From 12e2f49d45849f6ddd39cac14bce03c3cc19ceae Mon Sep 17 00:00:00 2001 From: Sander Roosendaal Date: Thu, 13 Jun 2024 08:46:13 +0200 Subject: [PATCH] fix rojabo permissions --- rowers/tests/test_imports.py | 40 +++++++++++++++++++++++++- rowers/tests/testdata/testdata.tcx.gz | Bin 4000 -> 4000 bytes rowers/views/importviews.py | 6 ++-- 3 files changed, 42 insertions(+), 4 deletions(-) diff --git a/rowers/tests/test_imports.py b/rowers/tests/test_imports.py index 78818eb5..b5735396 100644 --- a/rowers/tests/test_imports.py +++ b/rowers/tests/test_imports.py @@ -49,13 +49,31 @@ class RojaboObjects(DjangoTestCase): self.r.defaulttimezone = 'Europe/Prague' self.r.rowerplan = 'plan' self.r.save() - self.c.login(username='john',password='koeinsloot') + + self.u2 = User.objects.create_user('john2', + 'sander@ds2.ds', + 'stierinsloot') + + self.u2.first_name = 'Sander' + self.u2.last_name = 'John' + self.u2.save() + self.r2 = Rower.objects.create(user=self.u2,gdproptin=True, ftpset=True,surveydone=True, + gdproptindate=timezone.now() + ) + + self.r2.rojabo_token = '12' + self.r2.rojabo_refreshtoken = 'ab' + self.r2.rojabo_tokenexpirydate = arrow.get(datetime.datetime.now()+datetime.timedelta(days=1)).datetime + self.r2.defaulttimezone = 'Europe/Prague' + self.r2.rowerplan = 'pro' + self.r2.save() self.nu = datetime.datetime.now() @patch('rowers.rojabo_stuff.requests.get', side_effect=mocked_requests) @patch('rowers.rojabo_stuff.requests.post', side_effect=mocked_requests) def test_rojabo_import(self, mock_get, mock_post): + self.c.login(username='john',password='koeinsloot') url = '/rowers/session/rojaboimport/' response = self.c.get(url) self.assertEqual(response.status_code, 200) @@ -79,6 +97,26 @@ class RojaboObjects(DjangoTestCase): self.assertEqual(len(ps.steps['steps']),20) + @patch('rowers.rojabo_stuff.requests.get', side_effect=mocked_requests) + @patch('rowers.rojabo_stuff.requests.post', side_effect=mocked_requests) + def test_rojabo_import_denied(self, mock_get, mock_post): + self.c.login(username='john2',password='stierinsloot') + url = '/rowers/session/rojaboimport/' + response = self.c.get(url) + self.assertEqual(response.status_code, 302) + + form_data = { + 'csrfmiddlewaretoken': ['xalRrf8y7P2Hhobges9QC4aKCWg4l06gexDc8g2DeuVExgadfk4YhV8oSE1Yu43U'], + 'sessions': ['Import selected sessions'], + 'sessionid': ['862172'] + } + + + response = self.c.post(url,form_data) + self.assertEqual(response.status_code,302) + + + @pytest.mark.django_db @override_settings(TESTING=True) class GarminObjects(DjangoTestCase): diff --git a/rowers/tests/testdata/testdata.tcx.gz b/rowers/tests/testdata/testdata.tcx.gz index 9aad9188b1849b0620a9931fce061b7b71d791d1..3c0a65ca9ac545281fb7f0d3324d570c2c271e85 100644 GIT binary patch delta 3644 zcmV-C4#V-FAD|xxABzYG%#mu52PJ=sf^35^U}u8Z$mBMt$Q8L~q?VvAFZuUFcH6RS ztB^ctieMG!gQ2djt?R2tzMV&3zd1iUc-3ER*B6_w9-@JV2VWmQIC^%~tvBn<>398R z=&!!-hVHj++aIKzH`}isz8Hqf!`15b>(}PAyE|A>sRaHk00I){U+bwjT5}tu0J@#Yc>~Grz--$)vr$;Ki!?;i}hwZ zbeoet9kpE_?$7)9;-njPzxGZyaG*cx6`42N=YM|S-@DLy0MgIMAK!2IKJ00Kask z=H~oGdI$c(ySUr!!y`X>CB)eA*JO9VJqg^TK>ia7dlI)J_}~Gt0u2FqleGdW5;5GJ zt%!R}@@~azxW|(6&afDh@d6=6&4hbh@*cP%?%o6sPNUB|SJI4QS`K$#4|f6M16qx| zdoeN-?v;)671?pZCW4I`?mME5)%rNmj#iJ6_HQooFE5Pc*YgABCzT`HFmamJK6XO_Y{=(G2@WejM zC`xOC@#$4m+4B*MZyMg*=XpVsL|$djGeFUZ&4Nbznq*$ANzWEYLmqK9x_yh%j+1xB z3kFS;mI;g6^GhOMkv*R+G`6aFo*7M?33+Vu{O#m9=iV|PX*@aUMJbteZC&%*PeNV{ zFa(v%3l)vnH1Yw{lluf7enT~Td^wL-j=PXw4urTB;>70Lw(ff_Lf{xnGemXn}obK6wztC zx0YSeeEZNw`zgpX>{?=JbbD)EQQbbY`1~Z~$vB3nYJw+a$uFs*f6`S%UW^rH)jaQt z*3vGDyi`O!n8aO`foaQDR0=eipMtzalQd38s+Olkd)>-{s;I?QM4pXzx+txUv1Crp zlE~LnW5YT3)_FwDXfFt}k@;rNkCTsv0>q#qADeDJ|A>uH?v|p8(h5VYH24SfA5X3E@C56mVEQ!O+elz*ap2-WnGJFV)VBi|Y1EB45*J9}OS|O?=)lWfiTW_ANd?1^JwN8!%}4 z-a1P~b8nYKz9M^`tRaW2n&*XPlY7gpetwj^H)xSmqrIb|_WXj#JF19$?wmlZ>2L2m z7oF#qM7|>3K51(lQMGEB3*4f#3m`8BKvZ4MUE~&}o&S^j1|U_&$#d?0s`B3YWC_NW zfjN8fV!U;ziPia}8x)My2`UUz-mv)I(k{*V3xiwD3~2 zettY`hR^e0biul79O|lW+$fLyd0VytgCdZD7P0SFX-33)b1x*nJz6kWA!N#tvq=SfTujG7G05V2@x1}$iw_Z5*3 zMv}~HDlH;Vlli&F>g15oSSD3wMnrDp=N_?1&cQLAoA5)1`d|bJNrgVChCCCazDfNk`rOWxkag&t zEo$3Io9ic&I|&(K8>z1hJ-d3)Cp*ms0;@tFeNi=UNdrDsgr3t}PoSFX5yEWH*EZnS zB=ycPAgShh#Iof!OG3{Tp^sU^k2qGy9n*EI_%7G1b>Q3F0zgx(pjq|3-<;MuHk)8_hd^ua_?R^Kq% zqAr~_*H40;&_p6oC1^3tXHB!_!yiX)O<-m94YQj~)3lbQGmhRHZ-rGFKHIYE+)%5z zn*x2#uzwWP)z`C>ZKpy_&6@;08v%?usdr&E13tC{tx@#OSk$d$i0ot0#%a{-`bp47 zLlLb`!w+S{H{85=Q=qq$`)BFAc^qR?^X5O`TQMNY!Yhj~n|OU~$=DSIZEe!nkYZG! zCu(#3{Lu@Ts9d-hEmP6RUGw2jgPu)vNILYEXEL+AS##u$qu;em^eQ#aift~P`8#rV zEfdk}=6WZyNziI(nIq`Ku4N+Vmb^jhr5Sf~lZ*=?e@}rP(J+fsNxeYX3uW^Kdf%^OF*E3zh4 zygpe3t;l)-QtxtCji^KKsHkz*x@t^=K4hu)x&hzwY^1&o_@n3m}Ht8h#7f zPJ`YWe}{;wt{M_;^XARpk;~qACaVhCI&iZ|)o5zoDEeflS%CqqR{QNAHY*&!G+Y^LOOhn9vic3a^}vv#GRgSvsTWg$!$b_|8F_ z>lc7t43SpN^UyMK=U#Xfa?3XhGX4&?DuBDoUy6vLzVM zg0_>Om)uZ=bW(4nXygu>nl}mhU|2Bdq+VRnRE?