'Test has_permission with record approval'

def testHasPermissionWithRecordApproval(self):

    db = current.db
    auth = current.auth
    acl = auth.permission
    s3db = current.s3db
    settings = current.deployment_settings
    has_permission = auth.s3_has_permission
    AUTHENTICATED = auth.get_system_roles().AUTHENTICATED
    approval = settings.get_auth_record_approval()
    approval_required = settings.get_auth_record_approval_required_for()
    settings.auth.record_approval = True
    settings.auth.record_approval_required_for = []
    assertTrue = self.assertTrue
    assertFalse = self.assertFalse
    try:
        auth.s3_impersonate('admin@example.com')
        otable = s3db.org_organisation
        otable.approved_by.default = None
        org = Storage(name='Test    Approval    Organisation')
        org_id = otable.insert(**org)
        assertTrue((org_id > 0))
        org.update(id=org_id)
        s3db.update_super(otable, org)
        auth.s3_impersonate('normaluser@example.com')
        permitted = has_permission('read', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('update', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('delete', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('review', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('approve', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('reject', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        settings.auth.record_approval_required_for = ['org_organisation']
        auth.s3_impersonate('normaluser@example.com')
        permitted = has_permission('read', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('update', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('delete', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission(['read', 'review'], otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('review', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('approve', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('reject', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        db((otable.id == org_id)).update(owned_by_user=auth.user.id)
        auth.s3_impersonate('normaluser@example.com')
        permitted = has_permission('read', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('update', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('delete', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('review', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('approve', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('reject', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        db((otable.id == org_id)).update(owned_by_user=None)
        acl.update_acl(AUTHENTICATED, c='org', uacl=((acl.READ | acl.REVIEW) | acl.APPROVE), oacl=(((acl.READ | acl.UPDATE) | acl.REVIEW) | acl.APPROVE))
        acl.update_acl(AUTHENTICATED, t='org_organisation', uacl=(((acl.READ | acl.CREATE) | acl.REVIEW) | acl.APPROVE), oacl=(((acl.READ | acl.UPDATE) | acl.REVIEW) | acl.APPROVE))
        auth.s3_impersonate('normaluser@example.com')
        permitted = has_permission('read', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('update', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('delete', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission(['read', 'review'], otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('review', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('approve', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('reject', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        auth.s3_impersonate('admin@example.com')
        permitted = has_permission('read', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        resource = s3db.resource(otable, id=org_id, unapproved=True)
        resource.approve()
        auth.s3_impersonate('normaluser@example.com')
        permitted = has_permission('review', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('approve', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        permitted = has_permission('reject', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
        acl.update_acl(AUTHENTICATED, c='org', uacl=acl.READ, oacl=(acl.READ | acl.UPDATE))
        acl.update_acl(AUTHENTICATED, t='org_organisation', uacl=(acl.READ | acl.CREATE), oacl=(acl.READ | acl.UPDATE))
        auth.s3_impersonate('normaluser@example.com')
        permitted = has_permission('read', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('update', otable, record_id=org_id, c='org', f='organisation')
        assertTrue(permitted)
        permitted = has_permission('delete', otable, record_id=org_id, c='org', f='organisation')
        assertFalse(permitted)
    finally:
        settings.auth.record_approval = approval
        settings.auth.record_approval_required_for = approval_required
        auth.s3_impersonate(None)
