Skip to content

fix group permission issue (No. 307, 312~326) #1931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ivis-miyachi merged 2 commits into from
Sep 29, 2026
Merged

fix group permission issue (No. 307, 312~326) #1931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
11b0527
fix group permission issue (No.306, 307, 312~326)
wei-kuochen Sep 29, 2026
297905d
add test code
wei-kuochen Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 81 additions & 22 deletions modules/weko-groups/tests/test_views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,15 @@ def test_invitations(app_2, users):


# def new():
def test_new(app_2, users):
user_results = [
(0, 403),
(1, 302),
(2, 302),
(3, 302),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_new(app_2, users, id, status_code):
from sqlalchemy.exc import IntegrityError

def validate_on_submit_True():
Expand All @@ -157,7 +165,7 @@ def validate_on_submit_False():

with app_2.test_request_context():
with app_2.test_client() as client:
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.GroupForm", return_value=form):
# "Encountered unknown tag 'assets'. Jinja was looking for the following tags: 'endblock'. The innermost block that needs to be closed is 'block'.",
# But upon testing on the actual url on the browser "https://localhost/accounts/settings/groups/new" there is no problem
Expand All @@ -171,7 +179,7 @@ def validate_on_submit_False():
with patch("weko_groups.views.GroupForm", return_value=form):
with patch("weko_groups.views.Group.create", return_value=group):
res = client.get(url_for('weko_groups.new'))
assert res.status_code == 302
assert res.status_code == status_code

# Exception coverage
try:
Expand All @@ -182,7 +190,15 @@ def validate_on_submit_False():


# def manage(group_id):
def test_manage(app_2, users):
user_results = [
(0, 403),
(1, 302),
(2, 302),
(3, 302),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_manage(app_2, users, id, status_code):
def validate_on_submit_True():
return True

Expand All @@ -207,11 +223,12 @@ def update_func(item):
# "Encountered unknown tag 'assets'. Jinja was looking for the following tags: 'endblock'. The innermost block that needs to be closed is 'block'.",
# But upon testing on the actual url on the browser "https://localhost/accounts/settings/groups/1" there is no problem
# But upon testing on the actual url on the browser "https://localhost/accounts/settings/groups/1/manage" there is no problem
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.Group", return_value=group):
with patch("weko_groups.views.GroupForm", return_value=form):
try:
client.get(url_for('weko_groups.manage', group_id=1))
res = client.get(url_for('weko_groups.manage', group_id=1))
assert res.status_code == status_code
except:
pass

Expand All @@ -238,7 +255,15 @@ def validate_on_submit_True():


# def delete(group_id):
def test_delete(app_2, users):
user_results = [
(0, 403),
(1, 302),
(2, 302),
(3, 302),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_delete(app_2, users, id, status_code):
def can_edit_True(item):
return True

Expand All @@ -256,10 +281,10 @@ def delete_func():

with app_2.test_request_context():
with app_2.test_client() as client:
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.Group", return_value=group):
res = client.post(url_for('weko_groups.delete', group_id=1))
assert res.status_code == 302
assert res.status_code == status_code


def test_delete_2(app_2, users):
Expand All @@ -272,7 +297,15 @@ def test_delete_2(app_2, users):


# def members(group_id):
def test_members(app_2, users):
user_results = [
(0, 403),
(1, 200),
(2, 200),
(3, 200),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_members(app_2, users, id, status_code):
def can_edit_True(item):
return True

Expand All @@ -290,7 +323,7 @@ def delete_func():

with app_2.test_request_context():
with app_2.test_client() as client:
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.Group", return_value=group):
res = client.post(
url_for('weko_groups.members', group_id=1),
Expand All @@ -299,7 +332,7 @@ def delete_func():
"s": "s",
}
)
assert res.status_code == 200
assert res.status_code == status_code


def test_members_2(app_2, users):
Expand Down Expand Up @@ -338,7 +371,15 @@ def test_leave_2(app_2, users):


# def approve(group_id, user_id):
def test_approve(app_2, users):
user_results = [
(0, 403),
(1, 302),
(2, 302),
(3, 302),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_approve(app_2, users, id, status_code):
def can_edit_True(item):
return True

Expand All @@ -347,10 +388,10 @@ def can_edit_True(item):

with app_2.test_request_context():
with app_2.test_client() as client:
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.Membership", return_value=membership):
res = client.post(url_for('weko_groups.approve', group_id=1, user_id=users[3]["obj"].id))
assert res.status_code == 302
assert res.status_code == status_code


def test_approve_2(app_2, users):
Expand All @@ -363,7 +404,15 @@ def test_approve_2(app_2, users):


# def remove(group_id, user_id):
def test_remove(app_2, users):
user_results = [
(0, 403),
(1, 302),
(2, 302),
(3, 302),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_remove(app_2, users, id, status_code):
def can_edit_True(item):
return True

