CODEWITHSUNDEEP
pythondjangodjango-testingpython-decoratorsdjango-tests
python
python

Reputation: 4521

How to test that a view is only accessed by staff users in Django

I am learning testing in Django, and have a view which I want to test. This view should only be accessed by staff users. Suppose the view is:

def staff_users(request):
    ....
    # some logic

    return HttpResponseRedirect('/repositories/')

if the request is coming from staff users, it should redirect to repositories otherwise I should get something like permission denied. I am starting with something like in tests.py. 

 def test_request_object(self):
        self.user = User.objects.create_user(
        username='abc', email='[email protected]', password='1234')
        request = HttpRequest()
        # User send a request to access repositories
        response = staff_users(request)
        self.assertIsNone(response)

The problem is here I am not associating my request object with any users, and I also got to know about from django.contrib.admin.views.decorators import staff_member_required but not sure how to use them here. Could anyone tell me how should I test my view should only be accessed by staff users?

Upvotes: 2

Views: 1910

Answers (1)

anand
anand

Reputation: 1526

All you need to do is decorate your view which you want to protect as shown below:

@staff_member_required
def staff_users(request):
    ....
    # some logic

    return HttpResponseRedirect('/repositories/')

If you want a custom logic for testing instead of using django decorator then you can write your own decorator as well.

def staff_users_only(function):
  def wrap(request, *args, **kwargs):

        profile = request.session['user_profile']
        if profile is True: #then its a staff member
             return function(request, *args, **kwargs)
        else:
            return HttpResponseRedirect('/')

  wrap.__doc__=function.__doc__
  wrap.__name__=function.__name__
  return wrap

and use it as:

@staff_users_only
def staff_users(request):
    ....
    # some logic

    return HttpResponseRedirect('/repositories/')

Edit

Association of sessions on request object for testing can be done as:

def test_request_object(self):
    self.user = User.objects.create_user(
    username='abc', email='[email protected]', password='1234')
    request = HttpRequest()
    #create a session which will hold the user profile that will be used in by our custom decorator
    request.session = {} #Session middleware is not available in UnitTest hence create a blank dictionary for testing purpose
    request.session['user_profile'] = self.user.is_staff #assuming its django user.

    # User send a request to access repositories
    response = staff_users(request)

    #Check the response type for appropriate action
    self.assertIsNone(response)

Edit 2

Also it would be a far better idea to use django Client library for testing:

>>> from django.test import Client
>>> c = Client()
>>> response = c.post('/login/', {'username': 'abc', 'password': '1234'})
>>> response.status_code
200
>>> response = c.get('/user/protected-page/')
>>> response.content
b'<!DOCTYPE html...

Upvotes: 4

Related Questions