|
# retoor <retoor@molodetz.nl>
|
|
|
|
from playwright.sync_api import expect
|
|
|
|
from tests.conftest import BASE_URL
|
|
|
|
CONSENT = "ai_third_party"
|
|
|
|
|
|
def _privacy_tab(page, username):
|
|
page.goto(
|
|
f"{BASE_URL}/profile/{username}?tab=privacy", wait_until="domcontentloaded"
|
|
)
|
|
page.locator(".privacy-panel").wait_for(state="visible")
|
|
|
|
|
|
def test_the_owner_toggles_a_consent_from_the_privacy_tab(bob):
|
|
page, user = bob
|
|
_privacy_tab(page, user["username"])
|
|
row = page.locator(f".privacy-panel tr:has(input[value='{CONSENT}'])")
|
|
button = row.locator("button[type='submit']")
|
|
original = (button.inner_text() or "").strip()
|
|
flipped = "Withdraw" if original == "Grant" else "Grant"
|
|
try:
|
|
button.click()
|
|
expect(row.locator("button[type='submit']")).to_have_text(
|
|
flipped, timeout=10000
|
|
)
|
|
finally:
|
|
_privacy_tab(page, user["username"])
|
|
if (row.locator("button[type='submit']").inner_text() or "").strip() != original:
|
|
row.locator("button[type='submit']").click()
|
|
expect(row.locator("button[type='submit']")).to_have_text(
|
|
original, timeout=10000
|
|
)
|
|
|
|
|
|
def test_the_owner_sees_every_privacy_control(bob):
|
|
page, user = bob
|
|
_privacy_tab(page, user["username"])
|
|
panel = page.locator(".privacy-panel")
|
|
expect(panel.locator(f"form[action='/profile/{user['username']}/consent']").first).to_be_attached()
|
|
expect(
|
|
panel.locator(f"form[action='/profile/{user['username']}/mature-content']")
|
|
).to_be_visible()
|
|
expect(panel.locator("a:has-text('Delete account')")).to_be_visible()
|
|
|
|
|
|
def test_an_admin_reads_the_state_but_gets_no_privacy_controls(alice, seeded_db):
|
|
admin_page, _ = alice
|
|
member = seeded_db["bob"]
|
|
_privacy_tab(admin_page, member["username"])
|
|
panel = admin_page.locator(".privacy-panel")
|
|
expect(panel).to_contain_text("Only the account holder can change this.")
|
|
expect(panel).to_contain_text("Only the account holder can change this preference.")
|
|
expect(panel.locator("form[action$='/consent']")).to_have_count(0)
|
|
expect(panel.locator("form[action$='/mature-content']")).to_have_count(0)
|
|
expect(panel.locator("a:has-text('Delete account')")).to_have_count(0)
|
|
|
|
|
|
def test_a_stranger_never_reaches_the_privacy_panel(bob):
|
|
page, _ = bob
|
|
page.goto(
|
|
f"{BASE_URL}/profile/alice_test?tab=privacy", wait_until="domcontentloaded"
|
|
)
|
|
expect(page.locator(".privacy-panel")).to_have_count(0)
|
|
expect(page.locator("form[action='/profile/alice_test/consent']")).to_have_count(0)
|