Merge remote-tracking branch 'origin/edr_integration'

openprocurement · May 22, 2017 · fb955c1 · fb955c1
2 parents 51bcde1 + f443f3d
commit fb955c1
Show file tree

Hide file tree

Showing 6 changed files with 200 additions and 2 deletions.
diff --git a/openprocurement/tender/competitivedialogue/tests/auth.ini b/openprocurement/tender/competitivedialogue/tests/auth.ini
@@ -21,4 +21,7 @@ reviewer = reviewer
 test = token
 
 [competitive_dialogue]
-competitive_dialogue = competitive_dialogue,c
+competitive_dialogue = competitive_dialogue,c
+
+[bots]
+bot = bot
diff --git a/openprocurement/tender/competitivedialogue/tests/stage2/award.py b/openprocurement/tender/competitivedialogue/tests/stage2/award.py
@@ -2730,6 +2730,47 @@ def test_patch_tender_award_document(self):
         self.assertEqual(response.json['errors'][0]['description'],
                          "Can't update document in current (complete) tender status")
 
+    def test_create_award_document_bot(self):
+        old_authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+        response = self.app.post('/tenders/{}/awards/{}/documents'.format(self.tender_id, self.award_id),
+                                 upload_files=[('file', 'edr_request.yaml', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+        self.assertEqual('edr_request.yaml', response.json["data"]["title"])
+        if self.docservice:
+            self.assertIn('Signature=', response.json["data"]["url"])
+            self.assertIn('KeyID=', response.json["data"]["url"])
+            self.assertNotIn('Expires=', response.json["data"]["url"])
+            key = response.json["data"]["url"].split('/')[-1].split('?')[0]
+            tender = self.db.get(self.tender_id)
+            self.assertIn(key, tender['awards'][-1]['documents'][-1]["url"])
+            self.assertIn('Signature=', tender['awards'][-1]['documents'][-1]["url"])
+            self.assertIn('KeyID=', tender['awards'][-1]['documents'][-1]["url"])
+            self.assertNotIn('Expires=', tender['awards'][-1]['documents'][-1]["url"])
+
+        self.app.authorization = old_authorization
+
+    def test_patch_not_author(self):
+        authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+        response = self.app.post('/tenders/{}/awards/{}/documents'.format(self.tender_id, self.award_id),
+                                 upload_files=[('file', 'name.doc', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+
+        self.app.authorization = authorization
+        response = self.app.patch_json('/tenders/{}/awards/{}/documents/{}?acc_token={}'.format(self.tender_id, self.award_id, doc_id, self.tender_token),
+                                       {"data": {"description": "document description"}}, status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"], "Can update document only author")
+        self.app.authorization = authorization
+
 
 class TenderStage2EU2LotAwardDocumentResourceTest(BaseCompetitiveDialogEUStage2ContentWebTest):
     initial_status = 'active.qualification'
@@ -5396,6 +5437,47 @@ def test_patch_tender_award_document(self):
         self.assertEqual(response.json['errors'][0]['description'],
                          "Can't update document in current (complete) tender status")
 
+    def test_create_award_document_bot(self):
+        old_authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+        response = self.app.post('/tenders/{}/awards/{}/documents'.format(self.tender_id, self.award_id),
+                                 upload_files=[('file', 'edr_request.yaml', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+        self.assertEqual('edr_request.yaml', response.json["data"]["title"])
+        if self.docservice:
+            self.assertIn('Signature=', response.json["data"]["url"])
+            self.assertIn('KeyID=', response.json["data"]["url"])
+            self.assertNotIn('Expires=', response.json["data"]["url"])
+            key = response.json["data"]["url"].split('/')[-1].split('?')[0]
+            tender = self.db.get(self.tender_id)
+            self.assertIn(key, tender['awards'][-1]['documents'][-1]["url"])
+            self.assertIn('Signature=', tender['awards'][-1]['documents'][-1]["url"])
+            self.assertIn('KeyID=', tender['awards'][-1]['documents'][-1]["url"])
+            self.assertNotIn('Expires=', tender['awards'][-1]['documents'][-1]["url"])
+
+        self.app.authorization = old_authorization
+
+    def test_patch_not_author(self):
+        authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+        response = self.app.post('/tenders/{}/awards/{}/documents'.format(self.tender_id, self.award_id),
+                                 upload_files=[('file', 'name.doc', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+
+        self.app.authorization = authorization
+        response = self.app.patch_json('/tenders/{}/awards/{}/documents/{}?acc_token={}'.format(self.tender_id, self.award_id, doc_id, self.tender_token),
+                                       {"data": {"description": "document description"}}, status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"], "Can update document only author")
+        self.app.authorization = authorization
+
 
 class TenderStage2UA2LotAwardDocumentResourceTest(BaseCompetitiveDialogUAStage2ContentWebTest):
     initial_status = 'active.qualification'

diff --git a/openprocurement/tender/competitivedialogue/tests/stage2/qualification.py b/openprocurement/tender/competitivedialogue/tests/stage2/qualification.py
@@ -742,6 +742,55 @@ def test_put_qualification_document_after_status_change(self):
                          [{'description': u"Can't update document in current (active.pre-qualification.stand-still) tender status",
                            u'location': u'body', u'name': u'data'}])
 
