test: add more test for mixed scope

Author: MaferMazu

openedx_authz/tests/rest_api/test_permissions.py

@@ -2,10 +2,12 @@
 
 from unittest.mock import MagicMock, patch
 
+import ddt
 from django.test import TestCase
 
 from openedx_authz.rest_api.v1.permissions import (
     BaseScopePermission,
+    ContentLibraryPermission,
     CoursePermission,
     DynamicScopePermission,
 )
@@ -114,6 +116,58 @@ def test_one_scope_fails_returns_false(self, _):
         self.assertFalse(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
 
 
+@ddt.ddt
+class TestDynamicScopePermissionBulkScopesMixed(TestCase):
+    """Test DynamicScopePermission bulk-scopes behaviour when mixing specific and org-level scopes.
+
+    Parameterized over lib (lib:Org:A / lib:Org:*) and course-v1 (course-v1:Org1+C1+2024 / course-v1:Org1+*)
+    namespaces to verify that the AND-logic holds regardless of whether a scope targets a specific
+    resource or an entire org.
+    """
+
+    def setUp(self):
+        self.perm = DynamicScopePermission()
+
+    def test_mixed_namespaces_raises_value_error(self):
+        """Mixing lib and course-v1 scopes in the same bulk request raises ValueError."""
+        request = _make_request(data={"scopes": ["lib:Org:A", "course-v1:Org1+C1+2024"]})
+        with self.assertRaises(ValueError):
+            self.perm.has_permission(request, _make_view(required_permissions=["p"]))
+
+    @ddt.data(
+        (["lib:Org:A", "lib:Org:*"], "get"),
+        (["course-v1:Org1+C1+2024", "course-v1:Org1+*"], "get"),
+    )
+    @ddt.unpack
+    @patch("openedx_authz.api.is_user_allowed", return_value=True)
+    def test_specific_and_org_scope_both_pass_returns_true(self, scopes, method, _):
+        """When the user has permission on both the specific scope and the org-level scope, access is granted."""
+        request = _make_request(data={"scopes": scopes}, method=method.upper())
+        self.assertTrue(self.perm.has_permission(request, _make_view(method=method, required_permissions=["p"])))
+
+    @ddt.data(
+        (["lib:Org:A", "lib:Org:*"], "get"),
+        (["course-v1:Org1+C1+2024", "course-v1:Org1+*"], "get"),
+    )
+    @ddt.unpack
+    @patch("openedx_authz.api.is_user_allowed", side_effect=[True, False])
+    def test_specific_passes_org_fails_returns_false(self, scopes, method, _):
+        """When the user has permission on the specific scope but not the org-level scope, access is denied."""
+        request = _make_request(data={"scopes": scopes}, method=method.upper())
+        self.assertFalse(self.perm.has_permission(request, _make_view(method=method, required_permissions=["p"])))
+
+    @ddt.data(
+        (["lib:Org:A", "lib:Org:*"], "get"),
+        (["course-v1:Org1+C1+2024", "course-v1:Org1+*"], "get"),
+    )
+    @ddt.unpack
+    @patch("openedx_authz.api.is_user_allowed", side_effect=[False, True])
+    def test_specific_fails_org_passes_returns_false(self, scopes, method, _):
+        """When the user has permission on the org-level scope but not the specific scope, access is denied."""
+        request = _make_request(data={"scopes": scopes}, method=method.upper())
+        self.assertFalse(self.perm.has_permission(request, _make_view(method=method, required_permissions=["p"])))
+
+
 class TestCoursePermission(TestCase):
     """Test CoursePermission class."""
 
