Make sure to look against all roles (#101)

* get_principals_with_access_content and get_roles_with_access_content was not
  checking against all roles

CHANGELOG.rst

@@ -1,7 +1,9 @@
 1.1.0a19 (unreleased)
 ---------------------
 
-- Nothing changed yet.
+- get_principals_with_access_content and get_roles_with_access_content was not
+  checking against all roles
+  [vangheem]
 
 
 1.1.0a18 (2017-06-22)

guillotina/security/utils.py

@@ -29,9 +29,9 @@ def get_roles_with_access_content(obj, request=None):
     interaction = IInteraction(request)
     roles = interaction.cached_roles(obj, 'guillotina.AccessContent', 'o')
     result = []
+    all_roles = role.global_roles() + role.local_roles()
     for r in roles.keys():
-        lroles = role.global_roles()
-        if r in lroles:
+        if r in all_roles:
             result.append(r)
     return result
 
@@ -44,9 +44,9 @@ def get_principals_with_access_content(obj, request=None):
     interaction = IInteraction(request)
     roles = interaction.cached_roles(obj, 'guillotina.AccessContent', 'o')
     result = []
+    all_roles = role.global_roles() + role.local_roles()
     for r in roles.keys():
-        lroles = role.local_roles()
-        if r in lroles:
+        if r in all_roles:
             result.append(r)
     users = interaction.cached_principals(obj, result, 'guillotina.AccessContent', 'o')
     return list(users.keys())

guillotina/tests/test_security.py

@@ -67,7 +67,8 @@ async def test_set_local_guillotina(container_requester):
             principals = get_principals_with_access_content(testing_object, request)
             assert principals == ['root']
             roles = get_roles_with_access_content(testing_object, request)
-            assert roles == ['guillotina.ContainerAdmin']
+            assert roles == ['guillotina.Reader', 'guillotina.Reviewer', 'guillotina.Owner',
+                             'guillotina.Editor', 'guillotina.ContainerAdmin']
 
         # Now we add the user1 with inherit on the container
         response, status = await requester(