Merge lp:~stuartmetcalfe/django-openid-auth/staff-assignment into lp:~django-openid-auth/django-openid-auth/trunk

[Stuart Metcalfe]

This branch adds functionality to set staff status for specified teams, as requested in bug #388414. If the user is in any of the teams named in settings.OPENID_LAUNCHPAD_STAFF_TEAMS on openid login, staff status is assigned. If not in those teams, staff status is unassigned.

[lp:~stuartmetcalfe/django-openid-auth/staff-assignment]

76. By Stuart Metcalfe on 2010-10-15

Prevented staff status from being changed if OPENID_LAUNCHPAD_STAFF_TEAMS is not defined. Refactored tests to reduce repetition

[Stuart Metcalfe (stuartmetcalfe)]

Folowing some additional thought, I've prevented altering staff status if OPENID_LAUNCHPAD_STAFF_TEAMS isn't defined and refactored my tests slightly to reduce repetition (in rev.76). This is now definitely ready for review.

[lp:~stuartmetcalfe/django-openid-auth/staff-assignment]

77. By Stuart Metcalfe on 2010-10-16

Moved updated user instantiation and now return it as originally planned

[Anthony Lenton (elachuni)]

review: Approve

[James Henstridge (jamesh)]

This looks good.

review: Approve

=== modified file 'django_openid_auth/auth.py'
--- django_openid_auth/auth.py	2010-08-10 08:58:07 +0000
+++ django_openid_auth/auth.py	2010-10-16 19:58:41 +0000
@@ -87,6 +87,7 @@
             openid_response)
         if teams_response:
             self.update_groups_from_teams(user, teams_response)
+            self.update_staff_status_from_teams(user, teams_response)
 
         return user
 
@@ -219,3 +220,18 @@
             user.groups.remove(group)
         for group in desired_groups - current_groups:
             user.groups.add(group)
+
+    def update_staff_status_from_teams(self, user, teams_response):
+        if not hasattr(settings, 'OPENID_LAUNCHPAD_STAFF_TEAMS'):
+            return
+
+        staff_teams = getattr(settings, 'OPENID_LAUNCHPAD_STAFF_TEAMS', [])
+        user.is_staff = False
+
+        for lp_team in teams_response.is_member:
+            if lp_team in staff_teams:
+                user.is_staff = True
+                break
+
+        user.save()
+
 
=== modified file 'django_openid_auth/tests/test_views.py'
--- django_openid_auth/tests/test_views.py	2010-08-10 08:58:07 +0000
+++ django_openid_auth/tests/test_views.py	2010-10-16 19:58:41 +0000
@@ -462,11 +462,63 @@
         openid_request = self.provider.parseFormPost(response.content)
         openid_response = openid_request.answer(True)
         teams_request = teams.TeamsRequest.fromOpenIDRequest(openid_request)
-        
+
         self.assertEqual(group1 in user.groups.all(), False)
         self.assertEqual(group2 in user.groups.all(), False)
         self.assertTrue(group3 not in user.groups.all())
 
+    def test_login_teams_staff_not_defined(self):
+        delattr(settings, 'OPENID_LAUNCHPAD_STAFF_TEAMS')
+        user = User.objects.create_user('testuser', '[e-mail]')
+        user.is_staff = True
+        user.save()
+        self.assertTrue(user.is_staff)
+
+        user = self.get_openid_authed_user_with_teams(user, 'teamname,some-other-team')
+        self.assertTrue(user.is_staff)
+
+    def test_login_teams_staff_assignment(self):
+        settings.OPENID_LAUNCHPAD_STAFF_TEAMS = ('teamname',)
+        user = User.objects.create_user('testuser', '[e-mail]')
+        user.is_staff = False
+        user.save()
+        self.assertFalse(user.is_staff)
+
+        user = self.get_openid_authed_user_with_teams(user, 'teamname,some-other-team')
+        self.assertTrue(user.is_staff)
+
+    def test_login_teams_staff_unassignment(self):
+        settings.OPENID_LAUNCHPAD_STAFF_TEAMS = ('different-teamname',)
+        user = User.objects.create_user('testuser', '[e-mail]')
+        user.is_staff = True
+        user.save()
+        self.assertTrue(user.is_staff)
+
+        user = self.get_openid_authed_user_with_teams(user, 'teamname,some-other-team')
+        self.assertFalse(user.is_staff)
+
+    def get_openid_authed_user_with_teams(self, user, teams_str):
+        useropenid = UserOpenID(
+            user=user,
+            claimed_id='http://example.com/identity',
+            display_id='http://example.com/identity')
+        useropenid.save()
+
+        # Posting in an identity URL begins the authentication request:
+        response = self.client.post('/openid/login/',
+            {'openid_identifier': 'http://example.com/identity'})
+
+        # Complete the request
+        openid_request = self.provider.parseFormPost(response.content)
+        openid_response = openid_request.answer(True)
+        teams_request = teams.TeamsRequest.fromOpenIDRequest(openid_request)
+        teams_response = teams.TeamsResponse.extractResponse(
+            teams_request, teams_str)
+        openid_response.addExtension(teams_response)
+        response = self.complete(openid_response)
+        return User.objects.get(username=user.username)
+
+
 class HelperFunctionsTest(TestCase):
     def test_sanitise_redirect_url(self):
         settings.ALLOWED_EXTERNAL_OPENID_REDIRECT_DOMAINS = [
@@ -492,6 +544,6 @@
                 self.assertEqual(url, sanitised)
             else:
                 self.assertEqual(settings.LOGIN_REDIRECT_URL, sanitised)
-        
+
 def suite():
     return unittest.TestLoader().loadTestsFromName(__name__)