Snapshot: alpha-2026-9

backend/authentication/tests/test_auth.py

@@ -1,4 +1,5 @@
 import json
+import base64
 
 from django.test import Client, RequestFactory
 from nacl.encoding import HexEncoder
@@ -6,6 +7,7 @@ from nacl.signing import SigningKey
 
 from authentication.models import ToolshedUser, KnownIdentity
 from authentication.tests import UserTestMixin, SignatureAuthClient, DummyExternalUser, ToolshedTestCase
+from files.models import File
 
 
 class AuthorizationTestCase(ToolshedTestCase):
@@ -240,6 +242,7 @@ class UserApiTestCase(UserTestMixin, ToolshedTestCase):
         self.assertEqual(reply.json()['username'], 'testuser1')
         self.assertEqual(reply.json()['domain'], 'example.com')
         self.assertEqual(reply.json()['email'], 'test1@abc.de')
+        self.assertIsNone(reply.json()['profile_picture'])
 
     def test_user_info2(self):
         target = "/auth/user/"
@@ -249,6 +252,50 @@ class UserApiTestCase(UserTestMixin, ToolshedTestCase):
         self.assertEqual(reply.status_code, 200)
         self.assertEqual(reply.json()['username'], 'testuser1')
         self.assertEqual(reply.json()['domain'], 'example.com')
+        self.assertIsNone(reply.json()['profile_picture'])
+
+    def test_user_info_patch_profile_picture(self):
+        content = base64.b64encode(b'user-profile-image').decode('utf-8')
+        reply = self.client.patch('/auth/user/', self.f['local_user1'], {
+            'profile_picture': {
+                'data': content,
+                'mime_type': 'image/png'
+            }
+        })
+        self.assertEqual(reply.status_code, 200)
+        self.assertTrue(reply.json()['profile_picture'])
+        self.assertEqual(reply.json()['profile_picture']['mime_type'], 'image/png')
+        self.assertEqual(File.objects.count(), 1)
+        self.f['local_user1'].refresh_from_db()
+        self.assertIsNotNone(self.f['local_user1'].profile_picture)
+
+    def test_user_info_patch_profile_picture_clear(self):
+        encoded_content = base64.b64encode(b'user-profile-image').decode('utf-8')
+        test_file = File.objects.create(mime_type='image/png', data=encoded_content)
+        self.f['local_user1'].profile_picture = test_file
+        self.f['local_user1'].save()
+
+        reply = self.client.patch('/auth/user/', self.f['local_user1'], {'profile_picture': None})
+        self.assertEqual(reply.status_code, 200)
+        self.assertIsNone(reply.json()['profile_picture'])
+        self.f['local_user1'].refresh_from_db()
+        self.assertIsNone(self.f['local_user1'].profile_picture)
+        self.assertFalse(File.objects.filter(id=test_file.id).exists())
+
+    def test_user_info_patch_profile_picture_invalid(self):
+        reply = self.client.patch('/auth/user/', self.f['local_user1'], {'profile_picture': 'invalid'})
+        self.assertEqual(reply.status_code, 400)
+
+    def test_user_info_patch_profile_picture_id(self):
+        encoded_content = base64.b64encode(b'user-profile-image-by-id').decode('utf-8')
+        test_file = File.objects.create(mime_type='image/jpeg', data=encoded_content)
+        reply = self.client.patch('/auth/user/', self.f['local_user1'], {'profile_picture_id': test_file.id})
+        self.assertEqual(reply.status_code, 200)
+        self.assertEqual(reply.json()['profile_picture']['id'], test_file.id)
+
+    def test_user_info_patch_profile_picture_id_not_found(self):
+        reply = self.client.patch('/auth/user/', self.f['local_user1'], {'profile_picture_id': 999999})
+        self.assertEqual(reply.status_code, 400)
 
     def test_user_info_fail(self):
         reply = self.anonymous_client.get('/auth/user/')
@@ -308,6 +355,52 @@ class UserApiTestCase(UserTestMixin, ToolshedTestCase):
         self.assertEqual(reply.status_code, 403)
 
