]> asedeno.scripts.mit.edu Git - bluechips.git/blob - bluechips/tests/functional/test_spend.py
added XSRF protection to all forms and associated tests
[bluechips.git] / bluechips / tests / functional / test_spend.py
1 from datetime import date
2 from formencode import Invalid
3
4 from webhelpers.html.secure_form import token_key
5
6 from bluechips.tests import *
7
8 from bluechips import model
9 from bluechips.model import meta
10 from bluechips.model.types import Currency
11
12 from bluechips.controllers.spend import ExpenditureSchema
13
14 class TestSpendController(TestController):
15
16     def test_index(self):
17         response = self.app.get(url_for(controller='spend'))
18         # Test response...
19         response.mustcontain('Add a New Expenditure')
20         form = response.form
21
22         user = meta.Session.query(model.User).\
23                 filter_by(name=u'Charlie Root').one()
24         
25         form['spender_id'] = user.id
26         form['amount'] = '74.04'
27         # Make sure date is today.
28         today = date.today()
29         assert form['date'].value == today.strftime('%m/%d/%Y')
30         form['description'] = 'A test expenditure'
31         form['shares-0.amount'] = '1'
32         form['shares-1.amount'] = '2'
33         form['shares-2.amount'] = '2'
34         form['shares-3.amount'] = '1'
35         for ii in range(4):
36             assert int(form['shares-%d.user_id' % ii].value) == ii + 1
37
38         response = form.submit()
39         response = response.follow()
40         response.mustcontain('Expenditure', 'created.')
41
42         e = meta.Session.query(model.Expenditure).\
43                 order_by(model.Expenditure.id.desc()).first()
44         assert e.spender.name == u'Charlie Root'
45         assert e.amount == 7404
46         assert e.date == today
47         assert e.description == u'A test expenditure'
48
49         # Test the split.
50         shares = dict(((sp.user_id, sp.share)
51                        for sp in e.splits))
52         assert shares[1] == Currency('12.34')
53         assert shares[2] == Currency('24.68')
54         assert shares[3] == Currency('24.68')
55         assert shares[4] == Currency('12.34')
56
57
58     def test_edit(self):
59         user = meta.Session.query(model.User).\
60                 filter_by(name=u'Charlie Root').one()
61         e = model.Expenditure(user, 53812, u'Lemon bundt cake', None)
62         e.even_split()
63         meta.Session.add(e)
64         meta.Session.commit()
65
66         response = self.app.get(url_for(controller='spend',
67                                         action='edit',
68                                         id=e.id))
69         response.mustcontain('Edit an Expenditure')
70         form = response.form
71
72         assert int(form['spender_id'].value) == user.id
73         assert form['amount'].value == '538.12'
74         assert form['date'].value == date.today().strftime('%m/%d/%Y')
75         assert form['description'].value == u'Lemon bundt cake'
76
77         form['description'] = u'Updated bundt cake'
78
79         # Update the split too.
80
81         response = form.submit()
82         response = response.follow()
83         response.mustcontain('Expenditure', 'updated.')
84
85         e = meta.Session.query(model.Expenditure).\
86                 order_by(model.Expenditure.id.desc()).first()
87         assert e.description == u'Updated bundt cake'
88
89     def test_edit_zero_value(self):
90         user = meta.Session.query(model.User).\
91                 filter_by(name=u'Charlie Root').one()
92         e = model.Expenditure(user, 0, u'A zero value expenditure', None)
93         e.even_split()
94         meta.Session.add(e)
95         meta.Session.commit()
96
97         response = self.app.get(url_for(controller='spend',
98                                         action='edit',
99                                         id=e.id))
100         response.mustcontain('Edit an Expenditure')
101         form = response.form
102
103         assert int(form['spender_id'].value) == user.id
104         assert form['amount'].value == '0.00'
105         assert form['date'].value == date.today().strftime('%m/%d/%Y')
106         assert form['description'].value == u'A zero value expenditure'
107         for ii in range(4):
108             assert form['shares-%d.amount' % ii].value == '0'
109
110     def test_edit_nonexistent(self):
111         response = self.app.get(url_for(controller='spend',
112                                         action='edit',
113                                         id=124234), status=404)
114
115     def test_update_nonexistent(self):
116         response = self.app.get(url_for(controller='spend',
117                                         action='edit'))
118         params = self.sample_post.copy()
119         params[token_key] = response.form[token_key].value
120         self.app.post(url_for(controller='spend',
121                               action='update',
122                               id=14234), 
123                       params=params,
124                       status=404)
125
126     def test_xsrf_protection(self):
127         self.app.post(url_for(controller='spend',
128                               action='update'),
129                       params=self.sample_post,
130                       status=403)
131
132     def test_all_zero_shares_fails(self):
133         params = self.sample_post.copy()
134         for ii in range(4):
135             params['shares-%d.amount' % ii] = '0'
136         v = ExpenditureSchema()
137         try:
138             v.to_python(params)
139         except Invalid:
140             pass
141
142     def setUp(self):
143         self.sample_post = {
144             'spender_id': '1',
145             'amount': '44.12',
146             'date': '10/5/2008',
147             'description': 'Example expenditure post data.',
148             'shares-0.user_id': '1',
149             'shares-0.amount': '1',
150             'shares-1.user_id': '2',
151             'shares-1.amount': '1',
152             'shares-2.user_id': '3',
153             'shares-2.amount': '1',
154             'shares-3.user_id': '4',
155             'shares-3.amount': '1'}
156
157     def tearDown(self):
158         expenditures = meta.Session.query(model.Expenditure).all()
159         for e in expenditures:
160             meta.Session.delete(e)
161         meta.Session.commit()