Add unit tests and changelog entry

Signed-off-by: tdruez <[email protected]>

Author: tdruez

CHANGELOG.rst

@@ -17,6 +17,15 @@ Release notes
   Prior to this change only "superusers" could see and use this feature.
   https://github.com/aboutcode-org/dejacode/issues/385
 
+- Add Dataspace FK validation on Dataspace and DejacodeUser models.
+  Assigning an object from another Dataspace will raise an error at the ``save()``
+  level.
+  Do not include the ``homepage_layout`` field on Dataspace "addition" form since the
+  Dataspace does not exist yet.
+  Display the ``homepage_layout`` field as read-only on the Dataspace and User change
+  forms when the currently logged user is not looking at his own Dataspace.
+  https://github.com/aboutcode-org/dejacode/issues/428
+
 ### Version 5.4.2
 
 - Migrate the LDAP testing from using mockldap to slapdtest.

dje/tests/test_admin.py

@@ -204,6 +204,19 @@ def test_dataspace_admin_changeform_hide_dataspace_fk_on_addition(self):
         self.assertContains(response, expected1)
         self.assertContains(response, expected2)
 
+    def test_dataspace_admin_changeform_dataspace_fk_read_only_when_other_dataspace(self):
+        self.client.login(username=self.super_user.username, password="secret")
+
+        expected = "configuration-0-homepage_layout"
+
+        url = reverse("admin:dje_dataspace_change", args=[self.other_dataspace.pk])
+        response = self.client.get(url)
+        self.assertNotContains(response, expected)
+
+        url = reverse("admin:dje_dataspace_change", args=[self.dataspace.pk])
+        response = self.client.get(url)
+        self.assertContains(response, expected)
+
     def test_dataspace_admin_changelist_missing_in_filter_availability(self):
         # MissingInFilter is only available to superusers
         url = reverse("admin:organization_owner_changelist")

dje/tests/test_user.py

@@ -428,6 +428,19 @@ def test_user_admin_hide_dataspace_fk_on_addition(self):
         self.assertContains(response, expected1)
         self.assertContains(response, expected2)
 
+    def test_user_admin_dataspace_fk_read_only_when_other_dataspace(self):
+        self.client.login(username=self.nexb_user.username, password="secret")
+
+        expected = "id_homepage_layout"
+
+        url = reverse("admin:dje_dejacodeuser_change", args=[self.other_user.pk])
+        response = self.client.get(url)
+        self.assertNotContains(response, expected)
+
+        url = reverse("admin:dje_dejacodeuser_change", args=[self.nexb_user.pk])
+        response = self.client.get(url)
+        self.assertContains(response, expected)
+
     def test_user_admin_form_scope_homepage_layout_choices(self):
         self.client.login(username=self.nexb_user.username, password="secret")
         url = reverse("admin:dje_dejacodeuser_change", args=[self.nexb_user.pk])