 
+class UserProfileByHandleApiTestCase(UserTestMixin, ToolshedTestCase):
+    """Tests for GET /auth/user/<handle>/ - viewing another (friend) user's public profile."""
+
+    def setUp(self):
+        super().setUp()
+        self.prepare_users()
+        self.f['local_user1'].friends.add(self.f['ext_user1'].public_identity)
+        self.anonymous_client = Client(SERVER_NAME='testserver')
+        self.client = SignatureAuthClient()
+
+    def test_view_friend_profile(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.client.get(target, self.f['ext_user1'])
+        self.assertEqual(reply.status_code, 200)
+        self.assertEqual(reply.json()['username'], 'testuser1')
+        self.assertEqual(reply.json()['domain'], 'example.com')
+        self.assertIsNone(reply.json()['profile_picture'])
+        self.assertNotIn('email', reply.json())
+
+    def test_view_own_profile_via_handle(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.client.get(target, self.f['local_user1'])
+        self.assertEqual(reply.status_code, 200)
+        self.assertEqual(reply.json()['username'], 'testuser1')
+
+    def test_view_profile_not_friend(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.client.get(target, self.f['ext_user2'])
+        self.assertEqual(reply.status_code, 403)
+
+    def test_view_profile_unknown_user(self):
+        target = '/auth/user/nosuchuser@example.com/'
+        reply = self.client.get(target, self.f['ext_user1'])
+        self.assertEqual(reply.status_code, 404)
+
+    def test_view_profile_bad_handle(self):
+        target = '/auth/user/notahandle/'
+        reply = self.client.get(target, self.f['ext_user1'])
+        self.assertEqual(reply.status_code, 400)
+
+    def test_view_profile_unauthenticated(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.anonymous_client.get(target)
+        self.assertEqual(reply.status_code, 403)
+
+
 class FriendApiTestCase(UserTestMixin, ToolshedTestCase):
     def setUp(self):
         super().setUp()
@@ -319,26 +412,26 @@ class FriendApiTestCase(UserTestMixin, ToolshedTestCase):
         self.client = SignatureAuthClient()
 
     def test_friend_local(self):
-        reply = self.client.get('/api/friends/', self.f['local_user1'])
+        reply = self.client.get('/api/v1/friends/', self.f['local_user1'])
         self.assertEqual(reply.status_code, 200)
 
     def test_friend_external(self):
-        reply = self.client.get('/api/friends/', self.f['ext_user1'])
+        reply = self.client.get('/api/v1/friends/', self.f['ext_user1'])
         self.assertEqual(reply.status_code, 200)
 
     def test_friend_fail(self):
-        reply = self.anonymous_client.get('/api/friends/')
+        reply = self.anonymous_client.get('/api/v1/friends/')
         self.assertEqual(reply.status_code, 403)
 
     def test_friend_fail2(self):
-        target = "/api/friends/"
+        target = "/api/v1/friends/"
         signature = self.f['local_user1'].sign("http://testserver2" + target)
         header = {'HTTP_AUTHORIZATION': 'Signature ' + str(self.f['local_user1']) + ':' + signature}
         reply = self.anonymous_client.get(target, **header)
         self.assertEqual(reply.status_code, 403)
 
     def test_friend_fail3(self):
-        target = "/api/friends/"
+        target = "/api/v1/friends/"
         unknown_user = DummyExternalUser('extuser3', 'external.org', False)
         signature = unknown_user.sign("http://testserver" + target)
         header = {'HTTP_AUTHORIZATION': 'Signature ' + str(unknown_user) + ':' + signature}
@@ -346,7 +439,7 @@ class FriendApiTestCase(UserTestMixin, ToolshedTestCase):
         self.assertEqual(reply.status_code, 403)
 
     def test_friend_fail4(self):
-        target = "/api/friends/"
+        target = "/api/v1/friends/"
         signature = self.f['local_user1'].sign("http://testserver" + target)
         header = {'HTTP_AUTHORIZATION': 'Auth ' + str(self.f['local_user1']) + ':' + signature}
         reply = self.anonymous_client.get(target, **header)