text: 
  from __future__ import unicode_literals
  import json
  
  from django.contrib.auth.models import User
  from django.test import TestCase
  from rest_framework.authtoken.models import Token
  
  
  class TestAdminPerms(TestCase):
  
      def test_first_signup(self):
          # register a first user
          username, password = 'firstuser', 'password'
          email = 'autotest@deis.io'
          submit = {
              'username': username,
              'password': password,
              'email': email,
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertTrue(response.data['is_superuser'])
          # register a second user
          username, password = 'seconduser', 'password'
          email = 'autotest@deis.io'
          submit = {
              'username': username,
              'password': password,
              'email': email,
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertFalse(response.data['is_superuser'])
  
      def test_list(self):
          submit = {
              'username': 'firstuser',
              'password': 'password',
              'email': 'autotest@deis.io',
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertTrue(response.data['is_superuser'])
          user = User.objects.get(username='firstuser')
          token = Token.objects.get(user=user).key
          response = self.client.get('/v1/admin/perms', content_type='application/json',
                                     HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 1)
          self.assertEqual(response.data['results'][0]['username'], 'firstuser')
          self.assertTrue(response.data['results'][0]['is_superuser'])
          # register a non-superuser
          submit = {
              'username': 'seconduser',
              'password': 'password',
              'email': 'autotest@deis.io',
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertFalse(response.data['is_superuser'])
          user = User.objects.get(username='seconduser')
          token = Token.objects.get(user=user).key
          response = self.client.get('/v1/admin/perms', content_type='application/json',
                                     HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 403)
          self.assertIn('You do not have permission', response.data['detail'])
  
      def test_create(self):
          submit = {
              'username': 'first',
              'password': 'password',
              'email': 'autotest@deis.io',
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertTrue(response.data['is_superuser'])
          submit = {
              'username': 'second',
              'password': 'password',
              'email': 'autotest@deis.io',
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertFalse(response.data['is_superuser'])
          user = User.objects.get(username='first')
          token = Token.objects.get(user=user).key
          # grant user 2 the superuser perm
          url = '/v1/admin/perms'
          body = {'username': 'second'}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 201)
          response = self.client.get(url, HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 2)
          self.assertIn('second', str(response.data['results']))
  
      def test_delete(self):
          submit = {
              'username': 'first',
              'password': 'password',
              'email': 'autotest@deis.io',
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertTrue(response.data['is_superuser'])
          submit = {
              'username': 'second',
              'password': 'password',
              'email': 'autotest@deis.io',
          }
          url = '/v1/auth/register'
          response = self.client.post(url, json.dumps(submit), content_type='application/json')
          self.assertEqual(response.status_code, 201)
          self.assertFalse(response.data['is_superuser'])
          user = User.objects.get(username='first')
          token = Token.objects.get(user=user).key
          # grant user 2 the superuser perm
          url = '/v1/admin/perms'
          body = {'username': 'second'}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 201)
          # revoke the superuser perm
          response = self.client.delete(url + '/second', HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 204)
          response = self.client.get(url, HTTP_AUTHORIZATION='token {}'.format(token))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 1)
          self.assertNotIn('two', str(response.data['results']))
  
  
  class TestAppPerms(TestCase):
  
      fixtures = ['test_sharing.json']
  
      def setUp(self):
          self.user = User.objects.get(username='autotest-1')
          self.token = Token.objects.get(user=self.user).key
          self.user2 = User.objects.get(username='autotest-2')
          self.token2 = Token.objects.get(user=self.user2).key
  
