]> asedeno.scripts.mit.edu Git - bluechips.git/blob - bluechips/tests/functional/test_transfer.py
added XSRF protection to all forms and associated tests
[bluechips.git] / bluechips / tests / functional / test_transfer.py
1 from datetime import date
2 from decimal import Decimal
3
4 from webhelpers.html.secure_form import token_key
5
6 from bluechips.tests import *
7 from bluechips import model
8 from bluechips.model import meta
9
10 class TestTransferController(TestController):
11
12     def test_index(self):
13         response = self.app.get(url_for(controller='transfer'))
14         # Test response...
15         response.mustcontain('Add a New Transfer')
16         form = response.form
17
18         user_rich = meta.Session.query(model.User).\
19                 filter_by(name=u'Rich Scheme').one()
20         user_ben = meta.Session.query(model.User).\
21                 filter_by(name=u'Ben Bitdiddle').one()
22
23         form['debtor_id'] = user_rich.id
24         form['creditor_id'] = user_ben.id
25         form['amount'] = '123.45'
26         # Make sure date is today.
27         today = date.today()
28         assert form['date'].value == today.strftime('%m/%d/%Y')
29         form['description'] = 'A test transfer from Rich to Ben'
30
31         response = form.submit()
32         response = response.follow()
33         response.mustcontain('Transfer', 'created.')
34
35         t = meta.Session.query(model.Transfer).\
36                 order_by(model.Transfer.id.desc()).first()
37         assert t.debtor.name == u'Rich Scheme'
38         assert t.creditor.name == u'Ben Bitdiddle'
39         assert t.amount == 12345
40         assert t.date == today
41         assert t.description == u'A test transfer from Rich to Ben'
42
43     def test_edit(self):
44         user_rich = meta.Session.query(model.User).\
45                 filter_by(name=u'Rich Scheme').one()
46         user_ben = meta.Session.query(model.User).\
47                 filter_by(name=u'Ben Bitdiddle').one()
48         t = model.Transfer(user_rich, user_ben, 12345)
49         t.description = u'Test transfer'
50         meta.Session.add(t)
51         meta.Session.commit()
52
53         response = self.app.get(url_for(controller='transfer',
54                                         action='edit',
55                                         id=t.id))
56         response.mustcontain('Edit a Transfer')
57         form = response.form
58
59         assert int(form['debtor_id'].value) == t.debtor_id
60         assert int(form['creditor_id'].value) == t.creditor_id
61         assert Decimal(form['amount'].value) * 100 == t.amount
62         assert form['date'].value == t.date.strftime('%m/%d/%Y')
63         assert form['description'].value == t.description
64
65         form['description'] = u'A new description'
66
67         response = form.submit()
68         response = response.follow()
69         response.mustcontain('Transfer', 'updated.')
70
71         t = meta.Session.query(model.Transfer).\
72                 order_by(model.Transfer.id.desc()).first()
73         assert t.description == u'A new description'
74
75     def test_edit_nonexistent(self):
76         response = self.app.get(url_for(controller='transfer',
77                                         action='edit',
78                                         id=21424), status=404)
79
80     def test_update_nonexistent(self):
81         response = self.app.get(url_for(controller='transfer',
82                                         action='edit'))
83         params = self.sample_params.copy()
84         params[token_key] = response.form[token_key].value
85         self.app.post(url_for(controller='transfer',
86                               action='update',
87                               id=21424),
88                       params=params,
89                       status=404)
90
91     def test_xsrf_protection(self):
92         self.app.post(url_for(controller='transfer',
93                               action='update'),
94                       params=self.sample_params,
95                       status=403)
96
97
98     def test_update_get_redirects(self):
99         response = self.app.get(url_for(controller='transfer',
100                                         action='update'),
101                                 status=302)
102         assert (dict(response.headers)['location'] ==
103                 url_for(controller='transfer', action='edit', qualified=True))
104
105     def setUp(self):
106         self.sample_params = {
107             'debtor_id': '1',
108             'creditor_id': '2',
109             'amount': '33.98',
110             'date': '4/1/2007',
111             'description': 'Example transfer params.'}
112
113     def tearDown(self):
114         transfers = meta.Session.query(model.Transfer).all()
115         for t in transfers:
116             meta.Session.delete(t)
117         meta.Session.commit()