|
2 | 2 | Tests for the course advanced settings API. |
3 | 3 | """ |
4 | 4 | import json |
| 5 | +import pkg_resources |
| 6 | +from unittest.mock import patch |
5 | 7 |
|
| 8 | +import casbin |
6 | 9 | import ddt |
7 | 10 | from django.test import override_settings |
8 | 11 | from django.urls import reverse |
9 | 12 | from milestones.tests.utils import MilestonesTestCaseMixin |
| 13 | +from rest_framework.test import APIClient |
10 | 14 |
|
11 | 15 | from cms.djangoapps.contentstore.tests.utils import CourseTestCase |
| 16 | +from common.djangoapps.student.tests.factories import UserFactory |
| 17 | +from openedx.core import toggles as core_toggles |
| 18 | +from openedx_authz.api.users import assign_role_to_user_in_scope |
| 19 | +from openedx_authz.constants.roles import COURSE_STAFF |
| 20 | +from openedx_authz.engine.enforcer import AuthzEnforcer |
| 21 | +from openedx_authz.engine.utils import migrate_policy_between_enforcers |
12 | 22 |
|
13 | 23 |
|
14 | 24 | @ddt.ddt |
@@ -91,3 +101,105 @@ def test_disabled_fetch_all_query_param(self, setting, excluded_field): |
91 | 101 | with override_settings(FEATURES={setting: False}): |
92 | 102 | resp = self.client.get(self.url, {"fetch_all": 0}) |
93 | 103 | assert excluded_field not in resp.data |
| 104 | + |
| 105 | + |
| 106 | +@patch.object(core_toggles.AUTHZ_COURSE_AUTHORING_FLAG, 'is_enabled', return_value=True) |
| 107 | +class AdvancedSettingsAuthzTest(CourseTestCase): |
| 108 | + """ |
| 109 | + Tests for AdvancedCourseSettingsView authorization with openedx-authz. |
| 110 | +
|
| 111 | + These tests enable the AUTHZ_COURSE_AUTHORING_FLAG by default. |
| 112 | + """ |
| 113 | + |
| 114 | + def setUp(self): |
| 115 | + super().setUp() |
| 116 | + self._seed_database_with_policies() |
| 117 | + self.url = reverse( |
| 118 | + "cms.djangoapps.contentstore:v0:course_advanced_settings", |
| 119 | + kwargs={"course_id": self.course.id}, |
| 120 | + ) |
| 121 | + |
| 122 | + # Create test users |
| 123 | + self.authorized_user = UserFactory() |
| 124 | + self.unauthorized_user = UserFactory() |
| 125 | + |
| 126 | + # Assign role to authorized user |
| 127 | + assign_role_to_user_in_scope( |
| 128 | + self.authorized_user.username, |
| 129 | + COURSE_STAFF.external_key, |
| 130 | + str(self.course.id) |
| 131 | + ) |
| 132 | + AuthzEnforcer.get_enforcer().load_policy() |
| 133 | + |
| 134 | + # Create API clients and force_authenticate |
| 135 | + self.authorized_client = APIClient() |
| 136 | + self.authorized_client.force_authenticate(user=self.authorized_user) |
| 137 | + self.unauthorized_client = APIClient() |
| 138 | + self.unauthorized_client.force_authenticate(user=self.unauthorized_user) |
| 139 | + |
| 140 | + def tearDown(self): |
| 141 | + super().tearDown() |
| 142 | + AuthzEnforcer.get_enforcer().clear_policy() |
| 143 | + |
| 144 | + @classmethod |
| 145 | + def _seed_database_with_policies(cls): |
| 146 | + """Seed the database with policies from the policy file.""" |
| 147 | + global_enforcer = AuthzEnforcer.get_enforcer() |
| 148 | + global_enforcer.load_policy() |
| 149 | + model_path = pkg_resources.resource_filename("openedx_authz.engine", "config/model.conf") |
| 150 | + policy_path = pkg_resources.resource_filename("openedx_authz.engine", "config/authz.policy") |
| 151 | + migrate_policy_between_enforcers( |
| 152 | + source_enforcer=casbin.Enforcer(model_path, policy_path), |
| 153 | + target_enforcer=global_enforcer, |
| 154 | + ) |
| 155 | + |
| 156 | + def test_authorized_for_specific_course(self, mock_flag): |
| 157 | + """User authorized for specific course can access.""" |
| 158 | + response = self.authorized_client.get(self.url) |
| 159 | + self.assertEqual(response.status_code, 200) |
| 160 | + |
| 161 | + def test_unauthorized_for_specific_course(self, mock_flag): |
| 162 | + """User without authorization for specific course cannot access.""" |
| 163 | + response = self.unauthorized_client.get(self.url) |
| 164 | + self.assertEqual(response.status_code, 403) |
| 165 | + |
| 166 | + def test_unauthorized_for_different_course(self, mock_flag): |
| 167 | + """User authorized for one course cannot access another course.""" |
| 168 | + other_course = self.store.create_course("OtherOrg", "OtherCourse", "Run", self.user.id) |
| 169 | + other_url = reverse( |
| 170 | + "cms.djangoapps.contentstore:v0:course_advanced_settings", |
| 171 | + kwargs={"course_id": other_course.id}, |
| 172 | + ) |
| 173 | + response = self.authorized_client.get(other_url) |
| 174 | + self.assertEqual(response.status_code, 403) |
| 175 | + |
| 176 | + def test_staff_authorized_by_default(self, mock_flag): |
| 177 | + """Staff users are authorized by default.""" |
| 178 | + response = self.client.get(self.url) |
| 179 | + self.assertEqual(response.status_code, 200) |
| 180 | + |
| 181 | + def test_superuser_authorized_by_default(self, mock_flag): |
| 182 | + """Superusers are authorized by default.""" |
| 183 | + superuser = UserFactory(is_superuser=True, is_staff=False) |
| 184 | + superuser_client = APIClient() |
| 185 | + superuser_client.force_authenticate(user=superuser) |
| 186 | + response = superuser_client.get(self.url) |
| 187 | + self.assertEqual(response.status_code, 200) |
| 188 | + |
| 189 | + def test_patch_authorized_for_specific_course(self, mock_flag): |
| 190 | + """User authorized for specific course can PATCH.""" |
| 191 | + response = self.authorized_client.patch( |
| 192 | + self.url, |
| 193 | + {"display_name": {"value": "Test"}}, |
| 194 | + content_type="application/json" |
| 195 | + ) |
| 196 | + self.assertEqual(response.status_code, 200) |
| 197 | + |
| 198 | + def test_patch_unauthorized_for_specific_course(self, mock_flag): |
| 199 | + """User without authorization for specific course cannot PATCH.""" |
| 200 | + response = self.unauthorized_client.patch( |
| 201 | + self.url, |
| 202 | + {"display_name": {"value": "Test"}}, |
| 203 | + content_type="application/json" |
| 204 | + ) |
| 205 | + self.assertEqual(response.status_code, 403) |
0 commit comments