(QO@f}1aYxG53f{Tq$ep`OC+3!k zf1q8{)_Xsjxt?0kb`*UsvSv_)Z+!60u3rH9Xe3#8I;oF-Hg-KVHE#?(lM!om;hO-V z+4T!RFS+mvbm*}t`n*(78}KJU9}F<+`r(J1ygw84)Vz6P=<`a}fI)|z<808k_3Ovc zvk5}F$X$9-N^1DI6GcNm0eWXV+o*Ese*}jmT{??GFBPGWc}-i;NxjFS1HNx17*n7Z zGR|U9W$A=aw9@uo=v&R*IC{y|H$jz=8)DH)+j|Z8t(VR?`jFSO)kW?i6kY6WQ5t?N zSvmr{m8=21%8?sUX5-R<);Dhy{ca^|-8y%X$_8zr&GnO@_qqB;iJtvzR<~?(fBh)> zyplB|sl0j7`l8i0)cWR4f}VGan5&GtD6y?>IdgAbM(=Xrl@h&+MWwzqN}UFM%!OAv zyFLbJ&C_P?%}eNaD_JWecQIn?jJ*K#)})zUwEzkMv>v&4MenCV|90!U4M(fT-R1R% zA1{V}d;Hni@Z}F@{dvC`4nE&)fBO8O8xG)&|K0sgos+)n;j`1>%cIr)fCu|Cz59*% z^Yy3o{`;fvt`f(KtGE09*rm7U>f-gb+dS{i&UQ~LeOzx&pLau-&fD$Zu0-YiaYx_0 z99~>p-FQvDxx74EpL9d|>DMpD^|?PeS^DnVm+Q0V*FX1{^ggCTZ#c8Ne3+`~QztH@?_E`Q2kWey~Hm-lXU7T|(JkeV?AjZ|Ty< O5B>+x1_i{#fB^uDu7+O# delta 3644 zcmV-C4#V-FAD|xxABzYGJ;7;_2PJ>9f^35^U}u8Z$mBMtNFBLnq?XWKUh?mU?6zgu zRv~`U6u~Oc2SZ(5Th~{Qd^?Z6d2?}o@M^i)t}fS)9-@JV2j3h&IC{S6R_oRJ?EB@q zUv7Tr`tJ8`yF5rcueXmLzUcd_!^PtD>(}P2+gz;H=H&8Xk-prXyjWgz+r@wFhc8~y z!~H1^yEmV4mTyn`)vHzi=Z|mtC5!q2{Fz zvhU9GVb7K)m+RB*v9Lc{e6scZ0Y9wvZ_v|a`mx(|pZQ)s+W3C&cldvf5yR2q`qTRz zzD=Umoh|>dOn3iF*Dt@jy4by%{hwFqmt1dty#8+4_1mA9o2RSw%YOOq{>G0;r}?!z zf4MwHn=Z2d^ZgYTw_M`J*H61QtBaQx|EC)ecgqdja)}#XKVI)%)&9@p-CMCtWUsf} ze2}Nh^ni~E^JCoqeS?4EW_5O!Zf)7WxI8_6+O1!9=ZWG6TW{{&o&5KMyWefOx?HXM zo160&=^gltcX7Adhev+&N{F$;ugUI!dlI-wf&3>F_9Sjc@WBIyTb}Q3hwIU6`^jaW z|NPr$&jh!Q;UAwdo%3H^-zTw&M~nSmA768kF8cA$yZsjPi*S>t0u2FaleGdW5;okO zt%!R}@@~azxW|(6&M+I3@d6=6O@w=0@*cP%?%o6sPNUB|SJI4Qnh$qh4|f6M16qx| zdoeN*?v;)671?pZCW4I`?mME5)%rNml=_d6_HQooFE5Pc*YgAR79SQ zWfazsFYLREGa^qFk#`22&WVH0mz?J^zNXQh#jpdfndixtC2wa$zM_Z?2Lk|JG~@+JM(6E) z{Px_ex*_sOeyu}Q8Wu?`>BE~9`HFmamJK6XO_Y{=(G2@Wek6bL&VW^t4=@>-uWg>M zC`xOC@#$4m+4B*MZyMgz=XpVsL|$djGeFUZ&5TC-nq*$ANzWEYLmqK5x_yh%4wHAr z3kFS;mI;g6^K&9!kv*R+G`6aFo*7M?2zhMt{O#m9=iV|PX*@aUMJbteZC&%*k3wDy zFa(v%3l)vnH1YxClluf7e@7wDhAoO}o)279!}Cq%M{?=JbbD)EQQbbY`1~m3$vB3nYJw+a$;6s;I?QM4pXzx+txUv1Crp zoXFQxW5YT3)_FwDXfFtpk@;rN50j6E0>q#qADeDJ{fLcF?v|p8(h5VYH3FyfA5X3E@C56mVEQ!jX>Te*ap2-WnGJF|I ze3SWM@?tEZs=7)-*}A&c19Kem!4RUVbArUOH8#HK_G6GoFcFD0-dhLQa&MV)VBi|Y1sB45*J9}OS|O?=)lWfiTW_ANd?2Kk(O8!%}4 z-a1P~b8qKFz9M^`tRaW2n&*WklY7gpetwX=H)xSmqrIb|_WX>2L2m z7oF$lM7|>3K51(lQMGEB3*4f#GaxSpKvZ4MUE~&}o&J;i1|U_2$#d?0s`B3YWC_NW zfjN2dV!U;ziPia}8x)My3C_r#uP8omgR#h{$;t8QZLt#}Uz-mv)I(k{*V3xiwD3~2 zetu3eUz3I>Y`hR^e0biul79PHlW+$fLyT_Uytf17ZEg%0SFX-3VAk2x*nJz6kWA!PULHv=SfTujG7G05V2@x2F+-m_Z5*3 zMv}~HDlH;VlliH~>g15oSSD3wMnrDpryj9M&cQLAoFcP3b3O_UY^%7$s@ljI07CX+#rt>5(^`d|bJNrgVChCC6YzDfNc`rOWxkag&t zEo$3Io9joDI|&(K8L6)fJ-d3)Cp*ms0;@tFeNi=UP6Iwxgr3t}PoSFX5yE89*EZnS zB=ycPAgShh#Iof!b3)G*p^sU^k2Rs%j&gx(pjq|3-<;K{6U)8_hN^ua_?R^Kq% zqAr~_*N=jp&_p6oC1^2CXHB!