From 882c137d60a8eb0ec2d684f6fa53b65008b32704 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Wed, 2 Mar 2016 17:15:47 +0100
Subject: [PATCH] Add unit tests.

see #832
---
 modoboa/admin/models/mailbox.py |  4 ++--
 modoboa/admin/serializers.py    |  3 +++
 modoboa/admin/tests/api.py      | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/modoboa/admin/models/mailbox.py b/modoboa/admin/models/mailbox.py
index 1cd620197..c201bc7b9 100644
--- a/modoboa/admin/models/mailbox.py
+++ b/modoboa/admin/models/mailbox.py
@@ -235,8 +235,8 @@ class Mailbox(AdminObject):
                 self.quota = 0
         elif int(value) > self.domain.quota and not override_rules:
             raise lib_exceptions.BadRequest(
-                _("Quota is greater than the allowed domain's limit (%dM)"
-                  % self.domain.quota)
+                _("Quota is greater than the allowed domain's limit (%dM)")
+                  % self.domain.quota
             )
         else:
             self.quota = value
diff --git a/modoboa/admin/serializers.py b/modoboa/admin/serializers.py
index 5acfe858e..730fe9d31 100644
--- a/modoboa/admin/serializers.py
+++ b/modoboa/admin/serializers.py
@@ -113,6 +113,9 @@ class CreateAccountSerializer(AccountSerializer):
         address, domain_name = email_utils.split_mailbox(full_address)
         domain = get_object_or_404(
             admin_models.Domain, name=domain_name)
+        if not creator.can_access(domain):
+            raise serializers.ValidationError({
+                "domain": _("Permission denied.")})
         mb = admin_models.Mailbox(
             user=account, address=address, domain=domain, **data)
         mb.set_quota(
diff --git a/modoboa/admin/tests/api.py b/modoboa/admin/tests/api.py
index 2724072c2..a060d96a6 100644
--- a/modoboa/admin/tests/api.py
+++ b/modoboa/admin/tests/api.py
@@ -183,6 +183,24 @@ class AccountAPITestCase(ModoAPITestCase):
         errors = json.loads(response.content)
         self.assertIn("password", errors)
 
+    def test_create_account_as_domadmin(self):
+        """As DomainAdmin, try to create a new account."""
+        self.client.credentials(
+            HTTP_AUTHORIZATION='Token ' + self.da_token.key)
+        data = copy.deepcopy(self.ACCOUNT_DATA)
+        data["mailbox"]["quota"] = 20
+        url = reverse("external_api:account-list")
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(response.status_code, 400)
+        data["username"] = "fromapi@test2.com"
+        data["mailbox"].update({"full_address": "fromapi@test2.com",
+                                "quota": 10})
+        url = reverse("external_api:account-list")
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(response.status_code, 400)
+        errors = json.loads(response.content)
+        self.assertIn("domain", errors)
+
     def test_create_account_bad_master_user(self):
         """Try to create a new account."""
         data = copy.deepcopy(self.ACCOUNT_DATA)