mirror of
https://github.com/netbox-community/netbox.git
synced 2024-05-10 07:54:54 +00:00
12589 move user and group admin from admin (#12877)
Move admin views for users, groups, and object permissions from the admin site to the NetBox frontend --------- Co-authored-by: Jeremy Stretch <jstretch@netboxlabs.com>
This commit is contained in:
Arthur Hanson
GitHub
@ -1,5 +1,6 @@
|
||||
import csv
|
||||
|
||||
from django.conf import settings
|
||||
from django.contrib.contenttypes.models import ContentType
|
||||
from django.core.exceptions import ObjectDoesNotExist
|
||||
from django.db.models import ForeignKey
|
||||
@ -64,8 +65,15 @@ class ViewTestCases:
|
||||
def test_get_object_anonymous(self):
|
||||
# Make the request as an unauthenticated user
|
||||
self.client.logout()
|
||||
response = self.client.get(self._get_queryset().first().get_absolute_url())
|
||||
self.assertHttpStatus(response, 200)
|
||||
ct = ContentType.objects.get_for_model(self.model)
|
||||
if (ct.app_label, ct.model) in settings.EXEMPT_EXCLUDE_MODELS:
|
||||
# Models listed in EXEMPT_EXCLUDE_MODELS should not be accessible to anonymous users
|
||||
with disable_warnings('django.request'):
|
||||
response = self.client.get(self._get_queryset().first().get_absolute_url())
|
||||
self.assertHttpStatus(response, 302)
|
||||
else:
|
||||
response = self.client.get(self._get_queryset().first().get_absolute_url())
|
||||
self.assertHttpStatus(response, 200)
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=[])
|
||||
def test_get_object_without_permission(self):
|
||||
@ -128,6 +136,7 @@ class ViewTestCases:
|
||||
:form_data: Data to be used when creating a new object.
|
||||
"""
|
||||
form_data = {}
|
||||
validation_excluded_fields = []
|
||||
|
||||
def test_create_object_without_permission(self):
|
||||
|
||||
@ -146,7 +155,6 @@ class ViewTestCases:
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=['*'])
|
||||
def test_create_object_with_permission(self):
|
||||
initial_count = self._get_queryset().count()
|
||||
|
||||
# Assign unconstrained permission
|
||||
obj_perm = ObjectPermission(
|
||||
@ -161,6 +169,7 @@ class ViewTestCases:
|
||||
self.assertHttpStatus(self.client.get(self._get_url('add')), 200)
|
||||
|
||||
# Try POST with model-level permission
|
||||
initial_count = self._get_queryset().count()
|
||||
request = {
|
||||
'path': self._get_url('add'),
|
||||
'data': post_data(self.form_data),
|
||||
@ -168,19 +177,19 @@ class ViewTestCases:
|
||||
self.assertHttpStatus(self.client.post(**request), 302)
|
||||
self.assertEqual(initial_count + 1, self._get_queryset().count())
|
||||
instance = self._get_queryset().order_by('pk').last()
|
||||
self.assertInstanceEqual(instance, self.form_data)
|
||||
self.assertInstanceEqual(instance, self.form_data, exclude=self.validation_excluded_fields)
|
||||
|
||||
# Verify ObjectChange creation
|
||||
objectchanges = ObjectChange.objects.filter(
|
||||
changed_object_type=ContentType.objects.get_for_model(instance),
|
||||
changed_object_id=instance.pk
|
||||
)
|
||||
self.assertEqual(len(objectchanges), 1)
|
||||
self.assertEqual(objectchanges[0].action, ObjectChangeActionChoices.ACTION_CREATE)
|
||||
if issubclass(instance.__class__, ChangeLoggingMixin):
|
||||
objectchanges = ObjectChange.objects.filter(
|
||||
changed_object_type=ContentType.objects.get_for_model(instance),
|
||||
changed_object_id=instance.pk
|
||||
)
|
||||
self.assertEqual(len(objectchanges), 1)
|
||||
self.assertEqual(objectchanges[0].action, ObjectChangeActionChoices.ACTION_CREATE)
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=['*'])
|
||||
def test_create_object_with_constrained_permission(self):
|
||||
initial_count = self._get_queryset().count()
|
||||
|
||||
# Assign constrained permission
|
||||
obj_perm = ObjectPermission(
|
||||
@ -196,6 +205,7 @@ class ViewTestCases:
|
||||
self.assertHttpStatus(self.client.get(self._get_url('add')), 200)
|
||||
|
||||
# Try to create an object (not permitted)
|
||||
initial_count = self._get_queryset().count()
|
||||
request = {
|
||||
'path': self._get_url('add'),
|
||||
'data': post_data(self.form_data),
|
||||
@ -214,7 +224,8 @@ class ViewTestCases:
|
||||
}
|
||||
self.assertHttpStatus(self.client.post(**request), 302)
|
||||
self.assertEqual(initial_count + 1, self._get_queryset().count())
|
||||
self.assertInstanceEqual(self._get_queryset().order_by('pk').last(), self.form_data)
|
||||
instance = self._get_queryset().order_by('pk').last()
|
||||
self.assertInstanceEqual(instance, self.form_data, exclude=self.validation_excluded_fields)
|
||||
|
||||
class EditObjectViewTestCase(ModelViewTestCase):
|
||||
"""
|
||||
@ -223,6 +234,7 @@ class ViewTestCases:
|
||||
:form_data: Data to be used when updating the first existing object.
