)
         self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

orders/tests.py

@@ -5,13 +5,14 @@
     OpenApiResponse,
     extend_schema_view,
 )
-from rest_framework import permissions, viewsets, status
+from rest_framework import viewsets, status
 from rest_framework.permissions import IsAdminUser, IsAuthenticated
 from rest_framework.response import Response
 
 from cart.cart import Cart
 from coupons.models import Coupon
 from .models import Order, OrderItem
+from .permissions import IsAdminOrOwner
 from .serializers import OrderSerializer
 from .tasks import send_order_confirmation_email
 
@@ -74,7 +75,7 @@
 class OrderViewSet(viewsets.ModelViewSet):
     queryset = Order.objects.prefetch_related('items__product')
     serializer_class = OrderSerializer
-    permission_classes = [IsAdminUser]
+    permission_classes = [IsAuthenticated, IsAdminOrOwner]
 
     def get_queryset(self):
         qs = super().get_queryset()
@@ -84,10 +85,10 @@ def get_queryset(self):
 
     def get_permissions(self):
         if self.action in ['update', 'partial_update', 'destroy']:
-            self.permission_classes = [permissions.IsAdminUser]
+            permission_classes = [IsAdminUser]
         else:
-            self.permission_classes = [IsAuthenticated]
-        return super().get_permissions()
+            permission_classes = [IsAdminOrOwner]
+        return [permission() for permission in permission_classes]
 
     def create(self, request, *args, **kwargs):
         logger.info("Creating order for user id: %s", request.user.id)
@@ -99,7 +100,8 @@ def create(self, request, *args, **kwargs):
                                 status=status.HTTP_400_BAD_REQUEST)
             coupon = None
             try:
-                if request.session['coupon_id']:
+                coupon_id = request.session.get('coupon_id', None)
+                if coupon_id:
                     coupon = Coupon.objects.get(id=request.session['coupon_id'])
             except Coupon.DoesNotExist:
                 logger.warning("Invalid coupon ID in session for user id: %s", request.user.id)