Add test of views using invitations

gregui/api/urls.py

@@ -18,7 +18,7 @@ urlpatterns += [
     re_path(r"register/$", GuestRegisterView.as_view(), name="guest-register"),
     re_path(r"roletypes/$", RoleTypeViewSet.as_view(), name="role-types"),
     re_path(r"units/$", UnitsViewSet.as_view(), name="units"),
-    path("invited/", InvitedGuestView.as_view(), name="invite"),
-    path("invited/<uuid>", CheckInvitationView.as_view()),
-    path("invite/", CreateInvitationView.as_view()),
+    path("invited/", InvitedGuestView.as_view(), name="invited-info"),
+    path("invited/<uuid>", CheckInvitationView.as_view(), name="invite-verify"),
+    path("invite/", CreateInvitationView.as_view(), name="invite-post"),
 ]

gregui/api/views/invitation.py

@@ -169,7 +169,7 @@ class InvitedGuestView(APIView):
         clicked by the user. The next part of the flow is for the sponsor to confirm
         the guest.
         """
-        invite_id = kwargs["uuid"]
+        invite_id = request.session.get("invite_id")
         data = request.data
 
         with transaction.atomic():

gregui/tests/api/test_invitation.py

+import pytest
+
+from rest_framework import status
+from rest_framework.reverse import reverse
+from rest_framework.test import APIClient
+
+from greg.models import InvitationLink, Person
+
+
+@pytest.mark.django_db
+def test_get_invite(client):
+    """Forbid access with bad invitation link uuid"""
+    response = client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": "baduuid"})
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_get_invite_ok(client, invitation_link):
+    """Access okay with valid invitation link"""
+    response = client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    assert response.status_code == status.HTTP_200_OK
+
+
+@pytest.mark.django_db
+def test_get_invite_expired(client, invitation_link_expired):
+    """Forbid access with expired invite link"""
+    response = client.get(
+        reverse(
+            "gregui-v1:invite-verify", kwargs={"uuid": invitation_link_expired.uuid}
+        )
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_get_invited_info_no_session(client, invitation_link):
+    response = client.get(reverse("gregui-v1:invited-info"))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_get_invited_info_session_okay(client, invitation_link):
+    # get a session
+    client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    # Get info
+    response = client.get(reverse("gregui-v1:invited-info"))
+    assert response.status_code == status.HTTP_200_OK
+    data = response.json()
+    assert data.get("person")
+    assert data.get("sponsor")
+    assert data.get("role")
+
+
+@pytest.mark.django_db
+def test_get_invited_info_expired_link(client, invitation_link):
+    # Get a session while link is valid
+    client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    # Set expire link to expire long ago
+    invlink = InvitationLink.objects.get(uuid=invitation_link.uuid)
+    invlink.expire = "1970-01-01"
+    invlink.save()
+    # Make a get request that should fail because invite expired after login, but
+    # before get to userinfo
+    response = client.get(reverse("gregui-v1:invited-info"))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_post_invited_info_ok_mobile_update(client: APIClient, invitation_link):
+    # get a session
+    client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    # post updated info to confirm from guest
+    new_phone = "12345678"
+    post_data = {"mobile_phone": new_phone}
+    response = client.post(
+        reverse("gregui-v1:invited-info"),
+        post_data,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    # Check that the object was updated in the database
+    person = Person.objects.get(id=invitation_link.invitation.role.person.id)
+    assert person.mobile_phone == new_phone
+
+
+@pytest.mark.django_db
+def test_post_invited_info_ok(client, invitation_link):
+    # get a session
+    client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    # post updated info to confirm from guest
+    response = client.post(reverse("gregui-v1:invited-info"))
+    assert response.status_code == status.HTTP_201_CREATED
+
+
+@pytest.mark.django_db
+def test_post_invited_info_expired_session(client, invitation_link):
+    # get a session
+    client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    # Set expire link to expire long ago
+    invlink = InvitationLink.objects.get(uuid=invitation_link.uuid)
+    invlink.expire = "1970-01-01"
+    invlink.save()
+    # post updated info to confirm from guest, should fail because of expired
+    # invitation link
+    response = client.post(reverse("gregui-v1:invited-info"))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_post_invited_info_deleted_inv_link(client, invitation_link):
+    # get a session
+    client.get(
+        reverse("gregui-v1:invite-verify", kwargs={"uuid": invitation_link.uuid})
+    )
+    # Delete link
+    invlink = InvitationLink.objects.get(uuid=invitation_link.uuid)
+    invlink.delete()
+    # post updated info to confirm from guest, should fail because of removed
+    # invitation link
+    response = client.post(reverse("gregui-v1:invited-info"))
+    assert response.status_code == status.HTTP_403_FORBIDDEN

gregui/tests/conftest.py

@@ -4,21 +4,72 @@ from rest_framework.test import APIClient
 
 import pytest
 
-# from greg.models import (
-#    Consent,
-#    Notification,
-#    Person,
-#    Sponsor,
-#    SponsorOrganizationalUnit,
-#    Identity,
-#    Role,
-#    RoleType,
-#    OrganizationalUnit,
-#    ConsentType,
-# )
+from greg.models import (
+    Invitation,
+    InvitationLink,
+    OrganizationalUnit,
+    Person,
+    Role,
+    RoleType,
+    Sponsor,
+)
 
 
 @pytest.fixture
 def client() -> APIClient:
     client = APIClient()
     return client
+
+
+@pytest.fixture
+def person() -> Person:
+    Person.objects.create()
+    return Person.objects.get(id=1)
+
+
+@pytest.fixture
+def sponsor() -> Sponsor:
+    Sponsor.objects.create()
+    return Sponsor.objects.get(id=1)
+
+
+@pytest.fixture
+def orgunit() -> OrganizationalUnit:
+    OrganizationalUnit.objects.create()
+    return OrganizationalUnit.objects.get(id=1)
+
+
+@pytest.fixture
+def role_type() -> RoleType:
+    RoleType.objects.create()
+    return RoleType.objects.get(id=1)
+
+
+@pytest.fixture
+def role(person, sponsor, orgunit, role_type) -> Role:
+    Role.objects.create(
+        person=person,
+        sponsor_id=sponsor,
+        orgunit_id=orgunit,
+        end_date="2050-10-15",
+        type_id=role_type.id,
+    )
+    return Role.objects.get(id=1)
+
+
+@pytest.fixture
+def invitation(role) -> Invitation:
+    Invitation.objects.create(role=role)
+    return Invitation.objects.get(id=1)
+
+
+@pytest.fixture
+def invitation_link(invitation) -> InvitationLink:
+    InvitationLink.objects.create(invitation=invitation, expire="2060-10-15")
+    return InvitationLink.objects.get(id=1)
+
+
+@pytest.fixture
+def invitation_link_expired(invitation) -> InvitationLink:
+    InvitationLink.objects.create(invitation=invitation, expire="1970-01-01")
+    return InvitationLink.objects.get(id=1)