devplacepy/tests/api/project/visibility.py

# retoor <retoor@molodetz.nl>

import time
import pytest
import requests
from tests.conftest import BASE_URL
from devplacepy.database import get_table, invalidate_admins_cache
from devplacepy.utils import clear_user_cache
from devplacepy import project_files
from devplacepy.project_files import ProjectFileError
from devplacepy.services.devii.actions.dispatcher import (
    confirmation_error,
    _is_confirmed,
)
_counter_project_visibility = [0]
def _signup_project_visibility():
    _counter_project_visibility[0] += 1
    name = f"pv{int(time.time() * 1000)}{_counter_project_visibility[0]}"
    session = requests.Session()
    session.post(
        f"{BASE_URL}/auth/signup",
        data={
            "username": name,
            "email": f"{name}@t.dev",
            "password": "secret123",
            "confirm_password": "secret123",
            "birth_date": "1990-01-01",
            "accept_terms": "1",
        },
        allow_redirects=True,
    )
    row = get_table("users").find_one(username=name)
    return name, row["uid"], row["api_key"]
def _make_admin_project_visibility():
    name, uid, key = _signup_project_visibility()
    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
    clear_user_cache(uid)
    invalidate_admins_cache()
    return name, uid, key


def _eventually(predicate, *, attempts=25, delay=0.15):
    result = predicate()
    for _ in range(attempts):
        if result:
            return result
        time.sleep(delay)
        result = predicate()
    return result
def _h_project_visibility(key=None):
    headers = {"Accept": "application/json"}
    if key:
        headers["X-API-KEY"] = key
    return headers
def _create_project_project_visibility(key, title, is_private=False):
    data = {
        "title": title,
        "description": "visibility test",
        "project_type": "software",
        "status": "In Development",
    }
    if is_private:
        data["is_private"] = "on"
    r = requests.post(f"{BASE_URL}/projects/create", headers=_h_project_visibility(key), data=data)
    assert r.status_code == 200, r.text
    return r.json()["data"]
def _project_uid(slug):
    return get_table("projects").find_one(slug=slug)["uid"]
def _write_project_visibility(key, slug, path, content):
    return requests.post(
        f"{BASE_URL}/projects/{slug}/files/write",
        headers=_h_project_visibility(key),
        data={"path": path, "content": content},
        allow_redirects=False,
    )
def _set_private(key, slug, value):
    return requests.post(
        f"{BASE_URL}/projects/{slug}/private",
        headers=_h_project_visibility(key),
        data={"value": 1 if value else 0},
        allow_redirects=False,
    )
def _set_readonly(key, slug, value):
    return requests.post(
        f"{BASE_URL}/projects/{slug}/readonly",
        headers=_h_project_visibility(key),
        data={"value": 1 if value else 0},
        allow_redirects=False,
    )
def _list_slugs(key=None, user_uid=None):
    params = {"user_uid": user_uid} if user_uid else None
    r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
    return [p["slug"] for p in r.json()["projects"]]
def _detail_status(key, slug):
    return requests.get(
        f"{BASE_URL}/projects/{slug}", headers=_h_project_visibility(key)
    ).status_code
def _file_raw_status(key, slug, path):
    return requests.get(
        f"{BASE_URL}/projects/{slug}/files/raw",
        headers=_h_project_visibility(key),
        params={"path": path},
    ).status_code


def test_private_project_hidden_from_guest_listing(app_server):
    _, owner_uid, key = _signup_project_visibility()
    slug = _create_project_project_visibility(key, "Private Listing", is_private=True)["slug"]
    assert slug not in _list_slugs(key=None, user_uid=owner_uid)
    assert slug in _list_slugs(key=key, user_uid=owner_uid)


def test_private_project_hidden_from_other_member(app_server):
    _, owner_uid, owner_key = _signup_project_visibility()
    _, _, other_key = _signup_project_visibility()
    slug = _create_project_project_visibility(owner_key, "Private FromOther", is_private=True)["slug"]
    assert slug not in _list_slugs(key=other_key, user_uid=owner_uid)