_!yiU(O<-m94YQj})3lbQGmPFFZ-rGFKHIYE+)%5z z8v}jLuzwWP)z`C>ZKpy_%^L+h8v%?usdr&A13tC{twHq8Sk$d$i0ot0#%a{-`ccqF zLlLb`!w+S{H{85=W1zQ``)BFAc^qR?^QJ%GTQMNY!Yhj~nRtC|$=DSIZEe!nkYZG! zCu(#3^wA5Ls9d-hEmP6RUGw3OgPu)vNILYECo;3VS##tLqu;em^eQ#aift~P={s_F zEfdk}=6WZSNziI(nFHv2DW^Kdf%^OC)E3zh4 zygpe3t;l)?QtxtCji^KKsHkz*x@wGrK4hu)x&hzwWTd_g_=D&fO%T?_>m}Ht8h#7f zj)UGBe}{;wt{M_;^X5(8k;~qACaVhCI&hOo)o5zoAo^sdS%P;oM@>*&!G+Y(|6?Bn9vic3a^}vlc}_ASvrI0g$!$b_|8F_ z>t}#o43SpN^UyMKr(Sp!a?3XhGXC&?DuBDoUy6vLzVM zg0`cem)uZ=bW(4nXygu>nl}piU|2Bdq+VRnRE?(Qje?$%aYxG53f{Tq$ep@NC+3!k zf1q8{)_Xshxt?0kb`X6ovSv_)Z+!60uAc$=Xe3#8I;oF-GIl*RHE#$#lM!om;hO-V z+4VC(FS+mvbm*}t`n*(78}LU!9}F<+`r(J1ygw22)Vz5^=<`a}fI)|z<7Cjc_3MYx zvk5}F$X$9-N^1DI6GcNm0(xgW+o*Ese*}jmT{^QuFBPGWc}-i;NxjFS1HNx17-OIp zGR|U9W$A=aw9@uo=v&R*FnY<=H$jz=8)DH)+j|Z8t(VR)`jFSO)kW?i6kY6WRvLaS zSvmr{m8=21%8?sUCgak9);Dhu{ca^|-8y%X$_8zr&Gn<8_qqB;iJtvrR<~?(fBhi( zyplB|sl0j7`l8i0)cWR)f}VGan5&GtD6y?>IdN}ZM(=Xrl@h&+MWwzqN*xD%%!OAv zyFLbJ&C@3C%}eNaD_JWecQIn?j6DPN)})zUwEzkMv>v&4MeoN#|90!U4M&S7-PQGn zpDz35_V|nQ{_7vlmlw-*fAHmQf76!-U4H;?{2wROb*Cqxi}1x+|Mk&gf53zNncn@z z{Q3IRYXAMw_nXA=a`SfIpStw+Y%X7KyY*>ze!hEJ>EmjBcG~q_I&ZgsyAqZ6#~pq9 zvVU>8x$&BOdv$fbI_diK)30BQ>vMl{vh>||FIVTM*FX2y^ggCTZ#`|UrcxA>=*7r!slodJ9Wu>b#PapQ~qlixk2;|Dv`t95z~-zSvI%@65m{GKj- O{NR6FNa)eTfB^smQH7BJ diff --git a/rowers/views/importviews.py b/rowers/views/importviews.py index 95019ab1..f5270e17 100644 --- a/rowers/views/importviews.py +++ b/rowers/views/importviews.py @@ -649,10 +649,10 @@ def rower_process_testcallback(request): # pragma: no cover # The page where you select which Strava workout to import @login_required() -@user_passes_test(ispromember, login_url="/rowers/paidplans/", - message="This functionality requires a Pro plan or higher", +@user_passes_test(isplanmember, login_url="/rowers/paidplans/", + message="This functionality requires a Self-coach plan or higher", redirect_field_name=None) -@permission_required('rower.is_planmember', fn=get_user_by_userid, raise_exception=True) +@permission_required('plannedsession.add_session', fn=get_user_by_userid, raise_exception=True) def workout_rojaboimport_view(request, message="", userid=0): # pragma: no cover r = getrequestrower(request, userid=userid) if r.user != request.user: