diff --git a/modules/invenio-resourcesyncserver/invenio_resourcesyncserver/api.py b/modules/invenio-resourcesyncserver/invenio_resourcesyncserver/api.py index 61619251e6..9aede5fd4a 100644 --- a/modules/invenio-resourcesyncserver/invenio_resourcesyncserver/api.py +++ b/modules/invenio-resourcesyncserver/invenio_resourcesyncserver/api.py @@ -527,6 +527,9 @@ def get_record_content_file(self, record_id): include_contents, record_path, ) + if not exported_item: + # _export_item は閲覧権限のないレコードを {} で返す + return None result['items'].append(exported_item) @@ -1222,6 +1225,9 @@ def get_record_content_file(self, record_id): include_contents, record_path, ) + if not exported_item: + # _export_item は閲覧権限のないレコードを {} で返す + return None result['items'].append(exported_item) diff --git a/modules/invenio-resourcesyncserver/tests/test_api.py b/modules/invenio-resourcesyncserver/tests/test_api.py index beece032f7..90589d763f 100644 --- a/modules/invenio-resourcesyncserver/tests/test_api.py +++ b/modules/invenio-resourcesyncserver/tests/test_api.py @@ -372,6 +372,10 @@ def get_resource_dump_manifest(item): # Exception coverage assert not test.get_record_content_file(1) + # 閲覧権限のないレコードは _export_item が {} を返す + with patch("invenio_resourcesyncserver.api._export_item", return_value=({}, {})): + assert test.get_record_content_file(1) is None + # class ChangeListHandler(object): # def __init__(self, **kwargs): @@ -803,12 +807,16 @@ def get_change_dump_manifest_xml(key): test_str._is_record_in_index = _is_record_in_index - # Exception coverage + # es_records のレコードは非公開なので、匿名では書き出されない assert not test_str.get_record_content_file(record_id) - test_str.get_change_dump_manifest_xml = get_change_dump_manifest_xml + with patch("weko_items_ui.utils.check_publish_status", return_value=True): + # Exception coverage + assert not test_str.get_record_content_file(record_id) + + test_str.get_change_dump_manifest_xml = get_change_dump_manifest_xml - assert test_str.get_record_content_file(record_id) + assert test_str.get_record_content_file(record_id) # def get_capability_content(cls): diff --git a/modules/weko-groups/tests/conftest.py b/modules/weko-groups/tests/conftest.py index d38e427a25..7486be65c9 100644 --- a/modules/weko-groups/tests/conftest.py +++ b/modules/weko-groups/tests/conftest.py @@ -237,7 +237,7 @@ def users(app, db_2): comadmin = User.query.filter_by(email='comadmin@test.org').first() repoadmin = User.query.filter_by(email='repoadmin@test.org').first() sysadmin = User.query.filter_by(email='sysadmin@test.org').first() - generaluser = User.query.filter_by(email='generaluser@test.org') + generaluser = User.query.filter_by(email='generaluser@test.org').first() originalroleuser = create_test_user(email='originalroleuser@test.org') originalroleuser2 = create_test_user(email='originalroleuser2@test.org') @@ -278,7 +278,7 @@ def users(app, db_2): {'email': repoadmin.email, 'id': repoadmin.id, 'obj': repoadmin}, {'email': sysadmin.email, 'id': sysadmin.id, 'obj': sysadmin}, {'email': comadmin.email, 'id': comadmin.id, 'obj': comadmin}, - {'email': generaluser.email, 'id': generaluser.id, 'obj': sysadmin}, + {'email': generaluser.email, 'id': generaluser.id, 'obj': generaluser}, {'email': originalroleuser.email, 'id': originalroleuser.id, 'obj': originalroleuser}, {'email': originalroleuser2.email, 'id': originalroleuser2.id, 'obj': originalroleuser2}, {'email': user.email, 'id': user.id, 'obj': user}, diff --git a/modules/weko-groups/tests/test_models.py b/modules/weko-groups/tests/test_models.py index ef0d77df93..2cf5887809 100644 --- a/modules/weko-groups/tests/test_models.py +++ b/modules/weko-groups/tests/test_models.py @@ -975,10 +975,11 @@ def test_can_invite_others(example_group): assert group.can_invite_others(member) assert group.can_invite_others(non_member) + # 招待できるのは OPEN のときだけ。