Add user groups support.

tests/api/routes/controller/test_groups.py

@@ -0,0 +1,165 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import pytest
+
+from fastapi import FastAPI, status
+from httpx import AsyncClient
+
+from sqlalchemy.ext.asyncio import AsyncSession
+from gns3server.db.repositories.users import UsersRepository
+from gns3server.schemas.controller.users import User
+
+pytestmark = pytest.mark.asyncio
+
+
+class TestGroupRoutes:
+
+    async def test_create_group(self, app: FastAPI, client: AsyncClient) -> None:
+
+        new_group = {"name": "group1"}
+        response = await client.post(app.url_path_for("create_user_group"), json=new_group)
+        assert response.status_code == status.HTTP_201_CREATED
+
+    async def test_get_group(self, app: FastAPI, client: AsyncClient, db_session: AsyncSession) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("group1")
+        response = await client.get(app.url_path_for("get_user_group", user_group_id=group_in_db.user_group_id))
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["user_group_id"] == str(group_in_db.user_group_id)
+
+    async def test_list_groups(self, app: FastAPI, client: AsyncClient) -> None:
+
+        response = await client.get(app.url_path_for("get_user_groups"))
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()) == 4  # 3 default groups + group1
+
+    async def test_update_group(self, app: FastAPI, client: AsyncClient, db_session: AsyncSession) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("group1")
+
+        update_group = {"name": "group42"}
+        response = await client.put(
+            app.url_path_for("update_user_group", user_group_id=group_in_db.user_group_id),
+            json=update_group
+        )
+        assert response.status_code == status.HTTP_200_OK
+        updated_group_in_db = await user_repo.get_user_group(group_in_db.user_group_id)
+        assert updated_group_in_db.name == "group42"
+
+    async def test_cannot_update_admin_group(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("Administrators")
+        update_group = {"name": "Hackers"}
+        response = await client.put(
+            app.url_path_for("update_user_group", user_group_id=group_in_db.user_group_id),
+            json=update_group
+        )
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    async def test_delete_group(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("group42")
+        response = await client.delete(app.url_path_for("delete_user_group", user_group_id=group_in_db.user_group_id))
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+
+    async def test_cannot_delete_admin_group(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("Administrators")
+        response = await client.delete(app.url_path_for("delete_user_group", user_group_id=group_in_db.user_group_id))
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    async def test_add_member_to_group(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("Users")
+        response = await client.put(
+            app.url_path_for(
+                "add_member_to_group",
+                user_group_id=group_in_db.user_group_id,
+                user_id=str(test_user.user_id)
+            )
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        members = await user_repo.get_user_group_members(group_in_db.user_group_id)
+        assert len(members) == 1
+        assert members[0].username == test_user.username
+
+    async def test_get_user_group_members(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("Users")
+        response = await client.get(
+            app.url_path_for(
+                "get_user_group_members",
+                user_group_id=group_in_db.user_group_id)
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()) == 1
+
+    async def test_remove_member_from_group(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        group_in_db = await user_repo.get_user_group_by_name("Users")
+
+        response = await client.delete(
+            app.url_path_for(
+                "remove_member_from_group",
+                user_group_id=group_in_db.user_group_id,
+                user_id=str(test_user.user_id)
+            ),
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        members = await user_repo.get_user_group_members(group_in_db.user_group_id)
+        assert len(members) == 0

tests/api/routes/controller/test_users.py

@@ -56,8 +56,8 @@ class TestUserRoutes:
         assert user_in_db is None
 
         # register the user
-        res = await client.post(app.url_path_for("create_user"), json=params)
-        assert res.status_code == status.HTTP_201_CREATED
+        response = await client.post(app.url_path_for("create_user"), json=params)
+        assert response.status_code == status.HTTP_201_CREATED
 
         # make sure the user does exists in the database now
         user_in_db = await user_repo.get_user_by_username(params["username"])
@@ -66,7 +66,7 @@ class TestUserRoutes:
         assert user_in_db.username == params["username"]
 
         # check that the user returned in the response is equal to the user in the database
-        created_user = User(**res.json()).json()
+        created_user = User(**response.json()).json()
         assert created_user == User.from_orm(user_in_db).json()
 
     @pytest.mark.parametrize(
@@ -91,8 +91,8 @@ class TestUserRoutes:
 
         new_user = {"email": "not_taken@email.com", "username": "not_taken_username", "password": "test_password"}
         new_user[attr] = value
-        res = await client.post(app.url_path_for("create_user"), json=new_user)
-        assert res.status_code == status_code
+        response = await client.post(app.url_path_for("create_user"), json=new_user)
+        assert response.status_code == status_code
 
     async def test_users_saved_password_is_hashed(
         self,
@@ -105,8 +105,8 @@ class TestUserRoutes:
         new_user = {"username": "user3", "email": "user3@email.com", "password": "test_password"}
 
