import urllib.parse from django.urls import reverse from rest_framework import status from rest_framework.authtoken.models import Token from bookmarks.tests.helpers import LinkdingApiTestCase, BookmarkFactoryMixin class BookmarksApiPermissionsTestCase(LinkdingApiTestCase, BookmarkFactoryMixin): def authenticate(self) -> None: self.api_token = Token.objects.get_or_create(user=self.get_or_create_test_user())[0] self.client.credentials(HTTP_AUTHORIZATION='Token ' + self.api_token.key) def test_list_bookmarks_requires_authentication(self): self.get(reverse('bookmarks:bookmark-list'), expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.get(reverse('bookmarks:bookmark-list'), expected_status_code=status.HTTP_200_OK) def test_list_archived_bookmarks_requires_authentication(self): self.get(reverse('bookmarks:bookmark-archived'), expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.get(reverse('bookmarks:bookmark-archived'), expected_status_code=status.HTTP_200_OK) def test_list_shared_bookmarks_does_not_require_authentication(self): self.get(reverse('bookmarks:bookmark-shared'), expected_status_code=status.HTTP_200_OK) self.authenticate() self.get(reverse('bookmarks:bookmark-shared'), expected_status_code=status.HTTP_200_OK) def test_create_bookmark_requires_authentication(self): data = { 'url': 'https://example.com/', 'title': 'Test title', 'description': 'Test description', 'notes': 'Test notes', 'is_archived': False, 'unread': False, 'shared': False, 'tag_names': ['tag1', 'tag2'] } self.post(reverse('bookmarks:bookmark-list'), data, status.HTTP_401_UNAUTHORIZED) self.authenticate() self.post(reverse('bookmarks:bookmark-list'), data, status.HTTP_201_CREATED) def test_get_bookmark_requires_authentication(self): bookmark = self.setup_bookmark() url = reverse('bookmarks:bookmark-detail', args=[bookmark.id]) self.get(url, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.get(url, expected_status_code=status.HTTP_200_OK) def test_update_bookmark_requires_authentication(self): bookmark = self.setup_bookmark() data = {'url': 'https://example.com/'} url = reverse('bookmarks:bookmark-detail', args=[bookmark.id]) self.put(url, data, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.put(url, data, expected_status_code=status.HTTP_200_OK) def test_patch_bookmark_requires_authentication(self): bookmark = self.setup_bookmark() data = {'url': 'https://example.com'} url = reverse('bookmarks:bookmark-detail', args=[bookmark.id]) self.patch(url, data, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.patch(url, data, expected_status_code=status.HTTP_200_OK) def test_delete_bookmark_requires_authentication(self): bookmark = self.setup_bookmark() url = reverse('bookmarks:bookmark-detail', args=[bookmark.id]) self.delete(url, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.delete(url, expected_status_code=status.HTTP_204_NO_CONTENT) def test_archive_requires_authentication(self): bookmark = self.setup_bookmark() url = reverse('bookmarks:bookmark-archive', args=[bookmark.id]) self.post(url, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.post(url, expected_status_code=status.HTTP_204_NO_CONTENT) def test_unarchive_requires_authentication(self): bookmark = self.setup_bookmark(is_archived=True) url = reverse('bookmarks:bookmark-unarchive', args=[bookmark.id]) self.post(url, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.post(url, expected_status_code=status.HTTP_204_NO_CONTENT) def test_check_requires_authentication(self): url = reverse('bookmarks:bookmark-check') check_url = urllib.parse.quote_plus('https://example.com') self.get(f'{url}?url={check_url}', expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.get(f'{url}?url={check_url}', expected_status_code=status.HTTP_200_OK) def test_user_profile_requires_authentication(self): url = reverse('bookmarks:user-profile') self.get(url, expected_status_code=status.HTTP_401_UNAUTHORIZED) self.authenticate() self.get(url, expected_status_code=status.HTTP_200_OK)