diff --git a/project/views/utils.py b/project/views/utils.py index 16b0a13..222f056 100644 --- a/project/views/utils.py +++ b/project/views/utils.py @@ -249,6 +249,17 @@ def get_calendar_links(event_date: EventDate) -> dict: def get_invitation_access_result(email: str): from project.services.user import find_user_by_email + # Wenn der aktuelle Nutzer nicht der Empfänger der Einladung ist, Meldung ausgeben + if current_user.is_authenticated and not strings_are_equal_ignoring_case( + email, current_user.email + ): + return permission_missing( + url_for("profile"), + gettext( + "The invitation was issued to another user. Sign in with the email address the invitation was sent to." + ), + ) + # Wenn Email nicht als Nutzer vorhanden, dann direkt zu Registrierung if not find_user_by_email(email): return redirect(url_for("security.register")) @@ -257,13 +268,4 @@ def get_invitation_access_result(email: str): if not current_user.is_authenticated: return app.login_manager.unauthorized() - # Wenn der aktuelle Nutzer nicht der Empfänger der Einladung ist, Meldung ausgeben - if not strings_are_equal_ignoring_case(email, current_user.email): - return permission_missing( - url_for("profile"), - gettext( - "The invitation was issued to another user. Sign in with the email address the invitation was sent to." - ), - ) - return None diff --git a/tests/views/test_admin_unit_member_invitation.py b/tests/views/test_admin_unit_member_invitation.py index 6d7af1c..b50cc2d 100644 --- a/tests/views/test_admin_unit_member_invitation.py +++ b/tests/views/test_admin_unit_member_invitation.py @@ -1,3 +1,6 @@ +import pytest + + def test_create(client, app, utils, seeder, mocker): seeder.create_user() user_id = utils.login() @@ -200,8 +203,7 @@ def test_read_db_error(client, app, utils, seeder, mocker): def test_read_new_member_not_registered(client, app, utils, seeder): - seeder.create_user() - user_id = utils.login() + user_id = seeder.create_user() admin_unit_id = seeder.create_admin_unit(user_id, "Meine Crew") email = "new@member.de" @@ -228,20 +230,28 @@ def test_read_new_member_not_authenticated(client, app, utils, seeder): assert response.headers["Location"].startswith("http://localhost/login") -def test_read_currentUserDoesNotMatchInvitationEmail(client, app, db, utils, seeder): +@pytest.mark.parametrize("user_exists", [True, False]) +def test_read_currentUserDoesNotMatchInvitationEmail( + client, app, db, utils, seeder, user_exists +): user_id = seeder.create_user() utils.login() admin_unit_id = seeder.create_admin_unit(user_id, "Meine Crew") email = "new@member.de" - seeder.create_user(email) - invitation_id = seeder.create_invitation(admin_unit_id, email) + if user_exists: + seeder.create_user(email) + url = "/invitations/%d" % invitation_id - response = client.get(url) - assert response.status_code == 302 - assert response.headers["Location"] == "http://localhost/profile" + environ, response = client.get(url, follow_redirects=True, as_tuple=True) + + assert environ["REQUEST_URI"] == "/profile" + utils.assert_response_ok(response) + utils.assert_response_contains( + response, "Die Einladung wurde für einen anderen Nutzer ausgestellt." + ) def test_delete(client, app, utils, seeder): diff --git a/tests/views/test_user.py b/tests/views/test_user.py index 7288450..cfe7985 100644 --- a/tests/views/test_user.py +++ b/tests/views/test_user.py @@ -1,3 +1,6 @@ +import pytest + + def test_profile(client, seeder, utils): user_id, admin_unit_id = seeder.setup_base() seeder.create_event(admin_unit_id) @@ -26,17 +29,24 @@ def test_organization_invitation_not_authenticated(client, app, utils, seeder): assert response.headers["Location"].startswith("http://localhost/login") +@pytest.mark.parametrize("user_exists", [True, False]) def test_organization_invitation_currentUserDoesNotMatchInvitationEmail( - client, app, db, utils, seeder + client, app, db, utils, seeder, user_exists ): _, admin_unit_id = seeder.setup_base() invitation_id = seeder.create_admin_unit_invitation(admin_unit_id) - seeder.create_user("invited@test.de") + if user_exists: + seeder.create_user("invited@test.de") + url = utils.get_url("user_organization_invitation", id=invitation_id) - response = client.get(url) - assert response.status_code == 302 - assert response.headers["Location"] == "http://localhost/profile" + environ, response = client.get(url, follow_redirects=True, as_tuple=True) + + assert environ["REQUEST_URI"] == "/profile" + utils.assert_response_ok(response) + utils.assert_response_contains( + response, "Die Einladung wurde für einen anderen Nutzer ausgestellt." + ) def test_organization_invitation_list(client, seeder, utils):