first commit

backend/apps/accounts/tests_managed_by.py

@@ -0,0 +1,99 @@
+from django.test import TestCase
+from rest_framework.test import APIClient
+
+from apps.accounts.models import User
+
+
+class ManagedByRequestTests(TestCase):
+    def setUp(self):
+        self.client = APIClient()
+        self.buh = User.objects.create_user(
+            user_name="buh1", password="x", status=User.STATUS_BUH
+        )
+        self.buh_other = User.objects.create_user(
+            user_name="buh2", password="x", status=User.STATUS_BUH
+        )
+        self.gm = User.objects.create_user(
+            user_name="gm1", password="x", status=User.STATUS_GM
+        )
+
+    def test_gm_requests_and_buh_approves(self):
+        self.client.force_authenticate(self.gm)
+        response = self.client.post(
+            "/api/v1/users/request-managed-by/", {"buh_id": self.buh.pk}, format="json"
+        )
+        self.assertEqual(response.status_code, 200)
+        self.gm.refresh_from_db()
+        self.assertIsNone(self.gm.managed_by_id)
+        self.assertEqual(self.gm.managed_by_pending_id, self.buh.pk)
+
+        self.client.force_authenticate(self.buh)
+        pending = self.client.get("/api/v1/users/pending-managed/")
+        self.assertEqual(pending.status_code, 200)
+        self.assertEqual({row["user_name"] for row in pending.data}, {"gm1"})
+
+        approve = self.client.post(f"/api/v1/users/{self.gm.pk}/approve-managed-by/", {})
+        self.assertEqual(approve.status_code, 200)
+        self.gm.refresh_from_db()
+        self.assertEqual(self.gm.managed_by_id, self.buh.pk)
+        self.assertIsNone(self.gm.managed_by_pending_id)
+
+        managed = self.client.get("/api/v1/users/")
+        self.assertEqual({row["user_name"] for row in managed.data["results"]}, {"gm1"})
+
+    def test_other_buh_cannot_approve(self):
+        self.gm.request_managed_by(self.buh)
+        self.client.force_authenticate(self.buh_other)
+        response = self.client.post(f"/api/v1/users/{self.gm.pk}/approve-managed-by/", {})
+        self.assertEqual(response.status_code, 404)
+        self.gm.refresh_from_db()
+        self.assertIsNone(self.gm.managed_by_id)
+        self.assertEqual(self.gm.managed_by_pending_id, self.buh.pk)
+
+    def test_gm_can_cancel_request(self):
+        self.gm.request_managed_by(self.buh)
+        self.client.force_authenticate(self.gm)
+        response = self.client.post("/api/v1/users/cancel-managed-by-request/", {})
+        self.assertEqual(response.status_code, 200)
+        self.gm.refresh_from_db()
+        self.assertIsNone(self.gm.managed_by_pending_id)
+
+    def test_gm_lists_buhs_only(self):
+        User.objects.create_user(
+            user_name="buadmin1", password="x", status=User.STATUS_BU_ADMIN
+        )
+        self.client.force_authenticate(self.gm)
+        response = self.client.get("/api/v1/users/buhs/")
+        self.assertEqual(response.status_code, 200)
+        names = {row["user_name"] for row in response.data}
+        self.assertEqual(names, {"buh1", "buh2"})
+
+    def test_gm_admin_cannot_request_buh(self):
+        gm_admin = User.objects.create_user(
+            user_name="gma1", password="x", status=User.STATUS_GM_ADMIN
+        )
+        self.client.force_authenticate(gm_admin)
+        response = self.client.post(
+            "/api/v1/users/request-managed-by/", {"buh_id": self.buh.pk}, format="json"
+        )
+        self.assertEqual(response.status_code, 403)
+
+    def test_gm_cannot_request_bu_admin(self):
+        bu_admin = User.objects.create_user(
+            user_name="buadmin1", password="x", status=User.STATUS_BU_ADMIN
+        )
+        self.client.force_authenticate(self.gm)
+        response = self.client.post(
+            "/api/v1/users/request-managed-by/", {"buh_id": bu_admin.pk}, format="json"
+        )
+        self.assertEqual(response.status_code, 400)
+
+    def test_bu_admin_cannot_approve(self):
+        bu_admin = User.objects.create_user(
+            user_name="buadmin1", password="x", status=User.STATUS_BU_ADMIN
+        )
+        self.gm.managed_by_pending = bu_admin
+        self.gm.save(update_fields=["managed_by_pending", "updated_at"])
+        self.client.force_authenticate(bu_admin)
+        response = self.client.post(f"/api/v1/users/{self.gm.pk}/approve-managed-by/", {})
+        self.assertEqual(response.status_code, 403)