Repository: akvo/akvo-rsr

Issue:
Ensure UP app only lists projects that user has access



Discussion:

Resolving patch:
diff --git a/akvo/rsr/views/account.py b/akvo/rsr/views/account.py
--- a/akvo/rsr/views/account.py
+++ b/akvo/rsr/views/account.py
@@ -244,7 +244,7 @@ def api_key_xml_response(user, orgs):
     api_key_element.text = ApiKey.objects.get_or_create(user=user)[0].key
 
     # Published and editable projects
-    projects = orgs.all_projects().published()
+    projects = user.my_projects.published()
     pub_projs_element = etree.SubElement(xml_root, "published_projects")
     edit_projs_element = etree.SubElement(xml_root, "allow_edit_projects")
     for project in projects:
@@ -274,7 +274,7 @@ def api_key_json_response(user, orgs):
     response_data["api_key"] = ApiKey.objects.get_or_create(user=user)[0].key
 
     # Published projects
-    projects = orgs.all_projects().published()
+    projects = user.my_projects().published()
     response_data["published_projects"] = [p.id for p in projects]
 
     # Editable projects


Test patch:
diff --git a/akvo/rsr/tests/base.py b/akvo/rsr/tests/base.py
--- a/akvo/rsr/tests/base.py
+++ b/akvo/rsr/tests/base.py
@@ -9,7 +9,7 @@
 
 from akvo.rsr.models import (
     User, Employment, Organisation, Project, RelatedProject, Partnership, PublishingStatus,
-    Report, ProjectUpdate, ProjectHierarchy
+    Report, ProjectUpdate, ProjectHierarchy, ProjectRole
 )
 from akvo.utils import check_auth_groups
 
@@ -115,6 +115,11 @@ def make_employment(user, org, group_name):
         group = Group.objects.get(name=group_name)
         return Employment.objects.create(user=user, organisation=org, group=group, is_approved=True)
 
+    @staticmethod
+    def make_project_role(user, project, group_name):
+        group = Group.objects.get(name=group_name)
+        return ProjectRole.objects.create(user=user, project=project, group=group)
+
     @staticmethod
     def create_contributor(title, lead_project):
         contributor = BaseTestCase.create_project(title)
diff --git a/akvo/rsr/tests/up/test_up.py b/akvo/rsr/tests/up/test_up.py
--- a/akvo/rsr/tests/up/test_up.py
+++ b/akvo/rsr/tests/up/test_up.py
@@ -87,6 +87,33 @@ def test_get_api_key_excludes_unapproved_employment_projects(self):
         self.assertEqual(data['published_projects'], [self.project.id])
         self.assertEqual(data['organisations'], [self.org.id])
 
+    def test_get_api_key_handles_project_roles(self):
+        # Given
+        # New project that uses project roles, and user has no role
+        project_1 = self.create_project('Test Foo Bar Project')
+        project_1.use_project_roles = True
+        project_1.save()
+        self.make_partner(project_1, self.org, 2)
+        # New project that where user has a role
+        project_2 = self.create_project('Test Test Project')
+        project_2.use_project_roles = True
+        project_2.save()
+        self.make_project_role(self.user, project_2, 'Users')
+
+        # When
+        response = self.c.post('/auth/token/?format=json',
+                               {'username': 'testuser@akvo.org', 'password': 'TestPassword'})
+
+        # Then
+        data = response.json()
+        self.assertEqual(sorted(data),
+                         sorted(['username', 'user_id', 'organisations',
+                                 'allow_edit_projects', 'api_key',
+                                 'published_projects']))
+        self.assertEqual(set(data['published_projects']), {self.project.id, project_2.id})
+        self.assertNotIn(project_1.id, data['published_projects'])
+        self.assertEqual(data['organisations'], [self.org.id])
+
     def test_get_project_information(self):
         """
         Test getting project information needed by Up.