'Test delegation of a role'

def testRoleDelegation(self):

    s3db = current.s3db
    auth = current.auth
    current.deployment_settings.security.policy = 8
    auth.permission = S3Permission(auth)
    auth.s3_impersonate('normaluser@example.com')
    user = auth.user.pe_id
    org1 = self.org[0]
    org2 = self.org[1]
    org3 = self.org[2]
    pr_add_affiliation = s3db.pr_add_affiliation
    pr_remove_affiliation = s3db.pr_remove_affiliation
    s3_delegate_role = auth.s3_delegate_role
    s3_remove_delegation = auth.s3_remove_delegation
    assertTrue = self.assertTrue
    assertFalse = self.assertFalse
    assertEqual = self.assertEqual
    assertNotEqual = self.assertNotEqual
    READER = self.reader
    EDITOR = self.editor
    pr_add_affiliation(org3, user, role='TestStaff')
    auth.s3_assign_role(auth.user.id, EDITOR, for_pe=org3)
    pr_add_affiliation(org2, org3, role='TestOrgUnit')
    s3_delegate_role(READER, org1, receiver=org2)
    delegations = auth.user.delegations
    assertTrue((READER in delegations))
    assertTrue((org3 in delegations[READER]))
    assertTrue((org1 in delegations[READER][org3]))
    s3_remove_delegation(READER, org1, receiver=org2)
    delegations = auth.user.delegations
    assertEqual(delegations.keys(), [])
    s3_delegate_role([READER, EDITOR], org1, receiver=org2)
    delegations = auth.s3_get_delegations(org1)
    assertNotEqual(delegations, None)
    assertTrue(isinstance(delegations, Storage))
    assertTrue((org2 in delegations))
    assertTrue(isinstance(delegations[org2], list))
    assertEqual(len(delegations[org2]), 2)
    assertTrue((READER in delegations[org2]))
    assertTrue((EDITOR in delegations[org2]))
    delegations = auth.user.delegations
    assertTrue((READER in delegations))
    assertTrue((EDITOR in delegations))
    assertTrue((org3 in delegations[READER]))
    assertTrue((org1 in delegations[READER][org3]))
    assertTrue((org3 in delegations[EDITOR]))
    assertTrue((org1 in delegations[EDITOR][org3]))
    s3_remove_delegation(EDITOR, org1, receiver=org2)
    delegations = auth.s3_get_delegations(org1)
    assertNotEqual(delegations, None)
    assertTrue(isinstance(delegations, Storage))
    assertTrue((org2 in delegations))
    assertTrue(isinstance(delegations[org2], list))
    assertEqual(len(delegations[org2]), 1)
    assertTrue((READER in delegations[org2]))
    delegations = auth.user.delegations
    assertTrue((READER in delegations))
    assertFalse((EDITOR in delegations))
    assertTrue((org3 in delegations[READER]))
    assertTrue((org1 in delegations[READER][org3]))
    s3_remove_delegation(READER, org1, receiver=org2)
    delegations = auth.s3_get_delegations(org1)
    assertNotEqual(delegations, None)
    assertTrue(isinstance(delegations, Storage))
    assertEqual(delegations.keys(), [])
    delegations = auth.user.delegations
    assertEqual(delegations.keys(), [])
    pr_remove_affiliation(org3, user, role='TestStaff')
    pr_remove_affiliation(org2, org3, role='TestOrgUnit')
    auth.s3_withdraw_role(user, READER, for_pe=org3)
