testGUIwithSecurity: cleanups and more strict test

maybe a little to strict. I don't know how we can check that fields does
not display value without checking the markup in a so low level way

product/ERP5Form/tests/testGUIwithSecurity.py

@@ -41,8 +41,6 @@ from DateTime import DateTime
 class TestGUISecurity(ERP5TypeTestCase):
   """
   """
-  quiet = 0
-  run_all_test = 1
 
   def getBusinessTemplateList(self):
     return ('erp5_ui_test', 'erp5_base')
@@ -50,50 +48,60 @@ class TestGUISecurity(ERP5TypeTestCase):
   def getTitle(self):
     return "Security Issues in GUI"
 
-  def afterSetUp(self):
-    self.login()
-
-  def login(self):
-    uf = self.getPortal().acl_users
-    uf._doAddUser('seb', '', ['Manager'], [])
-    user = uf.getUserById('seb').__of__(uf)
-    newSecurityManager(None, user)
-
   def loginAs(self, id='user'):
-    uf = self.getPortal().acl_users
+    uf = self.portal.acl_users
     user = uf.getUserById(id).__of__(uf)
     newSecurityManager(None, user)
 
   def stepCreateObjects(self, sequence = None, sequence_list = None, **kw):
     # Make sure that the status is clean.
-    portal = self.getPortal()
-    portal.ListBoxZuite_reset()
-    message = portal.foo_module.FooModule_createObjects()
+    self.portal.ListBoxZuite_reset()
+    message = self.portal.foo_module.FooModule_createObjects()
     self.assertTrue('Created Successfully' in message)
-    if not hasattr(portal.person_module, 'user'):
-      user = portal.person_module.newContent(portal_type='Person', id='user', reference='user')
+    if not hasattr(self.portal.person_module, 'user'):
+      user = self.portal.person_module.newContent(portal_type='Person', id='user', reference='user')
       asg = user.newContent(portal_type='Assignment')
       asg.setStartDate(DateTime() - 100)
       asg.setStopDate(DateTime() + 100)
       asg.open()
-    self.commit()
 
   def stepCreateTestFoo(self, sequence = None, sequence_list = None, **kw):
-    foo_module = self.getPortal().foo_module
+    foo_module = self.portal.foo_module
     foo_module.newContent(portal_type='Foo', id='foo', foo_category='a')
     # allow Member to view foo_module in a hard coded way as it is not required to setup complex
     # security for this test (by default only 5A roles + Manager can view default modules)
     args = (('Manager', 'Member', 'Assignor', 'Assignee', 'Auditor', 'Associate' ), 0)
     foo_module.manage_permission('Access contents information', *args)
     foo_module.manage_permission('View', *args)
-    self.commit()
 
-  def stepAccessFoo(self, sequence = None, sequence_list = None, **kw):
+  def stepAccessFooDoesNotRaise(self, sequence = None, sequence_list = None, **kw):
     """
       Try to view the Foo_view form, make sure Unauthorized is not raised.
     """
     self.loginAs()
-    self.getPortal().foo_module.foo.Foo_view()
+    self.portal.foo_module.foo.Foo_view()
+    self.login()
+
+  def stepAccessFooDisplaysCategoryName(self, sequence = None, sequence_list = None, **kw):
+    """
+      Try to view the Foo_view form, make sure our category name is displayed
+    """
+    self.loginAs()
+    self.assertIn(
+      # this really depends on the generated markup
+      '<input name="field_my_foo_category_title" value="a" type="text"',
+      self.portal.foo_module.foo.Foo_view())
+    self.login()
+
+  def stepAccessFooDoesNotDisplayCategoryName(self, sequence = None, sequence_list = None, **kw):
+    """
+      Try to view the Foo_view form, make sure our category name is not displayed
+    """
+    self.loginAs()
+    self.assertNotIn(
+      # this really depends on the generated markup
+      '<input name="field_my_foo_category_title" value="a" type="text"',
+      self.portal.foo_module.foo.Foo_view())
     self.login()
 
   def stepChangeCategorySecurity(self, sequence = None, sequence_list = None, **kw):
@@ -101,30 +109,25 @@ class TestGUISecurity(ERP5TypeTestCase):
       here we change security of a category to which the "Foo" is related
       and which is displayed in the Foo's RelationStringField
     """
-    category = self.getPortal().portal_categories.foo_category.a
+    category = self.portal.portal_categories.foo_category.a
     args = (('Manager',), 0)
     category.manage_permission('Access contents information', *args)
     category.manage_permission('View', *args)
-    self.tic()
 
   def stepResetCategorySecurity(self, sequence = None, sequence_list = None, **kw):
     """
       reset it back
     """
-    category = self.getPortal().portal_categories.foo_category.a
+    category = self.portal.portal_categories.foo_category.a
     args = ((), 1)
     category.manage_permission('Access contents information', *args)
     category.manage_permission('View', *args)
-    self.tic()
 
-  def test_01_relationFieldToInaccessibleObject(self, quiet=quiet, run=run_all_test):
+  def test_01_relationFieldToInaccessibleObject(self):
     """
       This test checks if a form can be viewed when it contains a RelationStringField which
       links to an object the user is not authorized to view.
 
-      This fails for now. A proposed patch solving this problem is here:
-      http://svn.erp5.org/experimental/FSPatch/Products/ERP5Form/ERP5Form_safeRelationField.diff?view=markup
-
       This problem can happen for example in the following situation:
       - a user is a member of a project P team, so he can view P
       - the user creates a project-related document and leaves it in "draft" state
@@ -132,26 +135,23 @@ class TestGUISecurity(ERP5TypeTestCase):
       Then the user can not view the project, but still can view his document as he is the owner.
       An attempt to view the document form would raise Unauthorized.
     """
-    self.login()
-    if not run: return
-    if not quiet:
-      message = 'test_01_relationFieldToInaccessibleObject'
-      ZopeTestCase._print('\n%s ' % message)
-      LOG('Testing... ', 0, message)
     sequence_list = SequenceList()
     sequence_string = '\
                        CreateObjects \
                        CreateTestFoo \
                        Tic \
-                       AccessFoo \
+                       AccessFooDoesNotRaise \
+                       AccessFooDisplaysCategoryName \
                        ChangeCategorySecurity \
-                       AccessFoo \
+                       Tic \
+                       AccessFooDoesNotRaise \
+                       AccessFooDoesNotDisplayCategoryName \
                        ResetCategorySecurity \
-                       AccessFoo \
+                       Tic \
+                       AccessFooDoesNotRaise \
                        '
     sequence_list.addSequenceString(sequence_string)
-    sequence_list.play(self, quiet=quiet)
-
+    sequence_list.play(self)
 
 def test_suite():
   suite = unittest.TestSuite()