test: add electronic invoicing permission integration tests

enuxia_einvoice/tests/permissions_integration.py

@@ -0,0 +1,328 @@
+from __future__ import annotations
+
+import frappe
+from frappe.permissions import add_user_permission
+from frappe.tests import IntegrationTestCase
+
+from enuxia_einvoice.permissions import (
+    ROLE_MANAGER,
+    ROLE_OPERATOR,
+    ROLE_READER,
+    get_einvoice_access_level,
+    has_company_access,
+    require_company_access,
+    require_einvoice_role,
+)
+
+
+ALLOWED_COMPANY = "_Test Company"
+FORBIDDEN_COMPANY = "_Test Company 1"
+
+USER_WITHOUT_ROLE = (
+    "test.einvoice.no-role@example.com"
+)
+USER_READER = (
+    "test.einvoice.reader@example.com"
+)
+USER_OPERATOR = (
+    "test.einvoice.operator@example.com"
+)
+USER_MANAGER = (
+    "test.einvoice.manager@example.com"
+)
+
+TEST_USERS = {
+    USER_WITHOUT_ROLE: None,
+    USER_READER: ROLE_READER,
+    USER_OPERATOR: ROLE_OPERATOR,
+    USER_MANAGER: ROLE_MANAGER,
+}
+
+
+class TestPermissionsIntegration(
+    IntegrationTestCase
+):
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+
+        frappe.set_user("Administrator")
+
+        for email, einvoice_role in TEST_USERS.items():
+            user = cls._get_or_create_user(
+                email
+            )
+
+            current_roles = {
+                row.role
+                for row in (
+                    user.get("roles")
+                    or []
+                )
+            }
+
+            roles_to_remove = [
+                role
+                for role in (
+                    ROLE_READER,
+                    ROLE_OPERATOR,
+                    ROLE_MANAGER,
+                )
+                if role in current_roles
+            ]
+
+            if roles_to_remove:
+                user.remove_roles(
+                    *roles_to_remove
+                )
+
+            if "Accounts User" not in current_roles:
+                user.add_roles(
+                    "Accounts User"
+                )
+
+            if einvoice_role:
+                user.add_roles(
+                    einvoice_role
+                )
+
+            frappe.db.delete(
+                "User Permission",
+                {
+                    "user": email,
+                    "allow": "Company",
+                },
+            )
+
+            add_user_permission(
+                "Company",
+                ALLOWED_COMPANY,
+                email,
+                ignore_permissions=True,
+            )
+
+
+        frappe.clear_cache()
+
+    @classmethod
+    def _get_or_create_user(
+        cls,
+        email: str,
+    ):
+        if frappe.db.exists(
+            "User",
+            email,
+        ):
+            return frappe.get_doc(
+                "User",
+                email,
+            )
+
+        user = frappe.get_doc(
+            {
+                "doctype": "User",
+                "email": email,
+                "first_name": "Test",
+                "last_name": "Facturation électronique",
+                "enabled": 1,
+                "user_type": "System User",
+                "send_welcome_email": 0,
+            }
+        )
+
+        user.insert(
+            ignore_permissions=True
+        )
+
+        return user
+
+    def tearDown(self) -> None:
+        frappe.set_user(
+            "Administrator"
+        )
+        super().tearDown()
+
+    def test_real_role_hierarchy(
+        self,
+    ) -> None:
+        expected_levels = {
+            USER_WITHOUT_ROLE: 0,
+            USER_READER: 1,
+            USER_OPERATOR: 2,
+            USER_MANAGER: 3,
+        }
+
+        for user, expected_level in (
+            expected_levels.items()
+        ):
+            with self.subTest(user=user):
+                frappe.set_user(user)
+
+                self.assertEqual(
+                    get_einvoice_access_level(),
+                    expected_level,
+                )
+
+    def test_real_minimum_roles(
+        self,
+    ) -> None:
+        frappe.set_user(
+            USER_READER
+        )
+
+        with self.assertRaises(
+            frappe.PermissionError
+        ):
+            require_einvoice_role(
+                ROLE_OPERATOR
+            )
+
+        frappe.set_user(
+            USER_OPERATOR
+        )
+        require_einvoice_role(
+            ROLE_OPERATOR
+        )
+
+        frappe.set_user(
+            USER_MANAGER
+        )
+        require_einvoice_role(
+            ROLE_MANAGER
+        )
+
+    def test_real_company_user_permission(
+        self,
+    ) -> None:
+        frappe.set_user(
+            USER_OPERATOR
+        )
+
+        self.assertTrue(
+            has_company_access(
+                ALLOWED_COMPANY
+            )
+        )
+        self.assertFalse(
+            has_company_access(
+                FORBIDDEN_COMPANY
+            )
+        )
+
+        allowed_doc = frappe.get_doc(
+            "Company",
+            ALLOWED_COMPANY,
+        )
+        allowed_doc.check_permission(
+            "read"
+        )
+
+        forbidden_doc = frappe.get_doc(
+            "Company",
+            FORBIDDEN_COMPANY,
+        )
+
+        with self.assertRaises(
+            frappe.PermissionError
+        ):
+            forbidden_doc.check_permission(
+                "read"
+            )
+
+        require_company_access(
+            ALLOWED_COMPANY
+        )
+
+        with self.assertRaises(
+            frappe.PermissionError
+        ):
+            require_company_access(
+                FORBIDDEN_COMPANY
+            )
+
+    def test_exchange_permission_matrix(
+        self,
+    ) -> None:
+        for user in (
+            USER_READER,
+            USER_OPERATOR,
+            USER_MANAGER,
+        ):
+            with self.subTest(user=user):
+                frappe.set_user(user)
+
+                self.assertTrue(
+                    frappe.has_permission(
+                        "Electronic Invoice Exchange",
+                        ptype="read",
+                    )
+                )
+                self.assertFalse(
+                    frappe.has_permission(
+                        "Electronic Invoice Exchange",
+                        ptype="write",
+                    )
+                )
+                self.assertFalse(
+                    frappe.has_permission(
+                        "Electronic Invoice Exchange",
+                        ptype="create",
+                    )
+                )
+                self.assertFalse(
+                    frappe.has_permission(
+                        "Electronic Invoice Exchange",
+                        ptype="delete",
+                    )
+                )
+
+    def test_account_permission_matrix(
+        self,
+    ) -> None:
+        frappe.set_user(
+            USER_OPERATOR
+        )
+
+        for permission in (
+            "read",
+            "write",
+            "create",
+            "delete",
+        ):
+            with self.subTest(
+                user=USER_OPERATOR,
+                permission=permission,
+            ):
+                self.assertFalse(
+                    frappe.has_permission(
+                        "Electronic Invoicing Account",
+                        ptype=permission,
+                    )
+                )
+
+        frappe.set_user(
+            USER_MANAGER
+        )
+
+        for permission in (
+            "read",
+            "write",
+            "create",
+        ):
+            with self.subTest(
+                user=USER_MANAGER,
+                permission=permission,
+            ):
+                self.assertTrue(
+                    frappe.has_permission(
+                        "Electronic Invoicing Account",
+                        ptype=permission,
+                    )
+                )
+
+        self.assertFalse(
+            frappe.has_permission(
+                "Electronic Invoicing Account",
+                ptype="delete",
+            )
+        )