def test_private_project_visible_to_admin(app_server):
    _, owner_uid, owner_key = _signup_project_visibility()
    _, _, admin_key = _make_admin_project_visibility()
    slug = _create_project_project_visibility(owner_key, "Private AdminSees", is_private=True)["slug"]
    assert slug in _list_slugs(key=admin_key, user_uid=owner_uid)


def test_admin_private_hidden_from_other_admin(app_server):
    _, owner_uid, owner_key = _make_admin_project_visibility()
    _, _, other_admin_key = _make_admin_project_visibility()
    slug = _create_project_project_visibility(
        owner_key, "Admin Hidden", is_private=True
    )["slug"]
    assert _eventually(
        lambda: slug not in _list_slugs(key=other_admin_key, user_uid=owner_uid)
    )
    assert _eventually(lambda: _detail_status(other_admin_key, slug) == 404)
    assert _eventually(
        lambda: _file_raw_status(other_admin_key, slug, "missing.txt") == 404
    )
    assert slug in _list_slugs(key=owner_key, user_uid=owner_uid)
    assert _detail_status(owner_key, slug) == 200


def test_member_private_still_visible_to_admin(app_server):
    _, owner_uid, owner_key = _signup_project_visibility()
    _, _, admin_key = _make_admin_project_visibility()
    slug = _create_project_project_visibility(
        owner_key, "Member Hidden", is_private=True
    )["slug"]
    assert slug in _list_slugs(key=admin_key, user_uid=owner_uid)
    assert _detail_status(admin_key, slug) == 200


def test_toggle_private_then_public(app_server):
    _, owner_uid, key = _signup_project_visibility()
    slug = _create_project_project_visibility(key, "Toggle Privacy")["slug"]
    assert slug in _list_slugs(key=None, user_uid=owner_uid)
    assert _set_private(key, slug, True).status_code == 200
    assert slug not in _list_slugs(key=None, user_uid=owner_uid)
    assert _set_private(key, slug, False).status_code == 200
    assert slug in _list_slugs(key=None, user_uid=owner_uid)


def test_non_owner_cannot_toggle_flags(app_server):
    _, _, owner_key = _signup_project_visibility()
    _, _, other_key = _signup_project_visibility()
    slug = _create_project_project_visibility(owner_key, "Toggle Guarded")["slug"]
    assert _set_private(other_key, slug, True).status_code == 403
    assert _set_readonly(other_key, slug, True).status_code == 403


def test_toggle_readonly_off_restores_writes(app_server):
    _, _, key = _signup_project_visibility()
    slug = _create_project_project_visibility(key, "Readonly Restore")["slug"]
    _write_project_visibility(key, slug, "a.txt", "one")
    _set_readonly(key, slug, True)
    assert _write_project_visibility(key, slug, "a.txt", "two").status_code == 400
    assert _set_readonly(key, slug, False).status_code == 200
    assert _write_project_visibility(key, slug, "a.txt", "two").status_code == 200


def test_readonly_guards_service_layer(app_server):
    _, owner_uid, key = _signup_project_visibility()
    slug = _create_project_project_visibility(key, "Readonly Service")["slug"]
    project_uid = _project_uid(slug)
    user = get_table("users").find_one(uid=owner_uid)
    project_files.write_text_file(project_uid, user, "seed.txt", "seed")
    _set_readonly(key, slug, True)

    assert project_files.is_readonly(project_uid) is True
    with pytest.raises(ProjectFileError):
        project_files.write_text_file(project_uid, user, "seed.txt", "blocked")
    with pytest.raises(ProjectFileError):
        project_files.make_dir(project_uid, user, "docs")


def test_readonly_blocks_import_from_dir(app_server, tmp_path):
    _, owner_uid, key = _signup_project_visibility()
    slug = _create_project_project_visibility(key, "Readonly Import")["slug"]
    project_uid = _project_uid(slug)
    user = get_table("users").find_one(uid=owner_uid)
    (tmp_path / "imported.txt").write_text("data")
    _set_readonly(key, slug, True)
    with pytest.raises(ProjectFileError):
        project_files.import_from_dir(project_uid, str(tmp_path), user)