@@ -141,3 +195,56 @@ def test_scope_with_permission_denied(self, _):
         """When the user lacks the required permission on the course scope, access is denied."""
         request = _make_request(data={"scope": "course-v1:Org1+C1+2024"}, method="GET")
         self.assertFalse(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
+
+    @patch("openedx_authz.api.is_user_allowed", return_value=True)
+    def test_org_scope_allowed(self, _):
+        """An org-level course scope ('course-v1:Org1+*') grants access when the user has the required permission."""
+        request = _make_request(data={"scope": "course-v1:Org1+*"}, method="GET")
+        self.assertTrue(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
+
+    @patch("openedx_authz.api.is_user_allowed", return_value=False)
+    def test_org_scope_denied(self, _):
+        """An org-level course scope ('course-v1:Org1+*') denies access when the user lacks the required permission."""
+        request = _make_request(data={"scope": "course-v1:Org1+*"}, method="GET")
+        self.assertFalse(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
+
+
+class TestContentLibraryPermission(TestCase):
+    """Test ContentLibraryPermission class."""
+
+    def setUp(self):
+        self.perm = ContentLibraryPermission()
+
+    def test_no_scope_returns_false(self):
+        """A request without any scope value is always rejected — there is nothing to authorize against."""
+        self.assertFalse(self.perm.has_permission(_make_request(), _make_view(required_permissions=["p"])))
+
+    def test_scope_no_decorator_returns_true(self):
+        """When a scope is present but the view method has no @authz_permissions decorator,
+        the endpoint is considered open and access is granted."""
+        request = _make_request(data={"scope": "lib:Org1:A"})
+        self.assertTrue(self.perm.has_permission(request, _make_view(required_permissions=None)))
+
+    @patch("openedx_authz.api.is_user_allowed", return_value=True)
+    def test_scope_with_permission_allowed(self, _):
+        """When the user has the required permission on the given library scope, access is granted."""
+        request = _make_request(data={"scope": "lib:Org1:A"}, method="GET")
+        self.assertTrue(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
+
+    @patch("openedx_authz.api.is_user_allowed", return_value=False)
+    def test_scope_with_permission_denied(self, _):
+        """When the user lacks the required permission on the library scope, access is denied."""
+        request = _make_request(data={"scope": "lib:Org1:A"}, method="GET")
+        self.assertFalse(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
+
+    @patch("openedx_authz.api.is_user_allowed", return_value=True)
+    def test_org_scope_allowed(self, _):
+        """An org-level lib scope ('lib:Org1:*') grants access when the user has the required permission."""
+        request = _make_request(data={"scope": "lib:Org1:*"}, method="GET")
+        self.assertTrue(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))
+
+    @patch("openedx_authz.api.is_user_allowed", return_value=False)
+    def test_org_scope_denied(self, _):
+        """An org-level lib scope ('lib:Org1:*') denies access when the user lacks the required permission."""
+        request = _make_request(data={"scope": "lib:Org1:*"}, method="GET")
+        self.assertFalse(self.perm.has_permission(request, _make_view(method="get", required_permissions=["p"])))

openedx_authz/tests/rest_api/test_views.py

@@ -17,6 +17,7 @@
 
 from openedx_authz import api
 from openedx_authz.api.data import (
+    CourseOverviewData,
     OrgContentLibraryGlobData,
     OrgCourseOverviewGlobData,
 )
@@ -35,6 +36,7 @@
 User = get_user_model()
 
 COURSE_SCOPE_ORG1 = "course-v1:Org1+COURSE1+2024"
+COURSE_ORG1_GLOB = OrgCourseOverviewGlobData.build_external_key(CourseOverviewData(external_key=COURSE_SCOPE_ORG1).org)
 
 
 class ViewTestMixin(BaseRolesTestCase):
@@ -146,7 +148,7 @@ def create_admin_users(cls, quantity: int):
     @classmethod
     def create_course_users(cls):
         """Create course users (plain, non-staff)."""
-        users = ["course_admin", "course_editor", "course_auditor"]
+        users = ["course_admin", "course_editor", "course_auditor", "course_admin_org"]
         for username in users:
             User.objects.get_or_create(
                 username=username, defaults={"email": f"{username}@example.com"}
@@ -1521,7 +1523,7 @@ def test_org_glob_scope_returns_all_org_courses(self):
         self.build_qs_patcher.stop()
 
         # Simulate get_scopes_for_user_and_permission returning an org-level glob.
-        glob_scope = OrgCourseOverviewGlobData(external_key="course-v1:Org1+*")
+        glob_scope = OrgCourseOverviewGlobData(external_key=COURSE_ORG1_GLOB)
         with patch(
             "openedx_authz.rest_api.v1.views.get_scopes_for_user_and_permission",
             return_value=[glob_scope],
@@ -3908,7 +3910,7 @@ def test_user_with_org_course_permission_sees_org_course_assignments(self):
                 {
                     "subject_name": "regular_10",
                     "role_name": roles.COURSE_STAFF.external_key,
-                    "scope_name": "course-v1:Org1+*",
+                    "scope_name": COURSE_ORG1_GLOB,
                 },
             ]
         )
@@ -4028,24 +4030,31 @@ def test_user_with_both_library_and_course_permissions(self):
         self.assertIn("course-v1", scope_types)
 
 
+@ddt
 class TestBulkPutScopesAllLogic(ViewTestMixin):
     """Test that DynamicScopePermission enforces AND logic across scopes in bulk PUT.
 
     validate_permissions uses OR logic (any permission suffices per scope), but
     DynamicScopePermission wraps that with all(...for sv in scopes_list), meaning
     the user must pass the permission check for EVERY scope in the list.
 
