91 lines
4.3 KiB
Python
91 lines
4.3 KiB
Python
from odoo.addons.appointment.tests.common import AppointmentSecurityCommon
|
|
from odoo.exceptions import AccessError
|
|
from odoo.tests import tagged, users
|
|
from odoo.tools import mute_logger
|
|
|
|
|
|
@tagged('post_install', '-at_install', 'security')
|
|
class TestAppointmentInviteSecurity(AppointmentSecurityCommon):
|
|
|
|
@users('apt_manager')
|
|
@mute_logger('odoo.addons.base.models.ir_model', 'odoo.addons.base.models.ir_rule')
|
|
def test_appointment_invite_access_apt_manager(self):
|
|
""" Test security access to appointment.invite for the group_appointment_manager.
|
|
Can read / write / create / unlink any share link.
|
|
"""
|
|
self._prepare_link_with_user()
|
|
for share_link in self.all_share_link:
|
|
with self.subTest(share_link=share_link):
|
|
share_link.read(['resources_choice'])
|
|
share_link.write({'resources_choice': 'current_user'})
|
|
share_link.unlink()
|
|
|
|
self.env['appointment.invite'].create({
|
|
'appointment_type_ids': self.apt_type_apt_manager
|
|
})
|
|
|
|
@users('apt_user')
|
|
@mute_logger('odoo.addons.base.models.ir_model', 'odoo.addons.base.models.ir_rule')
|
|
def test_appointment_invite_access_apt_user(self):
|
|
""" Test security access to appointment.invite for the group_appointment_user.
|
|
Can create a share link.
|
|
Can read a share link that:
|
|
- if it is created by him.
|
|
- if he is present as the staff user in the share link.
|
|
Can write a share link that is created by him only.
|
|
Can unlink a share link that is created by him only.
|
|
"""
|
|
self._prepare_link_with_user()
|
|
# Can't read the share link in which he is not assigned as staff user.
|
|
with self.assertRaises(AccessError):
|
|
self.share_link_apt_manager.read(['resources_choice'])
|
|
|
|
# Can create a share link.
|
|
test_share_link = self.env['appointment.invite'].create({
|
|
'appointment_type_ids': self.apt_type_apt_user,
|
|
})
|
|
|
|
# Can't write or unlink share link created by someone else.
|
|
for share_link in self.all_share_link:
|
|
with self.subTest(share_link=share_link), self.assertRaises(AccessError):
|
|
share_link.write({'resources_choice': 'current_user'})
|
|
with self.subTest(share_link=share_link), self.assertRaises(AccessError):
|
|
share_link.unlink()
|
|
|
|
# Can only write or unlink share link created by himself.
|
|
test_share_link.write({'resources_choice': 'specific_resources'})
|
|
test_share_link.unlink()
|
|
|
|
@users('internal_user')
|
|
@mute_logger('odoo.addons.base.models.ir_model', 'odoo.addons.base.models.ir_rule')
|
|
def test_appointment_invite_access_internal_user(self):
|
|
""" Test security access to appointment.invite for the base.group_user.
|
|
Can create a share link.
|
|
Can read a share link that:
|
|
- if it is created by him.
|
|
- if he is present as the staff user in the share link.
|
|
Can write a share link that it is created by him only.
|
|
"""
|
|
self._prepare_link_with_user()
|
|
# Can't read the share link in which he is not assigned as staff user.
|
|
with self.assertRaises(AccessError):
|
|
self.share_link_apt_manager.read(['resources_choice'])
|
|
|
|
# Can create a share link.
|
|
test_share_link = self.env['appointment.invite'].create({
|
|
'appointment_type_ids': self.apt_type_internal_user,
|
|
})
|
|
|
|
# Can only write on share link created by himself.
|
|
for share_link in self.all_share_link:
|
|
with self.subTest(share_link=share_link), self.assertRaises(AccessError):
|
|
share_link.write({'resources_choice': 'current_user'})
|
|
test_share_link.write({'resources_choice': 'specific_resources'})
|
|
|
|
def _prepare_link_with_user(self):
|
|
""" Prepare the share Link types by applying the user to be the one from the environment. """
|
|
self.share_link_apt_manager = self.share_link_apt_manager.with_user(self.env.user)
|
|
self.share_link_apt_user = self.share_link_apt_user.with_user(self.env.user)
|
|
self.share_link_internal_user = self.share_link_internal_user.with_user(self.env.user)
|
|
self.all_share_link = self.share_link_apt_manager + self.share_link_apt_user + self.share_link_internal_user
|