492 cnx = self.login('iaminusersgrouponly') |
492 cnx = self.login('iaminusersgrouponly') |
493 session = self.session |
493 session = self.session |
494 # needed to avoid check_perm error |
494 # needed to avoid check_perm error |
495 session.set_pool() |
495 session.set_pool() |
496 # needed to remove rql expr granting update perm to the user |
496 # needed to remove rql expr granting update perm to the user |
|
497 affaire_perms = self.schema['Affaire'].permissions.copy() |
497 self.schema['Affaire'].set_action_permissions('update', self.schema['Affaire'].get_groups('update')) |
498 self.schema['Affaire'].set_action_permissions('update', self.schema['Affaire'].get_groups('update')) |
498 self.assertRaises(Unauthorized, |
|
499 self.schema['Affaire'].check_perm, session, 'update', eid=eid) |
|
500 cu = cnx.cursor() |
|
501 self.schema['Affaire'].set_action_permissions('read', ('users',)) |
|
502 try: |
499 try: |
|
500 self.assertRaises(Unauthorized, |
|
501 self.schema['Affaire'].check_perm, session, 'update', eid=eid) |
|
502 cu = cnx.cursor() |
|
503 self.schema['Affaire'].set_action_permissions('read', ('users',)) |
503 aff = cu.execute('Any X WHERE X ref "ARCT01"').get_entity(0, 0) |
504 aff = cu.execute('Any X WHERE X ref "ARCT01"').get_entity(0, 0) |
504 aff.fire_transition('abort') |
505 aff.fire_transition('abort') |
505 cnx.commit() |
506 cnx.commit() |
506 # though changing a user state (even logged user) is reserved to managers |
507 # though changing a user state (even logged user) is reserved to managers |
507 user = cnx.user(self.session) |
508 user = cnx.user(self.session) |
508 # XXX wether it should raise Unauthorized or ValidationError is not clear |
509 # XXX wether it should raise Unauthorized or ValidationError is not clear |
509 # the best would probably ValidationError if the transition doesn't exist |
510 # the best would probably ValidationError if the transition doesn't exist |
510 # from the current state but Unauthorized if it exists but user can't pass it |
511 # from the current state but Unauthorized if it exists but user can't pass it |
511 self.assertRaises(ValidationError, user.fire_transition, 'deactivate') |
512 self.assertRaises(ValidationError, user.fire_transition, 'deactivate') |
512 finally: |
513 finally: |
513 self.schema['Affaire'].set_action_permissions('read', ('managers',)) |
514 # restore orig perms |
|
515 for action, perms in affaire_perms.iteritems(): |
|
516 self.schema['Affaire'].set_action_permissions(action, perms) |
514 |
517 |
515 def test_trinfo_security(self): |
518 def test_trinfo_security(self): |
516 aff = self.execute('INSERT Affaire X: X ref "ARCT01"').get_entity(0, 0) |
519 aff = self.execute('INSERT Affaire X: X ref "ARCT01"').get_entity(0, 0) |
517 self.commit() |
520 self.commit() |
518 aff.fire_transition('abort') |
521 aff.fire_transition('abort') |