      def test_create(self):
          # check that user 1 sees her lone app and user 2's app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 2)
          app_id = response.data['results'][0]['id']
          # check that user 2 can only see his app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(len(response.data['results']), 1)
          # check that user 2 can't see any of the app's builds, configs,
          # containers, limits, or releases
          for model in ['builds', 'config', 'containers', 'releases']:
              response = self.client.get("/v1/apps/{}/{}/".format(app_id, model),
                                         HTTP_AUTHORIZATION='token {}'.format(self.token2))
              msg = "Failed: status '%s', and data '%s'" % (response.status_code, response.data)
              self.assertEqual(response.status_code, 403, msg=msg)
              self.assertEqual(response.data['detail'],
                               'You do not have permission to perform this action.', msg=msg)
          # TODO: test that git pushing to the app fails
          # give user 2 permission to user 1's app
          url = "/v1/apps/{}/perms".format(app_id)
          body = {'username': 'autotest-2'}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 201)
          # check that user 2 can see the app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 2)
          # check that user 2 sees (empty) results now for builds, containers,
          # and releases. (config and limit will still give 404s since we didn't
          # push a build here.)
          for model in ['builds', 'containers', 'releases']:
              response = self.client.get("/v1/apps/{}/{}/".format(app_id, model),
                                         HTTP_AUTHORIZATION='token {}'.format(self.token2))
              self.assertEqual(len(response.data['results']), 0)
          # TODO:  check that user 2 can git push the app
  
      def test_create_errors(self):
          # check that user 1 sees her lone app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token))
          app_id = response.data['results'][0]['id']
          # check that user 2 can't create a permission
          url = "/v1/apps/{}/perms".format(app_id)
          body = {'username': 'autotest-2'}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(response.status_code, 403)
  
      def test_delete(self):
          # give user 2 permission to user 1's app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token))
          app_id = response.data['results'][0]['id']
          url = "/v1/apps/{}/perms".format(app_id)
          body = {'username': 'autotest-2'}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 201)
          # check that user 2 can see the app as well as his own
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 2)
          # try to delete the permission as user 2
          url = "/v1/apps/{}/perms/{}".format(app_id, 'autotest-2')
          response = self.client.delete(url, content_type='application/json',
                                        HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(response.status_code, 403)
          # delete permission to user 1's app
          response = self.client.delete(url, content_type='application/json',
                                        HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 204)
          self.assertIsNone(response.data)
          # check that user 2 can only see his app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(len(response.data['results']), 1)
          # delete permission to user 1's app again, expecting an error
          response = self.client.delete(url, content_type='application/json',
                                        HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 403)
  
      def test_list(self):
          # check that user 1 sees her lone app and user 2's app
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 2)
          app_id = response.data['results'][0]['id']
          # create a new object permission
          url = "/v1/apps/{}/perms".format(app_id)
          body = {'username': 'autotest-2'}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 201)
          # list perms on the app
          response = self.client.get(
              "/v1/apps/{}/perms".format(app_id), content_type='application/json',
              HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.data, {'users': ['autotest-2']})
  
      def test_admin_can_list(self):
          """Check that an administrator can list an app's perms"""
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token))
          self.assertEqual(response.status_code, 200)
          self.assertEqual(len(response.data['results']), 2)
  
      def test_list_errors(self):
          response = self.client.get('/v1/apps', HTTP_AUTHORIZATION='token {}'.format(self.token))
          app_id = response.data['results'][0]['id']
          # login as user 2, list perms on the app
          response = self.client.get(
              "/v1/apps/{}/perms".format(app_id), content_type='application/json',
              HTTP_AUTHORIZATION='token {}'.format(self.token2))
          self.assertEqual(response.status_code, 403)
  
      def test_unauthorized_user_cannot_modify_perms(self):
          """
          An unauthorized user should not be able to modify other apps' permissions.
  
          Since an unauthorized user should not know about the application at all, these
          requests should return a 404.
          """
          app_id = 'autotest'
          url = '/v1/apps'
          body = {'id': app_id}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(self.token))
          unauthorized_user = self.user2
          unauthorized_token = self.token2
          url = '{}/{}/perms'.format(url, app_id)
          body = {'username': unauthorized_user.username}
          response = self.client.post(url, json.dumps(body), content_type='application/json',
                                      HTTP_AUTHORIZATION='token {}'.format(unauthorized_token))
          self.assertEqual(response.status_code, 403)
  