Django 单元测试、自定义权限和 request.user.username答案

【问题标题】：Django unit tests, custom permission and request.user.usernameDjango 单元测试、自定义权限和 request.user.username
【发布时间】：2019-06-12 19:26:14
【问题描述】：

我需要限制对我在视图中定义的 API 的访问。这是我的views.py：

rom rest_framework import generics
from rest_framework import permissions
from .serializers import LocationSerializer, PartSerializer, PartLocationSerializer, SiteSerializer
from .models import Location, Part, PartLocation, Site, SPIUser


class SPIPermission(permissions.BasePermission):
    """
    blah blah blah ...
    """
    def has_permission(self, request, view):
        try:
            username = request.user.username
            SPIUser.objects.get(username=username)
        except SPIUser.DoesNotExist:
            return False
        if not request.user.is_authenticated:
            return False
        return True


class LocationList(generics.ListCreateAPIView):
    # using get_queryset().order_by('id') prevents UnorderedObjectListWarning
    queryset = Location.objects.get_queryset().order_by('id')
    serializer_class = LocationSerializer
    permission_classes = (SPIPermission,)

我想在我的单元测试中证明您必须是 SPIUser 才能访问这些 api 端点，所以我编写了一个简单的单元测试，如下所示：

from .models import Location, Part, PartLocation, Site, SPIUser
from .urls import urlpatterns
from my.APITestCase import RemoteAuthenticatedTest
from django.db.models import ProtectedError
from django.test import TransactionTestCase
from django.urls import reverse
from rest_framework import status
import django.db.utils
import os


class ViewTestCases(RemoteAuthenticatedTest):

    def test_spi_permission(self):

        url = reverse('spi:locationlist')
        response = self.client.get(url)
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
        SPIUser.objects.create(username=self.username)
        response = self.client.get(url)
        self.assertNotEquals(response.status_code, status.HTTP_403_FORBIDDEN)

此测试失败并显示以下错误消息：

Failure
Traceback (most recent call last):
  File "/apps/man/apman/spi/tests.py", line 21, in test_spi_permission
    self.assertNotEquals(response.status_code, status.HTTP_403_FORBIDDEN)
AssertionError: 403 == 403

我注意到has_permission 中的那行...

username = request.user.username

... 始终将username 设置为''。所以has_permission 将永远返回False。

我的单元测试ViewTestCases 继承了类RemoteAuthenticatedTest，其定义如下：

from rest_framework.test import APIClient,APITestCase
from django.contrib.auth.models import User
from rest_framework.authtoken.models import Token


class RemoteAuthenticatedTest(APITestCase):
    client_class = APIClient

    def setUp(self):
        self.username = 'mister_neutron'
        self.password = 'XXXXXXXXXXX'
        self.user = User.objects.create_user(username= self.username,
                                             email='mister_neutron@example.com',
                                             password=self.password)
        #authentication user
        self.client.login(username=self.username, password=self.password)
        Token.objects.create(user=self.user)
        super(RemoteAuthenticatedTest, self).setUp()

所以我认为request.user.username 将是mister_neutron。我在这里做错了什么？

【问题讨论】：

标签： python django unit-testing

【解决方案1】：

哎呀。我忘记了我正在使用 RemoteUser 身份验证，所以当我进行身份验证时，我需要像这样设置REMOTE_USER：

        response = self.client.get(url, REMOTE_USER=self.username)

【讨论】：