34 lines
2.3 KiB
Python
34 lines
2.3 KiB
Python
import unittest
|
|
from unittest.mock import patch
|
|
from fastapi import FastAPI
|
|
from fastapi.testclient import TestClient
|
|
from backend.app.routers import portal
|
|
|
|
|
|
class PortalPrivacyTests(unittest.TestCase):
|
|
def test_detail_and_comments_are_private_for_regular_users(self):
|
|
item = {'id': 1, 'kind': 'issue', 'title': 'Broken movie', 'status': 'new',
|
|
'created_by_username': 'private-reporter', 'created_by_id': 42,
|
|
'assignee_username': 'private-admin', 'metadata_json': '{"email":"secret@example.com"}',
|
|
'description': 'Contact private-reporter or secret@example.com', 'created_at': '2026-09-07'}
|
|
comment = {'id': 1, 'item_id': 1, 'author_username': 'private-admin', 'author_role': 'admin',
|
|
'message': 'Sent to secret@example.com for private-reporter', 'is_internal': False}
|
|
app = FastAPI()
|
|
app.include_router(portal.router)
|
|
app.dependency_overrides[portal.get_current_user] = lambda: {'username': 'viewer', 'role': 'user', 'features': {'issues': True, 'requests': True, 'new_requests': True}}
|
|
with patch.object(portal, 'get_portal_item', return_value=item), \
|
|
patch.object(portal, '_list_portal_comments', return_value=[comment]), \
|
|
patch.object(portal, 'list_portal_item_activity', return_value=[]), \
|
|
patch.object(portal, 'issue_resolution_state', return_value={}), \
|
|
patch.object(portal, 'get_all_users', return_value=[{'username': 'private-reporter', 'email': 'secret@example.com'}, {'username': 'private-admin'}]):
|
|
client = TestClient(app)
|
|
for path in ['/portal/items/1', '/portal/items/1/comments']:
|
|
response = client.get(path)
|
|
self.assertEqual(response.status_code, 200)
|
|
for secret in ['private-reporter', 'private-admin', 'secret@example.com', 'metadata_json', 'assignee_username', 'created_by_id']:
|
|
self.assertNotIn(secret, response.text)
|
|
admin_result = portal._serialize_item(item, {'username': 'admin', 'role': 'admin'})
|
|
self.assertEqual(admin_result['created_by_username'], 'private-reporter')
|
|
own_result = portal._serialize_item(item, {'username': 'private-reporter', 'role': 'user'})
|
|
self.assertTrue(own_result['permissions']['can_edit'])
|