From 3bf2179e7e97808913c02d1b7f3bd8a7915cf579 Mon Sep 17 00:00:00 2001
From: egodoy-metalab <elder.gordy@metalab.com>
Date: Mon, 23 Jun 2025 12:40:05 -0600
Subject: [PATCH 1/2] Update test_workspaces.py

Adding new tests:
1. test_applet_owner_can_view_organizers
2. test_coordinator_can_NOT_view_organizers
3. test_editor_can_NOT_view_organizers
---
 src/apps/workspaces/tests/test_workspaces.py | 42 ++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/src/apps/workspaces/tests/test_workspaces.py b/src/apps/workspaces/tests/test_workspaces.py
index 8217df504c79..ab065d951b41 100644
--- a/src/apps/workspaces/tests/test_workspaces.py
+++ b/src/apps/workspaces/tests/test_workspaces.py
@@ -1483,3 +1483,45 @@ async def test_user_last_activity_workspace_respondent_retrieve(
         assert date_now.year == date_answer.year
         assert date_now.hour == date_answer.hour
         assert date_now.minute == date_answer.minute
+
+    async def test_applet_owner_can_view_organizers(self, client, tom):
+        client.login(tom)
+        response = await client.get(
+            self.workspace_managers_url.format(owner_id=tom.id),
+            dict(ordering="+email"),
+        )
+
+        assert response.status_code == 200
+        data = response.json()
+        assert data["count"] == 1  # lucy
+        assert data["count"] == len(data["result"])
+        tom_result = data["result"][0]
+        assert tom_result["id"] == str(tom.id)
+        assert tom_result["email"] == tom.email_encrypted
+
+    async def test_coordinator_can_NOT_view_organizers(
+        self,
+        client,
+        applet_one_lucy_coordinator: AppletFull,
+        tom,
+    ):
+        client.login(applet_one_lucy_coordinator)
+        response = await client.get(
+            self.workspace_managers_url.format(owner_id=tom.id),
+            dict(ordering="+email"),
+        )
+        assert response.status_code == http.HTTPStatus.UNAUTHORIZED
+
+    async def test_editor_can_NOT_view_organizers(
+        self,
+        client,
+        lucy,
+        tom,
+        applet_one_lucy_editor: AppletFull,
+    ):
+        client.login(applet_one_lucy_editor)
+        response = await client.get(
+            self.workspace_managers_url.format(owner_id=tom.id),
+            dict(ordering="+email"),
+        )
+        assert response.status_code == http.HTTPStatus.UNAUTHORIZED

From cf7c8b0ceb81caf3d4051bc56cdf4a542167c27f Mon Sep 17 00:00:00 2001
From: Phillipe Bojorquez <phillipe.bojorquez@gmail.com>
Date: Thu, 31 Jul 2025 16:05:02 -0400
Subject: [PATCH 2/2] Add test: 403 Forbidden (Reviewer can NOT view organizers

---
 src/apps/applets/tests/fixtures/applets.py   |  4 ++--
 src/apps/workspaces/tests/test_workspaces.py | 15 ++++++++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/apps/applets/tests/fixtures/applets.py b/src/apps/applets/tests/fixtures/applets.py
index 284bbf16b9a3..09ef4feac595 100644
--- a/src/apps/applets/tests/fixtures/applets.py
+++ b/src/apps/applets/tests/fixtures/applets.py
@@ -333,11 +333,11 @@ async def applet_one_lucy_reviewer(
     mocker: MockerFixture,
     tom: User,
     lucy: User,
-    tom_applet_subject: Subject,
+    tom_applet_one_subject: Subject,
 ) -> AppletFull:
     mocker.patch(
         "apps.workspaces.service.user_applet_access.UserAppletAccessService._get_default_role_meta",
-        return_value={"subjects": [str(tom_applet_subject.id)]},
+        return_value={"subjects": [str(tom_applet_one_subject.id)]},
     )
     await UserAppletAccessService(session, tom.id, applet_one.id).add_role(lucy.id, Role.REVIEWER)
     return applet_one
diff --git a/src/apps/workspaces/tests/test_workspaces.py b/src/apps/workspaces/tests/test_workspaces.py
index ab065d951b41..ca6aff922e30 100644
--- a/src/apps/workspaces/tests/test_workspaces.py
+++ b/src/apps/workspaces/tests/test_workspaces.py
@@ -1515,8 +1515,8 @@ async def test_coordinator_can_NOT_view_organizers(
     async def test_editor_can_NOT_view_organizers(
         self,
         client,
-        lucy,
         tom,
+        lucy,
         applet_one_lucy_editor: AppletFull,
     ):
         client.login(applet_one_lucy_editor)
@@ -1525,3 +1525,16 @@ async def test_editor_can_NOT_view_organizers(
             dict(ordering="+email"),
         )
         assert response.status_code == http.HTTPStatus.UNAUTHORIZED
+
+    async def test_reviewer_can_NOT_view_organizers(
+        self,
+        client,
+        tom,
+        applet_one_lucy_reviewer: AppletFull,
+    ):
+        client.login(applet_one_lucy_reviewer)
+        response = await client.get(
+            self.workspace_managers_url.format(owner_id=tom.id),
+            dict(ordering="+email"),
+        )
+        assert response.status_code == http.HTTPStatus.UNAUTHORIZED