-    course_admin has COURSE_ADMIN on COURSE_SCOPE_ORG1 only, giving them
-    COURSES_MANAGE_COURSE_TEAM on that scope but no permissions elsewhere.
+    Two users illustrate the difference between specific-scope and org-level permissions:
+      - course_admin: COURSE_ADMIN on COURSE_SCOPE_ORG1 only (specific course).
+      - course_admin_org: COURSE_ADMIN on COURSE_ORG1_GLOB (all courses in Org1).
     """
 
-    ANOTHER_COURSE_SCOPE = "course-v1:Org1+COURSE2+2024"
+    ANOTHER_COURSE_SCOPE = "course-v1:Org2+COURSE2+2024"
     _COURSE_ASSIGNMENTS = [
             {
                 "subject_name": "course_admin",
                 "role_name": roles.COURSE_ADMIN.external_key,
                 "scope_name": COURSE_SCOPE_ORG1,
             },
+            {
+                "subject_name": "course_admin_org",
+                "role_name": roles.COURSE_ADMIN.external_key,
+                "scope_name": COURSE_ORG1_GLOB,
+            },
     ]
 
     def setUp(self):
@@ -4057,7 +4066,8 @@ def setUp(self):
 
     def _put_course(self, scopes):
         request_data = {"role": roles.COURSE_ADMIN.external_key, "scopes": scopes, "users": ["regular_2"]}
-        with patch.object(api.CourseOverviewData, "exists", return_value=True):
+        with patch.object(api.CourseOverviewData, "exists", return_value=True), \
+             patch.object(api.OrgCourseOverviewGlobData, "exists", return_value=True):
             return self.client.put(self.url, data=request_data, format="json")
 
     def _put_lib(self, scopes):
@@ -4066,7 +4076,7 @@ def _put_lib(self, scopes):
             return self.client.put(self.url, data=request_data, format="json")
 
     def test_all_scopes_permitted_succeeds(self):
-        """User has permission on all requested scopes → 207."""
+        """course_admin has permission on their specific scope → 207."""
         response = self._put_course([COURSE_SCOPE_ORG1])
         self.assertEqual(response.status_code, status.HTTP_207_MULTI_STATUS)
 
@@ -4088,3 +4098,30 @@ def test_course_user_cannot_add_library_roles(self):
         """
         response = self._put_lib(["lib:Org1:LIB1"])
         self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    @data(
+        # course_admin has COURSE_ADMIN on the specific course only.
+        # Passes for the exact scope, but fails for the org-level glob or any combo including it.
+        ("course_admin", [COURSE_SCOPE_ORG1], status.HTTP_207_MULTI_STATUS),
+        ("course_admin", [COURSE_ORG1_GLOB], status.HTTP_403_FORBIDDEN),
+        ("course_admin", [COURSE_SCOPE_ORG1, COURSE_ORG1_GLOB], status.HTTP_403_FORBIDDEN),
+        # course_admin_org has COURSE_ADMIN on the org-level glob.
+        # Via Casbin glob matching, this covers both the glob itself and any specific course within the org.
+        ("course_admin_org", [COURSE_SCOPE_ORG1], status.HTTP_207_MULTI_STATUS),
+        ("course_admin_org", [COURSE_ORG1_GLOB], status.HTTP_207_MULTI_STATUS),
+        ("course_admin_org", [COURSE_SCOPE_ORG1, COURSE_ORG1_GLOB], status.HTTP_207_MULTI_STATUS),
+    )
+    @unpack
+    def test_scope_permission_vs_org_permission(self, username, scopes, expected_status):
+        """A user with a specific-scope role and one with an org-level role behave differently
+        when bulk PUT includes the org-level glob alongside specific scopes.
+
+        course_admin (specific scope) fails on any scope list that includes the org glob,
+        because they have no permission at that level.
+        course_admin_org (org-level glob) passes for both the glob and any specific course
+        within that org, thanks to Casbin's glob matching.
+        """
+        user = User.objects.get(username=username)
+        self.client.force_authenticate(user=user)
+        response = self._put_course(scopes)
+        self.assertEqual(response.status_code, expected_status)