tests.py

from __future__ import annotations
from django.test import TestCase
from django.urls import reverse
from backend.unittest import TestBase
from django.contrib.auth import get_user_model


class TestPermissions(TestBase, TestCase):
    def test_impersonate_staff(self):
        User = get_user_model()
        visitor = User.objects.create_superuser(email="admin@example.org", fullname="Admin", audit_skip=True)
        visited = User.objects.create_user(email="user@example.org", fullname="User", audit_skip=True)
        client = self.make_test_client(visitor)

        response = client.get(reverse("impersonate:whoami"))
        self.assertJSONEqual(response.content, {
            'impersonator': None,
            'impersonator_desc': None,
            'user': visitor.pk,
            'user_desc': str(visitor),
        })

        response = client.post(reverse("impersonate:impersonate"), data={"pk": visited.pk, "next": "/"})
        self.assertRedirectMatches(response, "^/$")

        response = client.get(reverse("impersonate:whoami"))
        self.assertJSONEqual(response.content, {
            'impersonator': visitor.pk,
            'impersonator_desc': str(visitor),
            'user': visited.pk,
            'user_desc': str(visited),
        })

    def test_impersonate_user(self):
        User = get_user_model()
        visitor = User.objects.create_user(email="user@example.org", fullname="User", audit_skip=True)
        visited = User.objects.create_user(email="user1@example.org", fullname="User1", audit_skip=True)
        client = self.make_test_client(visitor)
        response = client.post(reverse("impersonate:impersonate"), data={"pk": visited.pk})
        self.assertPermissionDenied(response)

        response = client.get(reverse("impersonate:whoami"))
        self.assertJSONEqual(response.content, {
            'impersonator': None,
            'impersonator_desc': None,
            'user': visitor.pk,
            'user_desc': str(visitor),
        })

    def test_impersonate_anonymous(self):
        User = get_user_model()
        visited = User.objects.create_user(email="user@example.org", fullname="User", audit_skip=True)
        client = self.make_test_client(None)
        response = client.post(reverse("impersonate:impersonate"), data={"pk": visited.pk})
        self.assertPermissionDenied(response)

        response = client.get(reverse("impersonate:whoami"))
        self.assertJSONEqual(response.content, {
            'impersonator': None,
            'impersonator_desc': None,
            'user': None,
            'user_desc': "AnonymousUser",
        })