2021-07-15 00:45:53 +00:00
|
|
|
from user import User
|
|
|
|
import test_engine
|
|
|
|
import testsamples
|
|
|
|
|
|
|
|
class TestUser(test_engine.EngineTestCase):
|
|
|
|
# pylint: disable=no-member
|
|
|
|
def setUp(self):
|
|
|
|
super(TestUser, self).setUp()
|
|
|
|
self.load_sample(testsamples.sample_students)
|
|
|
|
|
|
|
|
def test_constructor_sets_user_attributes(self):
|
|
|
|
data = {
|
|
|
|
'Access': 'owners',
|
|
|
|
'Name': 'Foo Bar',
|
|
|
|
'Email': 'email@example.com',
|
|
|
|
'UserID': 1,
|
2022-10-03 14:45:44 +00:00
|
|
|
'UserRef': '1',
|
2021-07-15 00:45:53 +00:00
|
|
|
'LinkKey': {
|
|
|
|
'Param1': 'Param1Value',
|
|
|
|
'Param2': 'Param2Value'
|
|
|
|
},
|
|
|
|
'Origin': 'https://getgrist.com',
|
(core) add a `user.SessionID` value for trigger formulas and granular access rules
Summary:
This makes a `user.SessionID` value available in information about the user, for use with trigger formulas and granular access rules. The ID should be constant within a browser session for anonymous user. For logged in users it simply reflects their user id.
This ID makes it possible to write access rules and trigger formulas that allow different anonymous users to create, view, and edit their own records in a document.
For example, you could have a brain-storming document for puns, and allow anyone to add to it (without logging in), letting people edit their own records, but not showing the records to others until they are approved by a moderator. Without something like this, we could only let anonymous people add one field of a record, and not have a secure way to let them edit that field or others in the same record.
Also adds a `user.IsLoggedIn` flag in passing.
Test Plan: Added a test, updated tests. The test added is a mini-moderation doc, don't use it for real because it allows users to edit their entries after a moderator has approved them.
Reviewers: georgegevoian
Reviewed By: georgegevoian
Subscribers: dsagal
Differential Revision: https://phab.getgrist.com/D3273
2022-02-22 15:42:06 +00:00
|
|
|
'StudentInfo': ['Students', 1],
|
|
|
|
'SessionID': 'u1',
|
|
|
|
'IsLoggedIn': True
|
2021-07-15 00:45:53 +00:00
|
|
|
}
|
|
|
|
u = User(data, self.engine.tables)
|
|
|
|
self.assertEqual(u.Name, 'Foo Bar')
|
|
|
|
self.assertEqual(u.Email, 'email@example.com')
|
|
|
|
self.assertEqual(u.UserID, 1)
|
|
|
|
self.assertEqual(u.LinkKey.Param1, 'Param1Value')
|
|
|
|
self.assertEqual(u.LinkKey.Param2, 'Param2Value')
|
|
|
|
self.assertEqual(u.Access, 'owners')
|
|
|
|
self.assertEqual(u.Origin, 'https://getgrist.com')
|
|
|
|
self.assertEqual(u.StudentInfo.id, 1)
|
|
|
|
self.assertEqual(u.StudentInfo.firstName, 'Barack')
|
|
|
|
self.assertEqual(u.StudentInfo.lastName, 'Obama')
|
|
|
|
self.assertEqual(u.StudentInfo.schoolName, 'Columbia')
|
|
|
|
|
|
|
|
def test_setting_is_sample_substitutes_attributes_with_samples(self):
|
|
|
|
data = {
|
|
|
|
'Access': 'owners',
|
|
|
|
'Name': None,
|
|
|
|
'Email': 'email@getgrist.com',
|
|
|
|
'UserID': 1,
|
2022-10-03 14:45:44 +00:00
|
|
|
'UserRef': '1',
|
2021-07-15 00:45:53 +00:00
|
|
|
'LinkKey': {
|
|
|
|
'Param1': 'Param1Value',
|
|
|
|
'Param2': 'Param2Value'
|
|
|
|
},
|
|
|
|
'Origin': 'https://getgrist.com',
|
(core) add a `user.SessionID` value for trigger formulas and granular access rules
Summary:
This makes a `user.SessionID` value available in information about the user, for use with trigger formulas and granular access rules. The ID should be constant within a browser session for anonymous user. For logged in users it simply reflects their user id.
This ID makes it possible to write access rules and trigger formulas that allow different anonymous users to create, view, and edit their own records in a document.
For example, you could have a brain-storming document for puns, and allow anyone to add to it (without logging in), letting people edit their own records, but not showing the records to others until they are approved by a moderator. Without something like this, we could only let anonymous people add one field of a record, and not have a secure way to let them edit that field or others in the same record.
Also adds a `user.IsLoggedIn` flag in passing.
Test Plan: Added a test, updated tests. The test added is a mini-moderation doc, don't use it for real because it allows users to edit their entries after a moderator has approved them.
Reviewers: georgegevoian
Reviewed By: georgegevoian
Subscribers: dsagal
Differential Revision: https://phab.getgrist.com/D3273
2022-02-22 15:42:06 +00:00
|
|
|
'StudentInfo': ['Students', 1],
|
|
|
|
'SessionID': 'u1',
|
|
|
|
'IsLoggedIn': True
|
2021-07-15 00:45:53 +00:00
|
|
|
}
|
|
|
|
u = User(data, self.engine.tables, is_sample=True)
|
|
|
|
self.assertEqual(u.StudentInfo.id, 0)
|
|
|
|
self.assertEqual(u.StudentInfo.firstName, '')
|
|
|
|
self.assertEqual(u.StudentInfo.lastName, '')
|
|
|
|
self.assertEqual(u.StudentInfo.schoolName, '')
|