epswing fucked around with this message at 22:49 on Feb 14, 2019

from rest_framework.test import APITestCase
from django.contrib.auth import get_user_model
User = get_user_model()

class CarTests(APITestCase):

    def test_reserve_car_permission(self):

        # set up a test user
        user = User.objects.create_user('user', 'user@example.com', 'secret')
        self.client.force_authenticate(user=user)

        # give user permission to add_car, but not reserve_car
        user.add_perm('myapp.add_car')
        user = User.objects.get(pk=user.id)
        self.client.force_authenticate(user=user) # re-authenticate
        self.assertTrue(user.has_perm('myapp.add_car'))
        self.assertFalse(user.has_perm('myapp.reserve_car'))

        # create a blank car
        data = {'name': 'Some Car'}
        response = self.client.post(car_list_url(), data)
        self.assertEqual(response.status_code, status.HTTP_201_CREATED, msg=json_error_response(response))
        car_id = response.data['id']

        # try to reserve the car, should fail because user doesn't have reserve_car permission
        response = self.client.post(carreserve_detail_url(car_id))
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN, msg='User should not have permission')
        self.assertEqual(response.data['detail'], 'You do not have permission to perform this action.')

        # add the reserve_car permission to the user
        user.add_perm('myapp.reserve_car')
        user = User.objects.get(pk=user.id)
        self.client.force_authenticate(user=user) # re-authenticate
        self.assertTrue(user.has_perm('myapp.add_car'))
        self.assertTrue(user.has_perm('myapp.reserve_car'))

        # try again to reserve the car, should pass now
        response = self.client.post(carreserve_detail_url(car_id))
        self.assertEqual(response.status_code, status.HTTP_200_OK, msg=json_error_response(response))

epswing fucked around with this message at 14:50 on May 30, 2019

INTERNAL_RESET_URL_TOKEN = 'set-password'
INTERNAL_RESET_SESSION_TOKEN = '_password_reset_token'

...

        self.validlink = False
        self.user = self.get_user(kwargs['uidb64'])

        if self.user is not None:
            token = kwargs['token']
            if token == INTERNAL_RESET_URL_TOKEN:
                session_token = self.request.session.get(INTERNAL_RESET_SESSION_TOKEN)
                if self.token_generator.check_token(self.user, session_token):
                    # If the token is valid, display the password reset form.
                    self.validlink = True
                    return super().dispatch(*args, **kwargs)
            else:
                if self.token_generator.check_token(self.user, token):
                    # Store the token in the session and redirect to the
                    # password reset form at a URL without the token. That
                    # avoids the possibility of leaking the token in the
                    # HTTP Referer header.
                    self.request.session[INTERNAL_RESET_SESSION_TOKEN] = token
                    redirect_url = self.request.path.replace(token, INTERNAL_RESET_URL_TOKEN)
                    return HttpResponseRedirect(redirect_url)

        # Display the "Password reset unsuccessful" page.
        return self.render_to_response(self.get_context_data())

Data Graham fucked around with this message at 02:40 on Jun 1, 2019

class GroupDetailSerializer(serializers.ModelSerializer):
    class Meta:
        model = Group
        fields = ('id', 'name',)
        
class UserDetailSerializer(serializers.ModelSerializer):
    groups = GroupDetailSerializer(many=True)
    class Meta:
        model = User
        fields = ('id', 'username', 'groups')
    
    @transaction.atomic
    def update(self, instance, validated_data):
        # snip.. remove all group assignments here
        groups = validated_data.pop('groups')
        super().update(instance, validated_data)
        # snip.. establish new group assignments here
        return instance

{
    "id": 1,
    "username": "user"
    "groups": [
        {
            "id": 1,
            "name": "G1"
        },
        {
            "id": 2,
            "name": "G2"
        }
    ],
}

{
    "id": 1,
    "username": "user"
    "groups": ["G1", "G2"],
}

{
    "id": 1,
    "username": "user"
    "groups": ["G1", "G3", "G4"],
}

epswing fucked around with this message at 03:22 on Jul 6, 2019

Data Graham fucked around with this message at 22:17 on Aug 10, 2019