ismail
17064fc33c
The inquiry_department_response view excluded dept managers even though they can resolve the inquiry via inquiry_change_status. Now both actions use the same handling_department_id predicate so forwarding locks the old department out consistently.
73 lines
3.1 KiB
Python
73 lines
3.1 KiB
Python
"""Tests for the feedback workflow realignment (Inquiry department-ownership)."""
|
|
from django.contrib.auth.models import Group
|
|
|
|
import pytest
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
|
|
from apps.accounts.models import User
|
|
from apps.organizations.models import Department, Hospital
|
|
from apps.complaints.models import Inquiry
|
|
|
|
|
|
def _ensure_group(name):
|
|
"""Get or create a role group (pytest runs with --nomigrations, so seeded
|
|
groups may not exist in the test DB — mirrors the pattern in
|
|
tests_routing_rejection.py and tests_workflow_fixes.py)."""
|
|
grp, _ = Group.objects.get_or_create(name=name)
|
|
return grp
|
|
|
|
|
|
@pytest.mark.django_db
|
|
class TestInquiryDepartmentResponsePermission(TestCase):
|
|
"""A department manager of the handling department can record a response.
|
|
|
|
Uses self.client (full middleware incl. django.contrib.messages) rather
|
|
than calling the view directly with RequestFactory, because the view
|
|
calls messages.error() on the permission-denied path.
|
|
"""
|
|
|
|
def setUp(self):
|
|
self.hospital = Hospital.objects.create(name="Test Hospital", code="TH01")
|
|
self.dept = Department.objects.create(name="Dept A", hospital=self.hospital, code="DA")
|
|
self.other_dept = Department.objects.create(name="Dept B", hospital=self.hospital, code="DB")
|
|
|
|
_ensure_group("Department Manager")
|
|
self.dept_manager = User.objects.create_user(
|
|
username="dmgr", email="dmgr@test", password="x", department=self.dept
|
|
)
|
|
self.dept_manager.groups.add(Group.objects.get(name="Department Manager"))
|
|
|
|
self.other_manager = User.objects.create_user(
|
|
username="other_dmgr", email="o@test", password="x", department=self.other_dept
|
|
)
|
|
self.other_manager.groups.add(Group.objects.get(name="Department Manager"))
|
|
|
|
self.inquiry = Inquiry.objects.create(
|
|
hospital=self.hospital,
|
|
department=self.dept,
|
|
subject="Test",
|
|
message="msg",
|
|
status="in_progress",
|
|
sent_to_department=True,
|
|
)
|
|
|
|
def test_dept_manager_of_handling_dept_can_access_response_view(self):
|
|
"""GET to inquiry_department_response succeeds (200) for dept manager of handling dept."""
|
|
self.client.force_login(self.dept_manager)
|
|
response = self.client.get(
|
|
reverse("inquiries:inquiry_department_response", kwargs={"pk": self.inquiry.pk})
|
|
)
|
|
# 200 = permission granted, 302 = permission denied redirect.
|
|
assert response.status_code == 200, \
|
|
f"dept_manager of handling dept should be allowed, got {response.status_code}"
|
|
|
|
def test_dept_manager_of_other_dept_cannot_access(self):
|
|
"""Dept manager of a non-handling department is denied (302 redirect)."""
|
|
self.client.force_login(self.other_manager)
|
|
response = self.client.get(
|
|
reverse("inquiries:inquiry_department_response", kwargs={"pk": self.inquiry.pk})
|
|
)
|
|
assert response.status_code == 302, \
|
|
f"dept_manager of other dept should be redirected (denied), got {response.status_code}"
|