138 lines
5.7 KiB
Python
138 lines
5.7 KiB
Python
from odoo.tests.common import TransactionCase, HttpCase
|
|
from odoo.exceptions import AccessError
|
|
|
|
class TestLibrarySecurity(TransactionCase):
|
|
|
|
def setUp(self):
|
|
super(TestLibrarySecurity, self).setUp()
|
|
|
|
# Ensure portal user exists
|
|
self.portal_user = self.env['res.users'].search([('login', '=', 'portal_test')], limit=1)
|
|
if not self.portal_user:
|
|
self.portal_user = self.env['res.users'].create({
|
|
'name': 'Portal User',
|
|
'login': 'portal_test',
|
|
'group_ids': [(4, self.env.ref('base.group_portal').id)]
|
|
})
|
|
|
|
self.portal_user2 = self.env['res.users'].create({
|
|
'name': 'Portal User 2',
|
|
'login': 'portal_test2',
|
|
'group_ids': [(4, self.env.ref('base.group_portal').id)]
|
|
})
|
|
|
|
self.library = self.env['education.library'].create({
|
|
'name': 'Main Library Sec',
|
|
'code': 'MLS01'
|
|
})
|
|
|
|
self.company = self.env.company
|
|
self.campus = self.env['education.campus'].create({
|
|
'name': 'Test Campus Sec', 'code': 'TCS01', 'company_id': self.company.id,
|
|
})
|
|
self.level = self.env['education.academic.level'].create({
|
|
'name': 'UG Sec', 'code': 'UGS01', 'company_id': self.company.id,
|
|
})
|
|
self.department = self.env['education.department'].create({
|
|
'name': 'Test Department Sec', 'code': 'TDS01', 'campus_id': self.campus.id,
|
|
})
|
|
self.academic_year = self.env['education.academic.year'].create({
|
|
'name': '2025-2026 Sec', 'code': 'AY2025S', 'start_date': '2025-06-01', 'end_date': '2026-05-31', 'company_id': self.company.id, 'state': 'draft',
|
|
})
|
|
self.academic_term = self.env['education.academic.term'].create({
|
|
'name': 'Sem 1 Sec', 'code': 'SEM1S', 'academic_year_id': self.academic_year.id, 'start_date': '2025-06-01', 'end_date': '2025-09-30', 'sequence': 1, 'company_id': self.company.id,
|
|
})
|
|
self.program = self.env['education.program'].create({
|
|
'name': 'BTech CS Sec', 'code': 'BTECH-CSS', 'level_id': self.level.id, 'department_id': self.department.id, 'duration': 4, 'duration_unit': 'years', 'company_id': self.company.id,
|
|
})
|
|
self.batch = self.env['education.batch'].create({
|
|
'name': 'Batch 2025 Sec', 'code': 'B2025S',
|
|
})
|
|
self.semester = self.env['education.semester'].create({
|
|
'name': 'Semester 1 Sec', 'code': 'SEM1S',
|
|
})
|
|
self.section = self.env['education.section'].create({
|
|
'name': 'Section A Sec', 'code': 'SEC-AS',
|
|
})
|
|
|
|
self.student = self.env['education.student'].create({
|
|
'first_name': 'Portal',
|
|
'last_name': 'Student',
|
|
'admission_number': 'SEC001',
|
|
'portal_user_id': self.portal_user.id,
|
|
'campus_id': self.campus.id,
|
|
'department_id': self.department.id,
|
|
'program_id': self.program.id,
|
|
'level_id': self.level.id,
|
|
'academic_year_id': self.academic_year.id,
|
|
'academic_term_id': self.academic_term.id,
|
|
'batch_id': self.batch.id,
|
|
'semester_id': self.semester.id,
|
|
'section_id': self.section.id,
|
|
'company_id': self.company.id,
|
|
})
|
|
|
|
self.student2 = self.env['education.student'].create({
|
|
'first_name': 'Portal2',
|
|
'last_name': 'Student2',
|
|
'admission_number': 'SEC002',
|
|
'portal_user_id': self.portal_user2.id,
|
|
'campus_id': self.campus.id,
|
|
'department_id': self.department.id,
|
|
'program_id': self.program.id,
|
|
'level_id': self.level.id,
|
|
'academic_year_id': self.academic_year.id,
|
|
'academic_term_id': self.academic_term.id,
|
|
'batch_id': self.batch.id,
|
|
'semester_id': self.semester.id,
|
|
'section_id': self.section.id,
|
|
'company_id': self.company.id,
|
|
})
|
|
|
|
self.member1 = self.env['education.library.member'].create({
|
|
'member_number': 'SM001',
|
|
'student_id': self.student.id,
|
|
'library_id': self.library.id,
|
|
'user_id': self.portal_user.id
|
|
})
|
|
|
|
self.member2 = self.env['education.library.member'].create({
|
|
'member_number': 'SM002',
|
|
'student_id': self.student2.id,
|
|
'library_id': self.library.id,
|
|
'user_id': self.portal_user2.id
|
|
})
|
|
|
|
self.book = self.env['education.library.book'].create({
|
|
'title': 'Security Book',
|
|
'author': 'Auth',
|
|
})
|
|
self.copy = self.env['education.library.book.copy'].create({
|
|
'book_id': self.book.id,
|
|
'library_id': self.library.id,
|
|
'accession_number': 'SEC-001'
|
|
})
|
|
|
|
self.issue1 = self.env['education.library.issue'].create({
|
|
'member_id': self.member1.id,
|
|
'copy_id': self.copy.id,
|
|
'status': 'issued'
|
|
})
|
|
|
|
def test_student_cannot_read_others_issue(self):
|
|
# As portal user 2, try to read issue 1
|
|
with self.assertRaises(AccessError):
|
|
self.issue1.with_user(self.portal_user2).read(['name'])
|
|
|
|
def test_student_can_read_own_issue(self):
|
|
# Should not raise exception
|
|
self.issue1.with_user(self.portal_user).read(['name'])
|
|
|
|
def test_student_cannot_spoof_member(self):
|
|
# Portal user 1 trying to create an issue for Member 2
|
|
with self.assertRaises(AccessError):
|
|
self.env['education.library.issue'].with_user(self.portal_user).create({
|
|
'member_id': self.member2.id,
|
|
'copy_id': self.copy.id
|
|
})
|