From 800cdad11b7c371de439b308c270c4e0b7a9b67b Mon Sep 17 00:00:00 2001
From: Spitap <dev@asdrip.fr>
Date: Fri, 24 Feb 2023 17:52:52 +0100
Subject: [PATCH] Even better tests

---
 modoboa/admin/api/v2/tests.py      | 25 ++++++++++++++++++-------
 modoboa/admin/api/v2/viewsets.py   | 14 ++++----------
 modoboa/parameters/api/v2/tests.py | 12 ++++++++++++
 3 files changed, 34 insertions(+), 17 deletions(-)

diff --git a/modoboa/admin/api/v2/tests.py b/modoboa/admin/api/v2/tests.py
index 92b9c5e3f..b58a31199 100644
--- a/modoboa/admin/api/v2/tests.py
+++ b/modoboa/admin/api/v2/tests.py
@@ -6,7 +6,7 @@ from django.utils.encoding import force_text
 
 from rest_framework.authtoken.models import Token
 
-from modoboa.admin import factories, models
+from modoboa.admin import factories, models, constants
 from modoboa.core import models as core_models
 from modoboa.lib.tests import ModoAPITestCase
 
@@ -492,16 +492,13 @@ class AlarmViewSetTestCase(ModoAPITestCase):
         """Try updating alarm status and delete it afterward."""
 
         domain = models.Domain.objects.get(name="test.com")
-        alarm = models.Alarm.objects.create(
-            domain=domain, mailbox=None, title="Test alarm 2")
-        alarm.save()
 
         # Try performing action on restricted domains
         self.client.credentials(
             HTTP_AUTHORIZATION="Token " + self.da_token.key)
         domain = models.Domain.objects.get(name="test2.com")
         alarm_restricted = models.Alarm.objects.create(
-            domain=domain, mailbox=None, title="Test alarm 3")
+            domain=domain, mailbox=None, title="Test alarm 2")
         alarm_restricted.save()
         url = reverse("v2:alarm-switch", args=[alarm_restricted.pk])
         resp = self.client.post(url)
@@ -513,15 +510,29 @@ class AlarmViewSetTestCase(ModoAPITestCase):
         # Perform actions as SuperAdmin
         self.client.credentials(HTTP_AUTHORIZATION="Token " + self.token.key)
 
+        alarm = models.Alarm.objects.create(
+            domain=domain, mailbox=None, title="Test alarm 3")
+        alarm.save()
+
         # Switch status of the alarm to close
         url = reverse("v2:alarm-switch", args=[alarm.pk])
-        resp = self.client.patch(url, {"status": 2})
+        resp = self.client.patch(url, {"status": constants.ALARM_CLOSED})
         self.assertEqual(resp.status_code, 204)
 
         # Check actual status
         url = reverse("v2:alarm-detail", args=[alarm.pk])
         resp = self.client.get(url)
-        self.assertEqual(resp.json()["status"], 2)
+        self.assertEqual(resp.json()["status"], constants.ALARM_CLOSED)
+
+        # Switch status back to open
+        url = reverse("v2:alarm-switch", args=[alarm.pk])
+        resp = self.client.patch(url, {"status": constants.ALARM_OPENED})
+        self.assertEqual(resp.status_code, 204)
+
+        # Check actual status
+        url = reverse("v2:alarm-detail", args=[alarm.pk])
+        resp = self.client.get(url)
+        self.assertEqual(resp.json()["status"], constants.ALARM_OPENED)
 
         # Try to set an non-existant status
         url = reverse("v2:alarm-switch", args=[alarm.pk])
diff --git a/modoboa/admin/api/v2/viewsets.py b/modoboa/admin/api/v2/viewsets.py
index 0876e93c8..5c3da0f08 100644
--- a/modoboa/admin/api/v2/viewsets.py
+++ b/modoboa/admin/api/v2/viewsets.py
@@ -352,10 +352,7 @@ class AlarmViewSet(GetThrottleViewsetMixin,
         """Custom delete method that accepts body arguments."""
         alarm = self.get_object()
         domain = models.Domain.objects.get(pk=alarm.domain.pk)
-        if not request.user.can_access(domain):
-            raise PermissionDenied(_("You don't have access to this domain"))
-        else:
-            alarm.delete()
+        alarm.delete()
         return response.Response(status=status.HTTP_204_NO_CONTENT)
 
     @action(methods=['patch'], detail=True)
@@ -365,11 +362,8 @@ class AlarmViewSet(GetThrottleViewsetMixin,
         serializer = serializers.AlarmSwitchStatusSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         domain = models.Domain.objects.get(pk=alarm.domain.pk)
-        if not request.user.can_access(domain):
-            raise PermissionDenied(_("You don't have access to this domain"))
+        if serializer.data["status"] == constants.ALARM_CLOSED:
+            alarm.close()
         else:
-            if serializer.data["status"] == constants.ALARM_CLOSED:
-                alarm.close()
-            else:
-                alarm.reopen()
+            alarm.reopen()
         return response.Response(status=status.HTTP_204_NO_CONTENT)
diff --git a/modoboa/parameters/api/v2/tests.py b/modoboa/parameters/api/v2/tests.py
index 0803b650d..dc5e21c59 100644
--- a/modoboa/parameters/api/v2/tests.py
+++ b/modoboa/parameters/api/v2/tests.py
@@ -75,6 +75,18 @@ class ParametersAPITestCase(ModoAPITestCase):
             errors["dkim_keys_storage_dir"], ["Directory not found."]
         )
 
+        # Try to set dkim storage dir to a non-writable directory.
+        data = {
+            "dkim_keys_storage_dir": "/root"
+        }
+        url = reverse("v2:parameter-detail", args=["admin"])
+        resp = self.client.put(url, data, format="json")
+        self.assertEqual(resp.status_code, 400)
+        errors = resp.json()
+        self.assertEqual(
+            errors["dkim_keys_storage_dir"], ["Directory non-writable"]
+        )
+
         data = {
             "enable_mx_checks": True,
             "domains_must_have_authorized_mx": True,