Get team invite confirmation working and fully tested

test/test_api_security.py

@@ -8,7 +8,7 @@ from app import app
 from initdb import setup_database_for_testing, finished_database_for_testing
 from endpoints.api import api_bp, api
 
-from endpoints.api.team import TeamMember, TeamMemberList, OrganizationTeam
+from endpoints.api.team import TeamMember, TeamMemberList, OrganizationTeam, TeamMemberInvite
 from endpoints.api.tag import RepositoryTagImages, RepositoryTag
 from endpoints.api.search import FindRepositories, EntitySearch
 from endpoints.api.image import RepositoryImageChanges, RepositoryImage, RepositoryImageList
@@ -3424,6 +3424,36 @@ class TestSuperUserLogs(ApiTestCase):
     self._run_test('GET', 200, 'devtable', None)
 
 
+class TestTeamMemberInvite(ApiTestCase):
+  def setUp(self):
+    ApiTestCase.setUp(self)
+    self._set_url(TeamMemberInvite, code='foobarbaz')
+
+  def test_put_anonymous(self):
+    self._run_test('PUT', 401, None, None)
+
+  def test_put_freshuser(self):
+    self._run_test('PUT', 404, 'freshuser', None)
+
+  def test_put_reader(self):
+    self._run_test('PUT', 404, 'reader', None)
+
+  def test_put_devtable(self):
+    self._run_test('PUT', 404, 'devtable', None)
+
+  def test_delete_anonymous(self):
+    self._run_test('DELETE', 401, None, None)
+
+  def test_delete_freshuser(self):
+    self._run_test('DELETE', 404, 'freshuser', None)
+
+  def test_delete_reader(self):
+    self._run_test('DELETE', 404, 'reader', None)
+
+  def test_delete_devtable(self):
+    self._run_test('DELETE', 404, 'devtable', None)
+
+
 class TestSuperUserList(ApiTestCase):
   def setUp(self):
     ApiTestCase.setUp(self)
@@ -3442,7 +3472,6 @@ class TestSuperUserList(ApiTestCase):
     self._run_test('GET', 200, 'devtable', None)
 
 
-
 class TestSuperUserManagement(ApiTestCase):
   def setUp(self):
     ApiTestCase.setUp(self)

test/test_api_usage.py

@@ -11,7 +11,7 @@ from app import app
 from initdb import setup_database_for_testing, finished_database_for_testing
 from data import model, database
 
-from endpoints.api.team import TeamMember, TeamMemberList, OrganizationTeam
+from endpoints.api.team import TeamMember, TeamMemberList, TeamMemberInvite, OrganizationTeam
 from endpoints.api.tag import RepositoryTagImages, RepositoryTag
 from endpoints.api.search import FindRepositories, EntitySearch
 from endpoints.api.image import RepositoryImage, RepositoryImageList
@@ -734,16 +734,50 @@ class TestGetOrganizationTeamMembers(ApiTestCase):
                                 params=dict(orgname=ORGANIZATION,
                                             teamname='readers'))
 
-    assert READ_ACCESS_USER in json['members']
+    self.assertEquals(READ_ACCESS_USER, json['members'][1]['name'])
 
 
 class TestUpdateOrganizationTeamMember(ApiTestCase):
-  def test_addmember(self):
+  def assertInTeam(self, data, membername):
+    for memberData in data['members']:
+      if memberData['name'] == membername:
+        return
+
+    self.fail(membername + ' not found in team: ' + json.dumps(data))
+
+  def test_addmember_alreadyteammember(self):
     self.login(ADMIN_ACCESS_USER)
 
+    membername = READ_ACCESS_USER
+    self.putResponse(TeamMember,
+                     params=dict(orgname=ORGANIZATION, teamname='readers',
+                                 membername=membername),
+                     expected_code=400)
+     
+
+  def test_addmember_orgmember(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    membername = READ_ACCESS_USER
+    self.putJsonResponse(TeamMember,
+                         params=dict(orgname=ORGANIZATION, teamname='owners',
+                                     membername=membername))
+     
+    # Verify the user was added to the team.
+    json = self.getJsonResponse(TeamMemberList,
+                                params=dict(orgname=ORGANIZATION,
+                                            teamname='owners'))
+
+    self.assertInTeam(json, membername)
+
+
+  def test_addmember_robot(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    membername = ORGANIZATION + '+coolrobot'
     self.putJsonResponse(TeamMember,
                          params=dict(orgname=ORGANIZATION, teamname='readers',
-                                     membername=NO_ACCESS_USER))
+                                     membername=membername))
      
 
     # Verify the user was added to the team.
@@ -751,7 +785,152 @@ class TestUpdateOrganizationTeamMember(ApiTestCase):
                                 params=dict(orgname=ORGANIZATION,
                                             teamname='readers'))
 
