first commit

backend/apps/accounts/tests_scoping.py

@@ -0,0 +1,118 @@
+from django.test import TestCase
+from rest_framework.test import APIClient
+
+from apps.accounts.models import User
+from apps.farms.models import Kandang, Site
+from apps.sync.models import CitySite
+
+
+class VisibilityScopeTests(TestCase):
+    def setUp(self):
+        self.client = APIClient()
+        self.director = User.objects.create_user(
+            user_name="dir1", password="x", status=User.STATUS_DIRECTOR
+        )
+        self.buh = User.objects.create_user(
+            user_name="buh1", password="x", status=User.STATUS_BUH
+        )
+        self.buh_other = User.objects.create_user(
+            user_name="buh2", password="x", status=User.STATUS_BUH
+        )
+        self.gm = User.objects.create_user(
+            user_name="gm1", password="x", status=User.STATUS_GM, managed_by=self.buh
+        )
+        self.gm_other = User.objects.create_user(
+            user_name="gm2",
+            password="x",
+            status=User.STATUS_GM,
+            managed_by=self.buh_other,
+        )
+        self.city_a = CitySite.objects.create(
+            code="a",
+            name="City A",
+            api_base_url="https://a.example/api/v1",
+            registered_by=self.gm,
+        )
+        self.city_b = CitySite.objects.create(
+            code="b",
+            name="City B",
+            api_base_url="https://b.example/api/v1",
+            registered_by=self.gm_other,
+        )
+        self.site = Site.objects.create(
+            site_name="Site A", user=self.gm, city_site=self.city_a
+        )
+        self.site_other = Site.objects.create(
+            site_name="Site B", user=self.gm_other, city_site=self.city_b
+        )
+        self.orphan = Site.objects.create(site_name="Orphan Seed", user=self.gm)
+        Kandang.objects.create(kandang_name="K1", site=self.site)
+        Kandang.objects.create(kandang_name="K2", site=self.site_other)
+
+    def test_director_sees_all_sites(self):
+        self.client.force_authenticate(self.director)
+        response = self.client.get("/api/v1/sites/")
+        self.assertEqual(response.status_code, 200)
+        names = {row["site_name"] for row in response.data["results"]}
+        self.assertEqual(names, {"Site A", "Site B", "Orphan Seed"})
+
+    def test_buh_sees_only_managed_gm_registered_sites(self):
+        self.client.force_authenticate(self.buh)
+        response = self.client.get("/api/v1/sites/")
+        self.assertEqual(response.status_code, 200)
+        names = {row["site_name"] for row in response.data["results"]}
+        self.assertEqual(names, {"Site A"})
+
+    def test_buh_sees_only_managed_gms(self):
+        self.client.force_authenticate(self.buh)
+        response = self.client.get("/api/v1/users/")
+        self.assertEqual(response.status_code, 200)
+        names = {row["user_name"] for row in response.data["results"]}
+        self.assertEqual(names, {"gm1"})
+
+    def test_gm_sees_own_city_sites_only(self):
+        self.client.force_authenticate(self.gm)
+        response = self.client.get("/api/v1/city-sites/")
+        self.assertEqual(response.status_code, 200)
+        codes = {row["code"] for row in response.data["results"]}
+        self.assertEqual(codes, {"a"})
+
+    def test_gm_sees_only_registered_linked_sites(self):
+        self.client.force_authenticate(self.gm)
+        response = self.client.get("/api/v1/sites/")
+        self.assertEqual(response.status_code, 200)
+        names = {row["site_name"] for row in response.data["results"]}
+        self.assertEqual(names, {"Site A"})
+
+    def test_gm_with_empty_registry_sees_no_sites(self):
+        self.city_a.delete()
+        self.client.force_authenticate(self.gm)
+        response = self.client.get("/api/v1/sites/")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data["results"], [])
+
+    def test_registering_city_site_attaches_matching_seed_site(self):
+        self.client.force_authenticate(self.gm)
+        response = self.client.post(
+            "/api/v1/city-sites/",
+            {
+                "code": "orphan-seed",
+                "name": "Orphan Seed",
+                "api_base_url": "https://orphan.example/api/v1",
+                "is_active": True,
+            },
+            format="json",
+        )
+        self.assertEqual(response.status_code, 201)
+        self.orphan.refresh_from_db()
+        self.assertEqual(self.orphan.city_site_id, response.data["id"])
+        listed = self.client.get("/api/v1/sites/")
+        names = {row["site_name"] for row in listed.data["results"]}
+        self.assertIn("Orphan Seed", names)
+
+    def test_director_sees_all_city_sites(self):
+        self.client.force_authenticate(self.director)
+        response = self.client.get("/api/v1/city-sites/")
+        self.assertEqual(response.status_code, 200)
+        codes = {row["code"] for row in response.data["results"]}
+        self.assertEqual(codes, {"a", "b"})