97 lines
4.0 KiB
Python
97 lines
4.0 KiB
Python
import pytest
|
|
from django.contrib.auth.models import Permission
|
|
from django.db import models
|
|
from django.urls import reverse
|
|
|
|
from apps.content.current import AboutContent, HomeContent, ListingContent, SiteContent
|
|
from apps.users.models import User
|
|
|
|
|
|
pytestmark = [pytest.mark.django_db, pytest.mark.integration]
|
|
|
|
|
|
def staff(username, *permissions):
|
|
user = User.objects.create_user(
|
|
username=username, mobile=f"0912{User.objects.count():07d}",
|
|
password="TestPass123!", is_staff=True,
|
|
)
|
|
user.user_permissions.add(*Permission.objects.filter(content_type__app_label="content", codename__in=permissions))
|
|
return user
|
|
|
|
|
|
def test_home_uses_standard_unfold_change_form_and_saves_directly(client):
|
|
client.force_login(staff("home-editor", "change_homecontent"))
|
|
url = reverse("admin:content_homecontent_change", args=[1])
|
|
|
|
response = client.get(url)
|
|
assert response.status_code == 200
|
|
assert b'name="hero_heading"' in response.content
|
|
assert b'name="seo_title"' in response.content
|
|
assert b"published_revision" not in response.content
|
|
assert client.get(reverse("admin:content_homecontent_add")).status_code == 403
|
|
|
|
current = HomeContent.objects.get(pk=1)
|
|
data = {
|
|
field.name: getattr(current, field.name)
|
|
for field in current._meta.fields
|
|
if field.editable and not field.is_relation and not isinstance(field, models.ImageField)
|
|
}
|
|
data["hero_heading"] = "A new heading"
|
|
data["seo_title"] = "New SEO title"
|
|
data["_save"] = "Save"
|
|
response = client.post(url, data)
|
|
assert response.status_code == 302
|
|
current.refresh_from_db()
|
|
assert current.hero_heading == "A new heading"
|
|
assert current.seo_title == "New SEO title"
|
|
|
|
|
|
def test_staff_without_model_change_permission_cannot_edit(client):
|
|
client.force_login(staff("other-staff"))
|
|
assert client.get(reverse("admin:content_aboutcontent_change", args=[1])).status_code == 403
|
|
assert client.post(reverse("admin:content_aboutcontent_change", args=[1]), {"title": "Changed"}).status_code == 403
|
|
|
|
|
|
def test_site_links_use_native_fields_and_reject_unsafe_url(client):
|
|
client.force_login(staff("site-editor", "change_sitecontent"))
|
|
url = reverse("admin:content_sitecontent_change", args=[1])
|
|
response = client.get(url)
|
|
assert response.status_code == 200
|
|
assert b'name="telegram_url"' in response.content
|
|
assert b'name="logo"' in response.content
|
|
|
|
current = SiteContent.objects.get(pk=1)
|
|
data = {
|
|
field.name: getattr(current, field.name)
|
|
for field in current._meta.fields
|
|
if field.editable and not field.is_relation and not isinstance(field, models.ImageField)
|
|
}
|
|
data["telegram_url"] = "javascript:alert(1)"
|
|
response = client.post(url, data)
|
|
assert response.status_code == 200
|
|
current.refresh_from_db()
|
|
assert current.telegram_url != "javascript:alert(1)"
|
|
|
|
|
|
def test_fixed_page_records_exist_and_cannot_be_added_or_deleted(client):
|
|
assert HomeContent.objects.filter(pk=1).exists()
|
|
assert AboutContent.objects.filter(pk=1).exists()
|
|
assert SiteContent.objects.filter(pk=1).exists()
|
|
assert set(ListingContent.objects.values_list("slug", flat=True)) == {"events", "blog"}
|
|
|
|
client.force_login(staff("listing-editor", "change_listingcontent"))
|
|
assert client.get(reverse("admin:content_listingcontent_add")).status_code == 403
|
|
assert client.get(reverse("admin:content_listingcontent_delete", args=["events"])).status_code == 403
|
|
assert client.get(reverse("admin:content_listingcontent_change", args=["events"])).status_code == 200
|
|
|
|
|
|
def test_current_website_copy_is_seeded_once():
|
|
home = HomeContent.objects.get(pk=1)
|
|
about = AboutContent.objects.get(pk=1)
|
|
events = ListingContent.objects.get(pk="events")
|
|
blog = ListingContent.objects.get(pk="blog")
|
|
assert home.hero_heading == "انجمن علمی کامپیوتر دانشگاه گیلان"
|
|
assert about.items.filter(kind="faq").count() == 3
|
|
assert events.seo_title == "رویدادها"
|
|
assert blog.title == "بلاگ" and blog.seo_title == "وبلاگ"
|