Add test: 403 Forbidden (Reviewer can NOT view organizers

Author: Phillipe-Bojorquez

src/apps/applets/tests/fixtures/applets.py

@@ -333,11 +333,11 @@ async def applet_one_lucy_reviewer(
     mocker: MockerFixture,
     tom: User,
     lucy: User,
-    tom_applet_subject: Subject,
+    tom_applet_one_subject: Subject,
 ) -> AppletFull:
     mocker.patch(
         "apps.workspaces.service.user_applet_access.UserAppletAccessService._get_default_role_meta",
-        return_value={"subjects": [str(tom_applet_subject.id)]},
+        return_value={"subjects": [str(tom_applet_one_subject.id)]},
     )
     await UserAppletAccessService(session, tom.id, applet_one.id).add_role(lucy.id, Role.REVIEWER)
     return applet_one

src/apps/workspaces/tests/test_workspaces.py

@@ -1515,8 +1515,8 @@ async def test_coordinator_can_NOT_view_organizers(
     async def test_editor_can_NOT_view_organizers(
         self,
         client,
-        lucy,
         tom,
+        lucy,
         applet_one_lucy_editor: AppletFull,
     ):
         client.login(applet_one_lucy_editor)
@@ -1525,3 +1525,16 @@ async def test_editor_can_NOT_view_organizers(
             dict(ordering="+email"),
         )
         assert response.status_code == http.HTTPStatus.UNAUTHORIZED
+
+    async def test_reviewer_can_NOT_view_organizers(
+        self,
+        client,
+        tom,
+        applet_one_lucy_reviewer: AppletFull,
+    ):
+        client.login(applet_one_lucy_reviewer)
+        response = await client.get(
+            self.workspace_managers_url.format(owner_id=tom.id),
+            dict(ordering="+email"),
+        )
+        assert response.status_code == http.HTTPStatus.UNAUTHORIZED