@@ -85,3 +85,198 @@ def test_list_teams_permissions(
8585 response = client .get (url , format = "json" , ** make_user_auth_headers (user , token ))
8686
8787 assert response .status_code == status .HTTP_200_OK
88+
89+
90+ @pytest .mark .django_db
91+ def test_team_permissions_wrong_team_general (
92+ make_organization ,
93+ make_team ,
94+ make_alert_group ,
95+ make_alert_receive_channel ,
96+ make_user ,
97+ make_escalation_chain ,
98+ make_schedule ,
99+ make_custom_action ,
100+ make_token_for_organization ,
101+ make_user_auth_headers ,
102+ ):
103+ organization = make_organization ()
104+
105+ user = make_user (organization = organization )
106+ _ , token = make_token_for_organization (organization )
107+
108+ team = make_team (organization )
109+
110+ user .teams .add (team )
111+ user .current_team = team
112+ user .save (update_fields = ["current_team" ])
113+
114+ alert_receive_channel = make_alert_receive_channel (organization )
115+ alert_group = make_alert_group (alert_receive_channel )
116+
117+ # escalation_chain = make_escalation_chain(organization)
118+ # schedule = make_schedule(organization, schedule_class=OnCallScheduleCalendar)
119+ # webhook = make_custom_action(organization)
120+
121+ for endpoint , instance in (
122+ ("alertgroup" , alert_group ),
123+ # todo: implement team filtering for other resources
124+ # ("alert_receive_channel", alert_receive_channel),
125+ # ("escalation_chain", escalation_chain),
126+ # ("schedule", schedule),
127+ # ("custom_button", webhook),
128+ ):
129+ client = APIClient ()
130+ url = reverse (f"api-internal:{ endpoint } , kwargs = {"pk" : instance .public_primary_key })
131+
132+ response = client .get (url , ** make_user_auth_headers (user , token ))
133+
134+ assert response .status_code == status .HTTP_403_FORBIDDEN
135+ assert response .json () == {
136+ "error_code" : "wrong_team" ,
137+ "owner_team" : {"name" : "General" , "id" : None , "email" : None , "avatar_url" : None },
138+ }
139+
140+
141+ @pytest .mark .django_db
142+ def test_team_permissions_wrong_team (
143+ make_organization ,
144+ make_team ,
145+ make_alert_group ,
146+ make_alert_receive_channel ,
147+ make_user ,
148+ make_escalation_chain ,
149+ make_schedule ,
150+ make_custom_action ,
151+ make_token_for_organization ,
152+ make_user_auth_headers ,
153+ ):
154+ organization = make_organization ()
155+
156+ user = make_user (organization = organization )
157+ _ , token = make_token_for_organization (organization )
158+
159+ team = make_team (organization )
160+ user .teams .add (team )
161+
162+ alert_receive_channel = make_alert_receive_channel (organization , team = team )
163+ alert_group = make_alert_group (alert_receive_channel )
164+
165+ # escalation_chain = make_escalation_chain(organization, team=team)
166+ # schedule = make_schedule(organization, schedule_class=OnCallScheduleCalendar, team=team)
167+ # webhook = make_custom_action(organization, team=team)
168+
169+ for endpoint , instance in (
170+ ("alertgroup" , alert_group ),
171+ # todo: implement team filtering for other resources
172+ # ("alert_receive_channel", alert_receive_channel),
173+ # ("escalation_chain", escalation_chain),
174+ # ("schedule", schedule),
175+ # ("custom_button", webhook),
176+ ):
177+ client = APIClient ()
178+ url = reverse (f"api-internal:{ endpoint } , kwargs = {"pk" : instance .public_primary_key })
179+
180+ response = client .get (url , ** make_user_auth_headers (user , token ))
181+
182+ assert response .status_code == status .HTTP_403_FORBIDDEN
183+ assert response .json () == {
184+ "error_code" : "wrong_team" ,
185+ "owner_team" : {
186+ "name" : team .name ,
187+ "id" : team .public_primary_key ,
188+ "email" : team .email ,
189+ "avatar_url" : team .avatar_url ,
190+ },
191+ }
192+
193+
194+ @pytest .mark .django_db
195+ def test_team_permissions_not_in_team (
196+ make_organization ,
197+ make_team ,
198+ make_alert_group ,
199+ make_alert_receive_channel ,
200+ make_user ,
201+ make_escalation_chain ,
202+ make_schedule ,
203+ make_custom_action ,
204+ make_token_for_organization ,
205+ make_user_auth_headers ,
206+ ):
207+ organization = make_organization ()
208+
209+ user = make_user (organization = organization )
210+ _ , token = make_token_for_organization (organization )
211+
212+ team = make_team (organization )
213+
214+ alert_receive_channel = make_alert_receive_channel (organization , team = team )
215+ alert_group = make_alert_group (alert_receive_channel )
216+
217+ # escalation_chain = make_escalation_chain(organization, team=team)
218+ # schedule = make_schedule(organization, schedule_class=OnCallScheduleCalendar, team=team)
219+ # webhook = make_custom_action(organization, team=team)
220+
221+ for endpoint , instance in (
222+ ("alertgroup" , alert_group ),
223+ # todo: implement team filtering for other resources
224+ # ("alert_receive_channel", alert_receive_channel),
225+ # ("escalation_chain", escalation_chain),
226+ # ("schedule", schedule),
227+ # ("custom_button", webhook),
228+ ):
229+ client = APIClient ()
230+ url = reverse (f"api-internal:{ endpoint } , kwargs = {"pk" : instance .public_primary_key })
231+
232+ response = client .get (url , ** make_user_auth_headers (user , token ))
233+
234+ assert response .status_code == status .HTTP_403_FORBIDDEN
235+ assert response .json () == {"error_code" : "wrong_team" }
236+
237+
238+ @pytest .mark .django_db
239+ def test_team_permissions_right_team (
240+ make_organization ,
241+ make_team ,
242+ make_alert_group ,
243+ make_alert_receive_channel ,
244+ make_user ,
245+ make_escalation_chain ,
246+ make_schedule ,
247+ make_custom_action ,
248+ make_token_for_organization ,
249+ make_user_auth_headers ,
250+ ):
251+ organization = make_organization ()
252+
253+ user = make_user (organization = organization )
254+ _ , token = make_token_for_organization (organization )
255+
256+ team = make_team (organization )
257+
258+ user .teams .add (team )
259+ user .current_team = team
260+ user .save (update_fields = ["current_team" ])
261+
262+ alert_receive_channel = make_alert_receive_channel (organization , team = team )
263+ alert_group = make_alert_group (alert_receive_channel )
264+
265+ # escalation_chain = make_escalation_chain(organization, team=team)
266+ # schedule = make_schedule(organization, schedule_class=OnCallScheduleCalendar, team=team)
267+ # webhook = make_custom_action(organization, team=team)
268+
269+ for endpoint , instance in (
270+ ("alertgroup" , alert_group ),
271+ # todo: implement team filtering for other resources
272+ # ("alert_receive_channel", alert_receive_channel),
273+ # ("escalation_chain", escalation_chain),
274+ # ("schedule", schedule),
275+ # ("custom_button", webhook),
276+ ):
277+ client = APIClient ()
278+ url = reverse (f"api-internal:{ endpoint } , kwargs = {"pk" : instance .public_primary_key })
279+
280+ response = client .get (url , ** make_user_auth_headers (user , token ))
281+
282+ assert response .status_code == status .HTTP_200_OK
0 commit comments