[#1799] Add tests for cms cases-plugin

src/open_inwoner/cms/cases/cms_plugins.py

@@ -7,6 +7,7 @@
 from open_inwoner.openzaak.cases import fetch_cases
 from open_inwoner.openzaak.formapi import fetch_open_submissions
 
+from ..utils.auth import check_user_access_rights, check_user_auth
 from ..utils.plugin_mixins import CMSActiveAppMixin
 
 
@@ -23,10 +24,18 @@ class CasesPlugin(CMSActiveAppMixin, CMSPluginBase):
 
     def render(self, context, instance, placeholder):
         request = context["request"]
+        user = request.user
+
+        if not check_user_auth(user, digid_required=True):
+            context["cases"] = None
+            return context
+
+        raw_cases = [case for case in fetch_cases(user.bsn) if not case.einddatum]
+
+        if not all(check_user_access_rights(user, case.url) for case in raw_cases):
+            context["cases"] = None
+            return context
 
-        raw_cases = [
-            case for case in fetch_cases(request.user.bsn) if not case.einddatum
-        ]
         # TODO
         # preprocessed_cases = preprocess_data(raw_cases)
 

src/open_inwoner/cms/cases/tests/test_plugin_cases.py

@@ -2,8 +2,12 @@
 
 from django.test import TestCase, override_settings
 
+import lxml
 import requests_mock
+from pyquery import PyQuery as pq
 
+from open_inwoner.accounts.choices import LoginTypeChoices
+from open_inwoner.accounts.tests.factories import UserFactory
 from open_inwoner.openzaak.tests.mixins import ZakenTestMixin
 from open_inwoner.utils.test import ClearCachesMixin
 
@@ -21,14 +25,62 @@ def setUpTestData(cls):
         super().setUpTestData()
         cms_tools.create_apphook_page(CasesApphook)
 
-    def test_cms_plugin_cases_are_rendered(self, m):
-        self._setUpMocks(m)
+    def test_cms_plugin_cases_not_rendered_for_anonymous_user(self, m):
+        self.setUpMocks(m)
 
+        # anonymous user
+        html, context = cms_tools.render_plugin(CasesPlugin)
+
+        self.assertIsNone(context["cases"])
+
+        # check that html empty
+        with self.assertRaises(lxml.etree.ParserError) as ctx:
+            pq(html)
+
+        self.assertEqual(str(ctx.exception), "Document is empty")
+
+    def test_cms_plugin_cases_not_rendered_for_non_digid_user(self, m):
+        self.setUpMocks(m)
+
+        user = UserFactory()
+        user.login_type = LoginTypeChoices.default
+        user.save()
+
+        html, context = cms_tools.render_plugin(CasesPlugin, user=user)
+
+        self.assertIsNone(context["cases"])
+
+        # check that html empty
+        with self.assertRaises(lxml.etree.ParserError) as ctx:
+            pq(html)
+
+        self.assertEqual(str(ctx.exception), "Document is empty")
+
+    def test_cms_plugin_cases_rendered(self, m):
+        self.setUpMocks(m)
+        self.setUpMocksExtra(m)  # create additional zaken
+
+        # the ZakenTestMixin user is a digid user
         html, context = cms_tools.render_plugin(CasesPlugin, user=self.user)
 
         cases = context["cases"]
 
+        # check that limiting display works (ZakenTestMixin creates 3 zaken)
         self.assertEqual(len(cases), 2)
 
         self.assertEqual(cases[0].omschrijving, "Coffee zaak 1")
         self.assertEqual(cases[1].omschrijving, "Coffee zaak 2")
+
+        # check html
+        doc = pq(html)
+
+        case_descriptions = doc.find(".h4").find("span")
+
+        for case_description, case in zip(case_descriptions, cases):
+            self.assertEqual(case_description.text, case.omschrijving)
+
+        case_link_paths = (case.url.rsplit("/", 1)[-1] for case in cases)
+        html_case_links = doc.find("a")
+
+        for html_link, path in zip(html_case_links, case_link_paths):
+            self.assertEqual(html_link.attrib["href"], f"/cases/{path}/status/")

src/open_inwoner/cms/products/cms_plugins.py

@@ -3,7 +3,6 @@
 from cms.plugin_base import CMSPluginBase
 from cms.plugin_pool import plugin_pool
 
-from open_inwoner.openzaak.cases import fetch_cases
 from open_inwoner.pdc.forms import ProductFinderForm
 from open_inwoner.pdc.models import Category, ProductCondition, ProductLocation
 from open_inwoner.questionnaire.models import QuestionnaireStep
@@ -15,8 +14,7 @@
 class CategoriesPlugin(CMSActiveAppMixin, CMSPluginBase):
     module = _("PDC")
     name = _("Categories Plugin")
-    # render_template = "cms/products/categories_plugin.html"
-    render_template = "cms/cases/cases_plugin.html"
+    render_template = "cms/products/categories_plugin.html"
     app_hook = "ProductsApphook"
     cache = False
 
@@ -42,10 +40,6 @@ def render(self, context, instance, placeholder):
 
         context["categories"] = categories
 
-        # from cms.models import Page
-        # pages = Page.objects.published().all()
-        # import pdb;pdb.set_trace()
-
         return context
 
 

src/open_inwoner/cms/utils/auth.py

@@ -0,0 +1,22 @@
+import logging
+
+from open_inwoner.openzaak.cases import fetch_roles_for_case_and_bsn
+
+logger = logging.getLogger(__name__)
+
+
+def check_user_auth(user, digid_required: bool = False) -> bool:
+    if not user.is_authenticated:
+        logger.debug("Permission denied: user not authenticated")
+        return False
+    if digid_required and not getattr(user, "bsn", None):
+        logger.debug("Permission denied: user has no BSN")
+        return False
+    return True
+
+
+def check_user_access_rights(user, case_url) -> bool:
+    if not fetch_roles_for_case_and_bsn(case_url, user.bsn):
+        f"Permission denied: no role for the case {case_url}"
+        return False
+    return True