+    def test_create_qualification_document_bot(self):
+        response = self.app.get('/tenders/{}/qualifications'.format(self.tender_id))
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.status, '200 OK')
+        qualifications = response.json['data']
+        old_authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+        response = self.app.post('/tenders/{}/qualifications/{}/documents'.format(self.tender_id, qualifications[0]['id']),
+                                 upload_files=[('file', 'edr_request.yaml','content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+        self.assertEqual('edr_request.yaml', response.json["data"]["title"])
+        if self.docservice:
+            self.assertIn('Signature=', response.json["data"]["url"])
+            self.assertIn('KeyID=', response.json["data"]["url"])
+            self.assertNotIn('Expires=', response.json["data"]["url"])
+            key = response.json["data"]["url"].split('/')[-1].split('?')[0]
+            tender = self.db.get(self.tender_id)
+            self.assertIn(key, tender['awards'][-1]['documents'][-1]["url"])
+            self.assertIn('Signature=', tender['awards'][-1]['documents'][-1]["url"])
+            self.assertIn('KeyID=', tender['awards'][-1]['documents'][-1]["url"])
+            self.assertNotIn('Expires=', tender['awards'][-1]['documents'][-1]["url"])
+        self.app.authorization = old_authorization
+
+    def test_patch_document_not_author(self):
+        response = self.app.get('/tenders/{}/qualifications'.format(self.tender_id))
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.status, '200 OK')
+        qualifications = response.json['data']
+        authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+
+        response = self.app.post('/tenders/{}/qualifications/{}/documents'.format(self.tender_id, qualifications[0]['id']),
+                                 upload_files=[('file', 'edr_request.yaml', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+
+        self.app.authorization = authorization
+        response = self.app.patch_json('/tenders/{}/qualifications/{}/documents/{}?acc_token={}'.format(
+            self.tender_id, qualifications[0]['id'], doc_id, self.tender_token),
+            {"data": {"description": "document description"}}, status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"], "Can update document only author")
+
 
 class TenderStage2EUQualificationComplaintResourceTest(BaseCompetitiveDialogEUStage2ContentWebTest):
     initial_status = 'active.tendering'  # 'active.pre-qualification.stand-still' status sets in setUp

diff --git a/openprocurement/tender/competitivedialogue/tests/stage2/tender.py b/openprocurement/tender/competitivedialogue/tests/stage2/tender.py
@@ -1208,6 +1208,36 @@ def test_tender_Administrator_change(self):
         self.assertEqual(response.content_type, 'application/json')
         self.assertEqual(response.json['data']['mode'], u'test')
 
+    def test_patch_not_author(self):
+        authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('competitive_dialogue', ''))
+
+        response = self.app.post_json('/tenders', {'data': test_tender_stage2_data_eu})
+        self.assertEqual(response.status, '201 Created')
+        tender = response.json['data']
+        owner_token = response.json['access']['token']
+
+        self.set_tender_status(tender, response.json['access']['token'], 'draft.stage2')
+        response = self.set_tender_status(tender, response.json['access']['token'], 'active.tendering')
+
+        tender = response.json['data']
+
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+
+        response = self.app.post('/tenders/{}/documents'.format(tender['id']),
+                                 upload_files=[('file', 'name.doc', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+
+        self.app.authorization = ('Basic', ('broker', ''))
+        response = self.app.patch_json('/tenders/{}/documents/{}?acc_token={}'.format(tender['id'], doc_id, owner_token),
+                                       {"data": {"description": "document description"}}, status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"], "Can update document only author")
+
 
 class TenderStage2UAResourceTest(BaseCompetitiveDialogUAStage2WebTest):
 
@@ -2383,6 +2413,36 @@ def test_tender_Administrator_change(self):
         self.assertEqual(response.content_type, 'application/json')
         self.assertEqual(response.json['data']['mode'], u'test')
 
+    def test_patch_not_author(self):
+        authorization = self.app.authorization
+        self.app.authorization = ('Basic', ('competitive_dialogue', ''))
+
+        response = self.app.post_json('/tenders', {'data': test_tender_stage2_data_ua})
+        self.assertEqual(response.status, '201 Created')
+        tender = response.json['data']
+        owner_token = response.json['access']['token']
+
+        self.set_tender_status(tender, response.json['access']['token'], 'draft.stage2')
+        response = self.set_tender_status(tender, response.json['access']['token'], 'active.tendering')
+
+        tender = response.json['data']
+
+        self.app.authorization = ('Basic', ('bot', 'bot'))
+
+        response = self.app.post('/tenders/{}/documents'.format(tender['id']),
+                                 upload_files=[('file', 'name.doc', 'content')])
+        self.assertEqual(response.status, '201 Created')
+        self.assertEqual(response.content_type, 'application/json')
+        doc_id = response.json["data"]['id']
+        self.assertIn(doc_id, response.headers['Location'])
+
+        self.app.authorization = authorization
+        response = self.app.patch_json('/tenders/{}/documents/{}?acc_token={}'.format(tender['id'], doc_id, owner_token),
+                                       {"data": {"description": "document description"}}, status=403)
+        self.assertEqual(response.status, '403 Forbidden')
+        self.assertEqual(response.content_type, 'application/json')
+        self.assertEqual(response.json['errors'][0]["description"], "Can update document only author")
+
 
 class TenderStage2UAProcessTest(BaseCompetitiveDialogUAStage2WebTest):
 

diff --git a/openprocurement/tender/competitivedialogue/views/stage2/tender_document.py b/openprocurement/tender/competitivedialogue/views/stage2/tender_document.py
@@ -24,6 +24,10 @@ def validate_update_tender(self, operation):
             self.request.errors.add('body', 'data', 'tenderPeriod should be extended by {0.days} days'.format(TENDERING_EXTRA_PERIOD))
             self.request.errors.status = 403
             return
+        if operation == 'update' and self.request.authenticated_role != (self.context.author or 'tender_owner'):
+            self.request.errors.add('url', 'role', 'Can update document only author')
+            self.request.errors.status = 403
+            return
         return True
 
 

diff --git a/setup.py b/setup.py
@@ -1,7 +1,7 @@
 from setuptools import setup, find_packages
 import os
 
-version = '1.0.13'
+version = '1.0.14'
 
 requires = [
     'setuptools'