         # send post request to create user and ensure it is successful
-        res = await client.post(app.url_path_for("create_user"), json=new_user)
-        assert res.status_code == status.HTTP_201_CREATED
+        response = await client.post(app.url_path_for("create_user"), json=new_user)
+        assert response.status_code == status.HTTP_201_CREATED
 
         # ensure that the users password is hashed in the db
         # and that we can verify it using our auth service
@@ -156,7 +156,6 @@ class TestAuthTokens:
         username = auth_service.get_username_from_token(token)
         assert username == test_user.username
 
-
     @pytest.mark.parametrize(
         "wrong_secret, wrong_token",
         (
@@ -200,19 +199,19 @@ class TestUserLogin:
             "username": test_user.username,
             "password": "user1_password",
         }
-        res = await unauthorized_client.post(app.url_path_for("login"), data=login_data)
-        assert res.status_code == status.HTTP_200_OK
+        response = await unauthorized_client.post(app.url_path_for("login"), data=login_data)
+        assert response.status_code == status.HTTP_200_OK
 
         # check that token exists in response and has user encoded within it
-        token = res.json().get("access_token")
+        token = response.json().get("access_token")
         payload = jwt.decode(token, jwt_secret, algorithms=["HS256"])
         assert "sub" in payload
         username = payload.get("sub")
         assert username == test_user.username
 
         # check that token is proper type
-        assert "token_type" in res.json()
-        assert res.json().get("token_type") == "bearer"
+        assert "token_type" in response.json()
+        assert response.json().get("token_type") == "bearer"
 
     async def test_user_can_authenticate_using_json(
             self,
@@ -226,9 +225,9 @@ class TestUserLogin:
             "username": test_user.username,
             "password": "user1_password",
         }
-        res = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
-        assert res.status_code == status.HTTP_200_OK
-        assert res.json().get("access_token")
+        response = await unauthorized_client.post(app.url_path_for("authenticate"), json=credentials)
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json().get("access_token")
 
     @pytest.mark.parametrize(
         "username, password, status_code",
@@ -253,9 +252,9 @@ class TestUserLogin:
             "username": username,
             "password": password,
         }
-        res = await unauthorized_client.post(app.url_path_for("login"), data=login_data)
-        assert res.status_code == status_code
-        assert "access_token" not in res.json()
+        response = await unauthorized_client.post(app.url_path_for("login"), data=login_data)
+        assert response.status_code == status_code
+        assert "access_token" not in response.json()
 
 
 class TestUserMe:
@@ -267,9 +266,9 @@ class TestUserMe:
             test_user: User,
     ) -> None:
 
-        res = await authorized_client.get(app.url_path_for("get_current_active_user"))
-        assert res.status_code == status.HTTP_200_OK
-        user = User(**res.json())
+        response = await authorized_client.get(app.url_path_for("get_current_active_user"))
+        assert response.status_code == status.HTTP_200_OK
+        user = User(**response.json())
         assert user.username == test_user.username
         assert user.email == test_user.email
         assert user.user_id == test_user.user_id
@@ -280,8 +279,8 @@ class TestUserMe:
             test_user: User,
     ) -> None:
 
-        res = await unauthorized_client.get(app.url_path_for("get_current_active_user"))
-        assert res.status_code == status.HTTP_401_UNAUTHORIZED
+        response = await unauthorized_client.get(app.url_path_for("get_current_active_user"))
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
 
 
 class TestSuperAdmin:
@@ -307,8 +306,8 @@ class TestSuperAdmin:
 
         user_repo = UsersRepository(db_session)
         admin_in_db = await user_repo.get_user_by_username("admin")
-        res = await client.delete(app.url_path_for("delete_user", user_id=admin_in_db.user_id))
-        assert res.status_code == status.HTTP_403_FORBIDDEN
+        response = await client.delete(app.url_path_for("delete_user", user_id=admin_in_db.user_id))
+        assert response.status_code == status.HTTP_403_FORBIDDEN
 
     async def test_admin_can_login_after_password_recovery(
             self,
@@ -327,5 +326,18 @@ class TestSuperAdmin:
             "username": "admin",
             "password": "whatever",
         }
-        res = await unauthorized_client.post(app.url_path_for("login"), data=login_data)
-        assert res.status_code == status.HTTP_200_OK
+        response = await unauthorized_client.post(app.url_path_for("login"), data=login_data)
+        assert response.status_code == status.HTTP_200_OK
+
+    async def test_super_admin_belongs_to_admin_group(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        admin_in_db = await user_repo.get_user_by_username("admin")
+        response = await client.get(app.url_path_for("get_user_memberships", user_id=admin_in_db.user_id))
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()) == 1