Expand All @@ -372,10 +421,10 @@ def can_edit_True(item):

with app_2.test_request_context():
with app_2.test_client() as client:
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.Group", return_value=group):
res = client.post(url_for('weko_groups.remove', group_id=1, user_id=users[3]["obj"].id))
assert res.status_code == 302
assert res.status_code == status_code


def test_remove_2(app_2, users):
Expand Down Expand Up @@ -428,7 +477,15 @@ def reject():


# def new_member(group_id):
def test_new_member(app_2, users):
user_results = [
(0, 403),
(1, 302),
(2, 302),
(3, 302),
(4, 403),
]
@pytest.mark.parametrize('id, status_code', user_results)
def test_new_member(app_2, users, id, status_code):
def validate_on_submit_True():
return True

Expand All @@ -449,15 +506,17 @@ def invite_by_emails(item):
# "Encountered unknown tag 'assets'. Jinja was looking for the following tags: 'endblock'. The innermost block that needs to be closed is 'block'."
# But upon testing on the actual url on the browser "https://localhost/accounts/settings/groups/1/members/new" there is no problem
with app_2.test_client() as client:
with patch("flask_login.utils._get_user", return_value=users[3]["obj"]):
with patch("flask_login.utils._get_user", return_value=users[id]["obj"]):
with patch("weko_groups.views.Group", return_value=group):
with patch("weko_groups.views.NewMemberForm", return_value=form):
try:
client.get(url_for('weko_groups.new_member', group_id=1))
res = client.get(url_for('weko_groups.new_member', group_id=1))
assert res.status_code == status_code
except:
pass
try:
client.get(url_for('weko_groups.new_member', group_id=1))
res = client.get(url_for('weko_groups.new_member', group_id=1))
assert res.status_code == status_code
except:
pass

Expand Down
2 changes: 1 addition & 1 deletion modules/weko-groups/weko_groups/models.py
View file
Open in desktop
Comment thread
wei-kuochen marked this conversation as resolved.
Original file line number Diff line number Diff line change
Expand Up @@ -517,7 +517,7 @@ def can_invite_others(self, user):
return False
elif self.is_admin(user):
return True
elif self.subscription_policy != SubscriptionPolicy.CLOSED:
elif self.subscription_policy == SubscriptionPolicy.OPEN:

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.325, 326

return True
else:
return False
Expand Down
25 changes: 25 additions & 0 deletions modules/weko-groups/weko_groups/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@
from six.moves.urllib.parse import urlparse
from sqlalchemy.exc import IntegrityError
from invenio_db import db
from weko_accounts.utils import roles_required
from weko_admin.config import WEKO_ADMIN_PERMISSION_ROLE_REPO, \
WEKO_ADMIN_PERMISSION_ROLE_SYSTEM, WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY

from .forms import GroupForm, NewMemberForm
from .models import Group, Membership
Expand Down Expand Up @@ -116,6 +119,7 @@ def groupcount():


@blueprint.route('/grouplist', methods=['GET'])
@login_required

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.307

def grouplist():
"""
Get logined group list info.
Expand Down Expand Up @@ -210,6 +214,9 @@ def invitations():
@blueprint.route('/new', methods=['GET', 'POST'])
@register_breadcrumb(blueprint, 'breadcrumbs.settings.group.new', _('New'))
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.312, 313

def new():
"""
Create new group.
Expand Down Expand Up @@ -250,6 +257,9 @@ def new():
{'text': _('Manage')}]
)
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.314, 315, 316, 317

def manage(group_id):
"""
Manage your group.
Expand Down Expand Up @@ -294,6 +304,9 @@ def manage(group_id):

@blueprint.route('/<int:group_id>/delete', methods=['POST'])
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.318

def delete(group_id):
"""
Delete group.
Expand Down Expand Up @@ -328,6 +341,9 @@ def delete(group_id):

@blueprint.route('/<int:group_id>/members', methods=['GET', 'POST'])
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.319

@register_breadcrumb(
blueprint, 'breadcrumbs.settings.group.members', _('Members'),
dynamic_list_constructor=lambda:
Expand Down Expand Up @@ -417,6 +433,9 @@ def leave(group_id):
@blueprint.route('/<int:group_id>/members/<int:user_id>/approve',
methods=['POST'])
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.321

def approve(group_id, user_id):
"""
Approve a user.
Expand Down Expand Up @@ -455,6 +474,9 @@ def approve(group_id, user_id):
@blueprint.route('/<int:group_id>/members/<int:user_id>/remove',
methods=['POST'])
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.322

def remove(group_id, user_id):
"""
Remove user from a group.
Expand Down Expand Up @@ -549,6 +571,9 @@ def reject(group_id):

@blueprint.route('/<int:group_id>/members/new', methods=['GET', 'POST'])
@login_required
@roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM,
WEKO_ADMIN_PERMISSION_ROLE_REPO,
WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY])

@wei-kuochen wei-kuochen Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix no.325, 326

@register_breadcrumb(
blueprint,
'breadcrumbs.settings.newmember',
Expand Down
Loading