-    assert NO_ACCESS_USER in json['members']
+    self.assertInTeam(json, membername)
+
+
+  def test_addmember_invalidrobot(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    membername = 'freshuser+anotherrobot'
+    self.putResponse(TeamMember,
+                     params=dict(orgname=ORGANIZATION, teamname='readers',
+                                 membername=membername),
+                     expected_code=400)
+  
+   
+  def test_addmember_nonorgmember(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    membername = NO_ACCESS_USER
+    response = self.putJsonResponse(TeamMember,
+                                    params=dict(orgname=ORGANIZATION, teamname='owners',
+                                                membername=membername))
+     
+
+    self.assertEquals(True, response['invited'])
+
+    # Make sure the user is not (yet) part of the team.
+    json = self.getJsonResponse(TeamMemberList,
+                                params=dict(orgname=ORGANIZATION,
+                                            teamname='readers'))
+
+    for member in json['members']:
+      self.assertNotEqual(membername, member['name'])
+
+
+class TestAcceptTeamMemberInvite(ApiTestCase):
+  def assertInTeam(self, data, membername):
+    for memberData in data['members']:
+      if memberData['name'] == membername:
+        return
+
+    self.fail(membername + ' not found in team: ' + json.dumps(data))
+
+  def test_accept_wronguser(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    # Create the invite.
+    membername = NO_ACCESS_USER
+    response = self.putJsonResponse(TeamMember,
+                                    params=dict(orgname=ORGANIZATION, teamname='owners',
+                                                membername=membername))
+    
+    self.assertEquals(True, response['invited'])
+
+    # Try to accept the invite.
+    user = model.get_user(membername)
+    invites = list(model.lookup_team_invites(user))
+    self.assertEquals(1, len(invites))
+
+    self.putResponse(TeamMemberInvite,
+                     params=dict(code=invites[0].invite_token),
+                     expected_code=404)
+
+
+  def test_accept(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    # Create the invite.
+    membername = NO_ACCESS_USER
+    response = self.putJsonResponse(TeamMember,
+                                    params=dict(orgname=ORGANIZATION, teamname='owners',
+                                                membername=membername))
+    
+    self.assertEquals(True, response['invited'])
+
+    # Login as the user.
+    self.login(membername)
+
+    # Accept the invite.
+    user = model.get_user(membername)
+    invites = list(model.lookup_team_invites(user))
+    self.assertEquals(1, len(invites))
+
+    self.putJsonResponse(TeamMemberInvite,
+                         params=dict(code=invites[0].invite_token))
+
+    # Verify the user is now on the team.
+    json = self.getJsonResponse(TeamMemberList,
+                                params=dict(orgname=ORGANIZATION,
+                                            teamname='owners'))
+
+    self.assertInTeam(json, membername)
+    
+    # Verify the accept now fails.
+    self.putResponse(TeamMemberInvite,
+                     params=dict(code=invites[0].invite_token),
+                     expected_code=404)
+
+
+
+class TestDeclineTeamMemberInvite(ApiTestCase):
+  def test_decline_wronguser(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    # Create the invite.
+    membername = NO_ACCESS_USER
+    response = self.putJsonResponse(TeamMember,
+                                    params=dict(orgname=ORGANIZATION, teamname='owners',
+                                                membername=membername))
+    
+    self.assertEquals(True, response['invited'])
+
+    # Try to decline the invite.
+    user = model.get_user(membername)
+    invites = list(model.lookup_team_invites(user))
+    self.assertEquals(1, len(invites))
+
+    self.deleteResponse(TeamMemberInvite,
+                        params=dict(code=invites[0].invite_token),
+                        expected_code=404)
+
+
+  def test_decline(self):
+    self.login(ADMIN_ACCESS_USER)
+
+    # Create the invite.
+    membername = NO_ACCESS_USER
+    response = self.putJsonResponse(TeamMember,
+                                    params=dict(orgname=ORGANIZATION, teamname='owners',
+                                                membername=membername))
+    
+    self.assertEquals(True, response['invited'])
+
+    # Login as the user.
+    self.login(membername)
+
+    # Decline the invite.
+    user = model.get_user(membername)
+    invites = list(model.lookup_team_invites(user))
+    self.assertEquals(1, len(invites))
+
+    self.deleteResponse(TeamMemberInvite,
+                        params=dict(code=invites[0].invite_token))
+
+    # Make sure the invite was deleted.
+    self.deleteResponse(TeamMemberInvite,
+                        params=dict(code=invites[0].invite_token),
+                        expected_code=404)
 
 
 class TestDeleteOrganizationTeamMember(ApiTestCase):
@@ -768,7 +947,7 @@ class TestDeleteOrganizationTeamMember(ApiTestCase):
                                 params=dict(orgname=ORGANIZATION,
                                             teamname='readers'))
 
-    assert not READ_ACCESS_USER in json['members']
+    assert len(json['members']) == 1
 
 
 class TestCreateRepo(ApiTestCase):
@@ -2064,7 +2243,7 @@ class TestSuperUserManagement(ApiTestCase):
 
     json = self.getJsonResponse(SuperUserManagement, params=dict(username = 'freshuser'))
     self.assertEquals('freshuser', json['username'])
-    self.assertEquals('no@thanks.com', json['email'])
+    self.assertEquals('jschorr+test@devtable.com', json['email'])
     self.assertEquals(False, json['super_user'])    
 
   def test_delete_user(self):
@@ -2087,7 +2266,7 @@ class TestSuperUserManagement(ApiTestCase):
     # Verify the user exists.
     json = self.getJsonResponse(SuperUserManagement, params=dict(username = 'freshuser'))
     self.assertEquals('freshuser', json['username'])
-    self.assertEquals('no@thanks.com', json['email'])
+    self.assertEquals('jschorr+test@devtable.com', json['email'])
 
     # Update the user.
     self.putJsonResponse(SuperUserManagement, params=dict(username='freshuser'), data=dict(email='foo@bar.com'))