APPROVAL では管理者のみ group.subscription_policy = SubscriptionPolicy.APPROVAL assert group.can_invite_others(admin) - assert group.can_invite_others(member) - assert group.can_invite_others(non_member) + assert not group.can_invite_others(member) + assert not group.can_invite_others(non_member) group.subscription_policy = SubscriptionPolicy.CLOSED assert group.can_invite_others(admin) diff --git a/modules/weko-groups/tests/test_views.py b/modules/weko-groups/tests/test_views.py index 1263cec028..f593c3fd86 100644 --- a/modules/weko-groups/tests/test_views.py +++ b/modules/weko-groups/tests/test_views.py @@ -166,6 +166,13 @@ def validate_on_submit_False(): with app_2.test_request_context(): with app_2.test_client() as client: with patch("flask_login.utils._get_user", return_value=users[id]["obj"]): + if status_code == 403: + # roles_required で弾かれる。要求後にセッションが片付き + # fixture のユーザが detach されるため、続けて要求しない + res = client.get(url_for('weko_groups.new')) + assert res.status_code == status_code + return + with patch("weko_groups.views.GroupForm", return_value=form): # "Encountered unknown tag 'assets'. Jinja was looking for the following tags: 'endblock'. The innermost block that needs to be closed is 'block'.", # But upon testing on the actual url on the browser "https://localhost/accounts/settings/groups/new" there is no problem @@ -555,11 +562,24 @@ def test_new_member_3(app_2, users): with app_2.test_request_context(): group = Group.create(name="name", is_managed=True) with app_2.test_client() as client: - with patch("flask_login.utils._get_user", return_value=users[7]["obj"]): + # 管理者ロールがあっても is_managed のグループには招待できず戻される + with patch("flask_login.utils._get_user", return_value=users[3]["obj"]): res = client.get(url_for('weko_groups.new_member', group_id=group.id)) assert res.status_code == 302 +def test_new_member_4(app_2, users): + # 1要求ごとにセッションが片付き fixture のユーザが detach されるため、 + # 別ユーザでの確認は別のテストに分ける + with app_2.test_request_context(): + group = Group.create(name="name", is_managed=True) + with app_2.test_client() as client: + # 管理者ロールを持たないユーザは roles_required で弾かれる + with patch("flask_login.utils._get_user", return_value=users[7]["obj"]): + res = client.get(url_for('weko_groups.new_member', group_id=group.id)) + assert res.status_code == 403 + + # def remove_csrf(form): def test_remove_csrf(app): form = MagicMock() diff --git a/modules/weko-groups/tests/test_weko_groups.py b/modules/weko-groups/tests/test_weko_groups.py index bc61efada1..94d281e08e 100644 --- a/modules/weko-groups/tests/test_weko_groups.py +++ b/modules/weko-groups/tests/test_weko_groups.py @@ -55,5 +55,6 @@ def test_view(app): with app.test_client() as client: res = client.get('/accounts/settings/groups/groupcount') assert 200 == res.status_code + # grouplist は login_required。未ログインはログイン画面へ飛ばされる res = client.get('/accounts/settings/groups/grouplist') - assert 200 == res.status_code + assert 302 == res.status_code diff --git a/modules/weko-search-ui/tests/test_views.py b/modules/weko-search-ui/tests/test_views.py index e089f17655..250720b4b4 100644 --- a/modules/weko-search-ui/tests/test_views.py +++ b/modules/weko-search-ui/tests/test_views.py @@ -145,7 +145,7 @@ def test_opensearch_description_acl_guest(app,client_api,db_register2,index_styl # def journal_detail(index_id=0): def test_journal_detail(i18n_app, users, indices): with patch("flask_login.utils._get_user", return_value=users[3]['obj']): - assert journal_detail(33) + assert journal_detail(index_id=33) def test_journal_detail_forbidden(client, users, indices): diff --git a/modules/weko-workflow/tests/test_views.py b/modules/weko-workflow/tests/test_views.py index 6e59f93656..a13f39ecb4 100644 --- a/modules/weko-workflow/tests/test_views.py +++ b/modules/weko-workflow/tests/test_views.py @@ -4365,14 +4365,10 @@ def test_get_feedback_maillist_acl_users( # .tox/c1/bin/pytest --cov=weko_workflow tests/test_views.py::test_get_feedback_maillist -vv -s --cov-branch --cov-report=term --basetemp=/code/modules/weko-workflow/.tox/c1/tmp +# check_authority で弾かれずに本体まで届くよう、アクティビティの申請者ではない +# ユーザのうち管理者(sysadmin)で確認する。権限の境界は *_acl_* のテストで見る。 @pytest.mark.parametrize('users_index, status_code', [ - (0, 200), - #(1, 200), - #(2, 200), - #(3, 200), - #(4, 200), - #(5, 200), - #(6, 200), + (2, 200), ]) def test_get_feedback_maillist(client, users, db_register_full_action, users_index, status_code): login(client=client, email=users[users_index]['email'])