linkding/bookmarks/tests/test_bookmarks_api_permissions.py

import urllib.parse

from django.urls import reverse
from rest_framework import status
from rest_framework.authtoken.models import Token

from bookmarks.tests.helpers import LinkdingApiTestCase, BookmarkFactoryMixin


class BookmarksApiPermissionsTestCase(LinkdingApiTestCase, BookmarkFactoryMixin):
    def authenticate(self) -> None:
        self.api_token = Token.objects.get_or_create(
            user=self.get_or_create_test_user()
        )[0]
        self.client.credentials(HTTP_AUTHORIZATION="Token " + self.api_token.key)

    def test_list_bookmarks_requires_authentication(self):
        self.get(
            reverse("bookmarks:bookmark-list"),
            expected_status_code=status.HTTP_401_UNAUTHORIZED,
        )

        self.authenticate()
        self.get(
            reverse("bookmarks:bookmark-list"), expected_status_code=status.HTTP_200_OK
        )

    def test_list_archived_bookmarks_requires_authentication(self):
        self.get(
            reverse("bookmarks:bookmark-archived"),
            expected_status_code=status.HTTP_401_UNAUTHORIZED,
        )

        self.authenticate()
        self.get(
            reverse("bookmarks:bookmark-archived"),
            expected_status_code=status.HTTP_200_OK,
        )

    def test_list_shared_bookmarks_does_not_require_authentication(self):
        self.get(
            reverse("bookmarks:bookmark-shared"),
            expected_status_code=status.HTTP_200_OK,
        )

        self.authenticate()
        self.get(
            reverse("bookmarks:bookmark-shared"),
            expected_status_code=status.HTTP_200_OK,
        )

    def test_create_bookmark_requires_authentication(self):
        data = {
            "url": "https://example.com/",
            "title": "Test title",
            "description": "Test description",
            "notes": "Test notes",
            "is_archived": False,
            "unread": False,
            "shared": False,
            "tag_names": ["tag1", "tag2"],
        }

        self.post(
            reverse("bookmarks:bookmark-list"), data, status.HTTP_401_UNAUTHORIZED
        )

        self.authenticate()
        self.post(reverse("bookmarks:bookmark-list"), data, status.HTTP_201_CREATED)

    def test_get_bookmark_requires_authentication(self):
        bookmark = self.setup_bookmark()
        url = reverse("bookmarks:bookmark-detail", args=[bookmark.id])

        self.get(url, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.get(url, expected_status_code=status.HTTP_200_OK)

    def test_update_bookmark_requires_authentication(self):
        bookmark = self.setup_bookmark()
        data = {"url": "https://example.com/"}
        url = reverse("bookmarks:bookmark-detail", args=[bookmark.id])

        self.put(url, data, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.put(url, data, expected_status_code=status.HTTP_200_OK)

    def test_patch_bookmark_requires_authentication(self):
        bookmark = self.setup_bookmark()
        data = {"url": "https://example.com"}
        url = reverse("bookmarks:bookmark-detail", args=[bookmark.id])

        self.patch(url, data, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.patch(url, data, expected_status_code=status.HTTP_200_OK)

    def test_delete_bookmark_requires_authentication(self):
        bookmark = self.setup_bookmark()
        url = reverse("bookmarks:bookmark-detail", args=[bookmark.id])

        self.delete(url, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.delete(url, expected_status_code=status.HTTP_204_NO_CONTENT)

    def test_archive_requires_authentication(self):
        bookmark = self.setup_bookmark()
        url = reverse("bookmarks:bookmark-archive", args=[bookmark.id])

        self.post(url, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.post(url, expected_status_code=status.HTTP_204_NO_CONTENT)

    def test_unarchive_requires_authentication(self):
        bookmark = self.setup_bookmark(is_archived=True)
        url = reverse("bookmarks:bookmark-unarchive", args=[bookmark.id])

        self.post(url, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.post(url, expected_status_code=status.HTTP_204_NO_CONTENT)

    def test_check_requires_authentication(self):
        url = reverse("bookmarks:bookmark-check")
        check_url = urllib.parse.quote_plus("https://example.com")

        self.get(
            f"{url}?url={check_url}", expected_status_code=status.HTTP_401_UNAUTHORIZED
        )

        self.authenticate()
        self.get(f"{url}?url={check_url}", expected_status_code=status.HTTP_200_OK)

    def test_user_profile_requires_authentication(self):
        url = reverse("bookmarks:user-profile")

        self.get(url, expected_status_code=status.HTTP_401_UNAUTHORIZED)

        self.authenticate()
        self.get(url, expected_status_code=status.HTTP_200_OK)