37 lines
1.5 KiB
Python
37 lines
1.5 KiB
Python
# backend/core/users/tests/test_permissions.py
|
|
|
|
import pytest
|
|
from rest_framework import status
|
|
from rest_framework.test import APIClient
|
|
from django.contrib.auth import get_user_model
|
|
|
|
User = get_user_model()
|
|
|
|
@pytest.mark.django_db
|
|
class TestUserPermissions:
|
|
|
|
def setup_method(self):
|
|
self.client = APIClient()
|
|
# Kreiramo dva korisnika
|
|
self.user1 = User.objects.create_user(email="user1@erp.hr", password="password123")
|
|
self.user2 = User.objects.create_user(email="user2@erp.hr", password="password123")
|
|
|
|
def test_user_cannot_edit_other_user(self):
|
|
"""Osigurava da user1 ne može mijenjati podatke od user2."""
|
|
self.client.force_authenticate(user=self.user1)
|
|
|
|
# Pokušavamo patchati user2 (pretpostavljamo URL /api/users/{id}/)
|
|
response = self.client.patch(f'/api/users/{self.user2.id}/', {"first_name": "Haker"})
|
|
|
|
# Trebali bismo dobiti 403 Forbidden ili 404 (ovisno kako skrivaš postojanje drugih)
|
|
assert response.status_code in [status.HTTP_403_FORBIDDEN, status.HTTP_404_NOT_FOUND]
|
|
|
|
def test_authenticated_user_can_edit_self(self):
|
|
"""Osigurava da user1 može mijenjati svoje podatke."""
|
|
self.client.force_authenticate(user=self.user1)
|
|
|
|
response = self.client.patch(f'/api/users/{self.user1.id}/', {"first_name": "Ime"})
|
|
|
|
assert response.status_code == status.HTTP_200_OK
|
|
self.user1.refresh_from_db()
|
|
assert self.user1.first_name == "Ime" |