TMSS-138: Improved permission tests

SAS/TMSS/test/t_tmssapp_specification_permissions.py

@@ -91,18 +91,23 @@ class CycleTest(rest_framework.test.APITransactionTestCase):
         res = client.post('%s/cycle/' % BASE_URI, data=self.test_data_2)
         self.assertEqual(res.status_code, 201)
 
-        #self.assertEqual(0, len(models.Cycle.objects.all()))
-        #models.Cycle.objects.create(**self.test_data_1)
-        #self.assertEqual(7, len(models.Cycle.objects.all()))
 
-        #self.user.groups.set([self.support_group])
-        #self.user.save()
+    def test_Cycle_cannot_be_deleted_without_group(self):
 
+        self.user.groups.set([])
+
+        # add
+        count = len(models.Cycle.objects.all())
+        models.Cycle.objects.create(**self.test_data_2)
+        url = '%s/cycle/%s/' % (BASE_URI, self.test_data_2['name'])
+        self.assertEqual(count+1, len(models.Cycle.objects.all()))
 
-        #self.assertTrue(self.user.has_perm('tmssapp.change_cycle'))
-        #models.Cycle.objects.create(**self.test_data_1)
+        # delete
+        res = client.delete(url)
+        self.assertEqual(res.status_code, 403)
+        self.assertEqual(count + 1, len(models.Cycle.objects.all()))
 
-    def test_Cycle_can_only_be_deleted_by_admin(self):
+    def test_Cycle_can_be_deleted_by_admin(self):
 
         self.user.groups.set([self.admin_group])
 
@@ -115,5 +120,4 @@ class CycleTest(rest_framework.test.APITransactionTestCase):
         # delete
         res = client.delete(url)
         self.assertEqual(res.status_code, 204)
-        new_count = len(models.Cycle.objects.all())
         self.assertEqual(count, len(models.Cycle.objects.all()))
\ No newline at end of file