Calendar tests: auth & rights

tracim/tracim/tests/__init__.py

@@ -37,7 +37,8 @@ from tracim.lib.content import ContentApi
 from tracim.lib.workspace import WorkspaceApi
 from tracim.model import DBSession, Content
 from tracim.model.data import Workspace, ContentType, ContentRevisionRO
-from tracim.lib.calendar import CALENDAR_BASE_URL
+from tracim.lib.calendar import CALENDAR_BASE_URL_TEMPLATE
+from tracim.lib.calendar import CALENDAR_USER_URL_TEMPLATE
 
 __all__ = ['setup_app', 'setup_db', 'teardown_db', 'TestController']
 
@@ -374,8 +375,20 @@ class TestCalendar(TestController):
         from tracim.config.app_cfg import CFG
         cfg = CFG.get_instance()
 
-        return CALENDAR_BASE_URL.format(
+        return CALENDAR_BASE_URL_TEMPLATE.format(
             proto='https' if cfg.RADICALE_CLIENT_SSL else 'http',
             domain=cfg.RADICALE_CLIENT_HOST or '127.0.0.1',
             port=str(cfg.RADICALE_CLIENT_PORT)
         )
+
+    def _get_user_calendar_url(self, user_id):
+        from tracim.config.app_cfg import CFG
+        cfg = CFG.get_instance()
+
+        return CALENDAR_USER_URL_TEMPLATE.format(
+            proto='https' if cfg.RADICALE_CLIENT_SSL else 'http',
+            domain=cfg.RADICALE_CLIENT_HOST or '127.0.0.1',
+            port=str(cfg.RADICALE_CLIENT_PORT),
+            id=user_id,
+            extra='',
+        )

tracim/tracim/tests/functional/test_calendar.py

@@ -6,7 +6,9 @@ from nose.tools import eq_, ok_
 import requests
 from requests.exceptions import ConnectionError
 
+from tracim.model import DBSession
 from tracim.tests import TestCalendar as BaseTestCalendar
+from tracim.model.auth import User
 
 
 class TestCalendar(BaseTestCalendar):
@@ -25,11 +27,72 @@ class TestCalendar(BaseTestCalendar):
             ok_(False, 'Unable to contact radicale on HTTP')
 
     def test_func__radicale_auth__ok__as_lawrence(self):
-        client = caldav.DAVClient('http://127.0.0.1:15232',
-                                  username='lawrence-not-real-email@fsf.local',
-                                  password='foobarbaz')
+        radicale_base_url = self._get_base_url()
+        client = caldav.DAVClient(
+            radicale_base_url,
+            username='lawrence-not-real-email@fsf.local',
+            password='foobarbaz'
+        )
         try:
             client.propfind()
             ok_(True, 'No auth error when communicate with radicale server')
         except AuthorizationError:
             ok_(False, 'AuthorizationError when communicate with radicale')
+
+    def test_func__radicale_auth__fail__as_john_doe(self):
+        radicale_base_url = self._get_base_url()
+        client = caldav.DAVClient(
+            radicale_base_url,
+            username='john.doe@foo.local',
+            password='nopasswd'
+        )
+        try:
+            client.propfind()
+            ok_(False, 'Auth with unknown user should be raise'
+                       ' AuthorizationError !')
+        except AuthorizationError:
+            ok_(True, 'AuthorizationError thrown correctly')
+
+    def test_func__radicale_rights_read_user_calendar__ok__as_lawrence(self):
+        radicale_base_url = self._get_base_url()
+        client = caldav.DAVClient(
+            radicale_base_url,
+            username='lawrence-not-real-email@fsf.local',
+            password='foobarbaz'
+        )
+        user = DBSession.query(User).filter(
+            User.email == 'lawrence-not-real-email@fsf.local'
+        ).one()
+        calendar_base_url = self._get_user_calendar_url(user.user_id)
+        try:
+            caldav.Calendar(
+                parent=client,
+                client=client,
+                url=calendar_base_url
+            ).events()
+
+            ok_(True, 'User can access it\'s own calendar')
+        except AuthorizationError:
+            ok_(False, 'User should not access that')
+
+    def test_func__radicale_rights_read_user_calendar__fail__as_john_doe(self):
+        radicale_base_url = self._get_base_url()
+        client = caldav.DAVClient(
+            radicale_base_url,
+            username='john.doe@foo.local',
+            password='nopasswd'
+        )
+        other_user = DBSession.query(User).filter(
+            User.email == 'admin@admin.admin'
+        ).one()
+        calendar_base_url = self._get_user_calendar_url(other_user.user_id)
+        try:
+            caldav.Calendar(
+                parent=client,
+                client=client,
+                url=calendar_base_url
+            ).events()
+
+            ok_(False, 'User can\'t acces other user calendar')
+        except AuthorizationError:
+            ok_(True, 'User should not acces other user calendar')