peter
edacb86800
Peter needed a second user for throwaway testing without going through Django admin each time. Superusers now get a "Users" tab in Settings (hidden for regular users) with a create-user form and a list of existing accounts. New users are regular (non-staff, non-superuser) by default, with an optional "Grant admin access" checkbox; creating one immediately issues their API token and displays it once, since that's the credential an agent account needs and a human account can otherwise regenerate for themselves later from their own Settings -> Account. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
66 lines
2.7 KiB
Python
66 lines
2.7 KiB
Python
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
from rest_framework.authtoken.models import Token
|
|
|
|
User = get_user_model()
|
|
|
|
|
|
class SettingsUsersViewTestCase(TestCase):
|
|
def setUp(self):
|
|
self.admin = User.objects.create_superuser(username="admin", password="pw", email="")
|
|
self.regular = User.objects.create_user(username="regular", password="pw")
|
|
|
|
def test_requires_login(self):
|
|
response = self.client.get(reverse("settings-users"))
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
def test_non_superuser_forbidden(self):
|
|
self.client.force_login(self.regular)
|
|
response = self.client.get(reverse("settings-users"))
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
def test_superuser_can_view(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.get(reverse("settings-users"))
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertContains(response, "admin")
|
|
self.assertContains(response, "regular")
|
|
|
|
def test_superuser_creates_regular_user_with_token(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.post(
|
|
reverse("settings-users"), {"username": "newtester", "password": "hunter2pw"}
|
|
)
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
created = User.objects.get(username="newtester")
|
|
self.assertTrue(created.check_password("hunter2pw"))
|
|
self.assertFalse(created.is_superuser)
|
|
self.assertFalse(created.is_staff)
|
|
self.assertTrue(Token.objects.filter(user=created).exists())
|
|
self.assertContains(response, Token.objects.get(user=created).key)
|
|
|
|
def test_superuser_can_grant_admin(self):
|
|
self.client.force_login(self.admin)
|
|
self.client.post(
|
|
reverse("settings-users"),
|
|
{"username": "newadmin", "password": "hunter2pw", "is_superuser": "on"},
|
|
)
|
|
created = User.objects.get(username="newadmin")
|
|
self.assertTrue(created.is_superuser)
|
|
|
|
def test_duplicate_username_rejected(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.post(
|
|
reverse("settings-users"), {"username": "regular", "password": "hunter2pw"}
|
|
)
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertContains(response, "already exists")
|
|
self.assertEqual(User.objects.filter(username="regular").count(), 1)
|
|
|
|
def test_missing_fields_rejected(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.post(reverse("settings-users"), {"username": "", "password": ""})
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertContains(response, "required")
|