|
||||
"""
|
||||
form_data = {}
|
||||
validation_excluded_fields = []
|
||||
|
||||
def test_edit_object_without_permission(self):
|
||||
instance = self._get_queryset().first()
|
||||
@ -261,15 +273,17 @@ class ViewTestCases:
|
||||
'data': post_data(self.form_data),
|
||||
}
|
||||
self.assertHttpStatus(self.client.post(**request), 302)
|
||||
self.assertInstanceEqual(self._get_queryset().get(pk=instance.pk), self.form_data)
|
||||
instance = self._get_queryset().get(pk=instance.pk)
|
||||
self.assertInstanceEqual(instance, self.form_data, exclude=self.validation_excluded_fields)
|
||||
|
||||
# Verify ObjectChange creation
|
||||
objectchanges = ObjectChange.objects.filter(
|
||||
changed_object_type=ContentType.objects.get_for_model(instance),
|
||||
changed_object_id=instance.pk
|
||||
)
|
||||
self.assertEqual(len(objectchanges), 1)
|
||||
self.assertEqual(objectchanges[0].action, ObjectChangeActionChoices.ACTION_UPDATE)
|
||||
if issubclass(instance.__class__, ChangeLoggingMixin):
|
||||
objectchanges = ObjectChange.objects.filter(
|
||||
changed_object_type=ContentType.objects.get_for_model(instance),
|
||||
changed_object_id=instance.pk
|
||||
)
|
||||
self.assertEqual(len(objectchanges), 1)
|
||||
self.assertEqual(objectchanges[0].action, ObjectChangeActionChoices.ACTION_UPDATE)
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=['*'])
|
||||
def test_edit_object_with_constrained_permission(self):
|
||||
@ -297,7 +311,8 @@ class ViewTestCases:
|
||||
'data': post_data(self.form_data),
|
||||
}
|
||||
self.assertHttpStatus(self.client.post(**request), 302)
|
||||
self.assertInstanceEqual(self._get_queryset().get(pk=instance1.pk), self.form_data)
|
||||
instance = self._get_queryset().get(pk=instance1.pk)
|
||||
self.assertInstanceEqual(instance, self.form_data, exclude=self.validation_excluded_fields)
|
||||
|
||||
# Try to edit a non-permitted object
|
||||
request = {
|
||||
@ -404,8 +419,15 @@ class ViewTestCases:
|
||||
def test_list_objects_anonymous(self):
|
||||
# Make the request as an unauthenticated user
|
||||
self.client.logout()
|
||||
response = self.client.get(self._get_url('list'))
|
||||
self.assertHttpStatus(response, 200)
|
||||
ct = ContentType.objects.get_for_model(self.model)
|
||||
if (ct.app_label, ct.model) in settings.EXEMPT_EXCLUDE_MODELS:
|
||||
# Models listed in EXEMPT_EXCLUDE_MODELS should not be accessible to anonymous users
|
||||
with disable_warnings('django.request'):
|
||||
response = self.client.get(self._get_url('list'))
|
||||
self.assertHttpStatus(response, 302)
|
||||
else:
|
||||
response = self.client.get(self._get_url('list'))
|
||||
self.assertHttpStatus(response, 200)
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=[])
|
||||
def test_list_objects_without_permission(self):
|
||||
@ -450,10 +472,19 @@ class ViewTestCases:
|
||||
self.assertIn(instance1.get_absolute_url(), content)
|
||||
self.assertNotIn(instance2.get_absolute_url(), content)
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=['*'])
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=[])
|
||||
def test_export_objects(self):
|
||||
url = self._get_url('list')
|
||||
|
||||
# Add model-level permission
|
||||
obj_perm = ObjectPermission(
|
||||
name='Test permission',
|
||||
actions=['view']
|
||||
)
|
||||
obj_perm.save()
|
||||
obj_perm.users.add(self.user)
|
||||
obj_perm.object_types.add(ContentType.objects.get_for_model(self.model))
|
||||
|
||||
# Test default CSV export
|
||||
response = self.client.get(f'{url}?export')
|
||||
self.assertHttpStatus(response, 200)
|
||||
@ -700,7 +731,7 @@ class ViewTestCases:
|
||||
# Assign model-level permission
|
||||
obj_perm = ObjectPermission(
|
||||
name='Test permission',
|
||||
actions=['change']
|
||||
actions=['view', 'change']
|
||||
)
|
||||
obj_perm.save()
|
||||
obj_perm.users.add(self.user)
|
||||
@ -731,7 +762,7 @@ class ViewTestCases:
|
||||
obj_perm = ObjectPermission(
|
||||
name='Test permission',
|
||||
constraints={attr_name: value},
|
||||
actions=['change']
|
||||
actions=['view', 'change']
|
||||
)
|
||||
obj_perm.save()
|
||||
obj_perm.users.add(self.user)
|
||||
@ -795,7 +826,6 @@ class ViewTestCases:
|
||||
|
||||
@override_settings(EXEMPT_VIEW_PERMISSIONS=[])
|
||||
def test_bulk_delete_objects_with_constrained_permission(self):
|
||||
initial_count = self._get_queryset().count()
|
||||
pk_list = self._get_queryset().values_list('pk', flat=True)
|
||||
data = {
|
||||
'pk': pk_list,
|
||||
@ -814,6 +844,7 @@ class ViewTestCases:
|
||||
obj_perm.object_types.add(ContentType.objects.get_for_model(self.model))
|
||||
|
||||
# Attempt to bulk delete non-permitted objects
|
||||
initial_count = self._get_queryset().count()
|
||||
self.assertHttpStatus(self.client.post(self._get_url('bulk_delete'), data), 302)
|
||||
self.assertEqual(self._get_queryset().count(), initial_count)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user