Adding in security tests and docs.

test/test_api_security.py

@@ -51,7 +51,7 @@ from endpoints.api.superuser import (SuperUserLogs, SuperUserList, SuperUserMana
                                      SuperUserOrganizationManagement, SuperUserOrganizationList,
                                      SuperUserAggregateLogs, SuperUserServiceKeyManagement,
                                      SuperUserServiceKey, SuperUserServiceKeyApproval,
-                                     SuperUserTakeOwnership)
+                                     SuperUserTakeOwnership, SuperUserMessages)
 from endpoints.api.secscan import RepositoryImageSecurity
 from endpoints.api.manifest import RepositoryManifestLabels, ManageRepositoryManifestLabel
 
@@ -4200,6 +4200,36 @@ class TestSuperUserManagement(ApiTestCase):
   def test_delete_devtable(self):
     self._run_test('DELETE', 204, 'devtable', None)
 
+class TestSuperUserMessages(ApiTestCase):
+  def setUp(self):
+    ApiTestCase.setUp(self)
+    self._set_url(SuperUserMessages, username='freshuser')
+
+  def test_get_anonymous(self):
+    self._run_test('GET', 200, None, None)
+
+  def test_get_freshuser(self):
+    self._run_test('GET', 200, 'freshuser', None)
+
+  def test_get_reader(self):
+    self._run_test('GET', 200, 'reader', None)
+
+  def test_get_devtable(self):
+    self._run_test('GET', 200, 'devtable', None)
+
+
+  def test_post_anonymous(self):
+    self._run_test('POST', 403, None, dict(message={"content": "new message"}))
+
+  def test_post_freshuser(self):
+    self._run_test('POST', 403, 'freshuser', dict(message={"content": "new message"}))
+
+  def test_post_reader(self):
+    self._run_test('POST', 403, 'reader', dict(message={"content": "new message"}))
+
+  def test_post_devtable(self):
+    self._run_test('POST', 201, 'devtable', dict(message={"content": "new message"}))
+
 
 class TestUserInvoiceFieldList(ApiTestCase):
   def setUp(self):