Resolve "Updating own past feedback sets other tutors assignment to is_done=True"

Closes #155 (closed)

core/tests/test_feedback.py

@@ -93,7 +93,7 @@ class FeedbackCreateTestCase(APITestCase):
 
     @classmethod
     def setUpTestData(cls):
-        cls.url = '/api/feedback/'
+        cls.url = lambda self: f'/api/assignment/{self.assignment.pk}/finish/'
         cls.user_factory = GradyUserFactory()
         cls.tutor = cls.user_factory.make_tutor(password='p')
         cls.exam = make_exams(exams=[{
@@ -138,7 +138,7 @@ class FeedbackCreateTestCase(APITestCase):
 
         }
         self.assertEqual(Feedback.objects.count(), 0)
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
         self.assertEqual(Feedback.objects.count(), 0)
 
@@ -149,7 +149,7 @@ class FeedbackCreateTestCase(APITestCase):
             'of_submission': self.assignment.submission.pk
         }
         self.assertEqual(Feedback.objects.count(), 0)
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertEqual(Feedback.objects.count(), 0)
 
@@ -159,7 +159,7 @@ class FeedbackCreateTestCase(APITestCase):
             'is_final': True,
             'of_submission': self.assignment.submission.pk
         }
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(status.HTTP_403_FORBIDDEN, response.status_code)
         self.assertEqual(Feedback.objects.count(), 0)
 
@@ -169,7 +169,7 @@ class FeedbackCreateTestCase(APITestCase):
             'is_final': False,
             'of_submission': self.assignment.submission.pk
         }
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
         self.assertEqual(Feedback.objects.count(), 0)
 
@@ -180,7 +180,7 @@ class FeedbackCreateTestCase(APITestCase):
             'of_submission': self.assignment.submission.pk
         }
         self.assertEqual(Feedback.objects.count(), 0)
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertEqual(Feedback.objects.count(), 0)
 
@@ -191,7 +191,7 @@ class FeedbackCreateTestCase(APITestCase):
             'of_submission': self.assignment.submission.pk
         }
         self.assertEqual(Feedback.objects.count(), 0)
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
         self.assertEqual(Feedback.objects.count(), 0)
 
@@ -209,7 +209,7 @@ class FeedbackCreateTestCase(APITestCase):
             }
         }
         self.assertEqual(self.fst_label.feedback.count(), 0)
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
         self.fst_label.refresh_from_db()
         self.snd_label.refresh_from_db()
@@ -229,7 +229,7 @@ class FeedbackCreateTestCase(APITestCase):
                 }
             }
         }
-        self.client.post(self.url, data, format='json')
+        self.client.post(self.url(), data, format='json')
         object_score = self.sub.feedback.score
         self.assertEqual(object_score, 0.5)
 
@@ -245,7 +245,7 @@ class FeedbackCreateTestCase(APITestCase):
                 }
             }
         }
-        self.client.post(self.url, data, format='json')
+        self.client.post(self.url(), data, format='json')
         object_score = self.sub.feedback.score
         self.assertEqual(object_score, 5)
 
@@ -262,7 +262,7 @@ class FeedbackCreateTestCase(APITestCase):
             }
         }
         self.assertEqual(FeedbackComment.objects.count(), 0)
-        response = self.client.post(self.url, data, format='json')
+        response = self.client.post(self.url(), data, format='json')
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
         self.assertEqual(FeedbackComment.objects.count(), 1)
 
@@ -278,7 +278,7 @@ class FeedbackCreateTestCase(APITestCase):
                 }
             }
         }
-        self.client.post(self.url, data, format='json')
+        self.client.post(self.url(), data, format='json')
         comment = FeedbackComment.objects.first()
         self.assertEqual(comment.of_tutor, self.tutor)
         self.assertEqual(comment.text, 'Nice meth!')
@@ -298,8 +298,8 @@ class FeedbackCreateTestCase(APITestCase):
             }
         }
         self.assignment.delete()
-        response = self.client.post(self.url, data, format='json')
-        self.assertEqual(status.HTTP_403_FORBIDDEN, response.status_code)
+        response = self.client.post(self.url(), data, format='json')
+        self.assertEqual(status.HTTP_404_NOT_FOUND, response.status_code)
 
     def test_cannot_create_with_someoneelses_assignment(self):
         data = {
@@ -314,8 +314,9 @@ class FeedbackCreateTestCase(APITestCase):
         }
         other_tutor = self.user_factory.make_tutor('Berta')
         self.client.force_authenticate(other_tutor)
-        response = self.client.post(self.url, data, format='json')
-        self.assertEqual(status.HTTP_403_FORBIDDEN, response.status_code)
+        response = self.client.post(self.url(), data, format='json')
+        # returns 404 since the other users assignment is not visible to this one
+        self.assertEqual(status.HTTP_404_NOT_FOUND, response.status_code)
 
     def test_can_create_multiple_feedback_comments(self):
         data = {
@@ -333,7 +334,7 @@ class FeedbackCreateTestCase(APITestCase):
                 }
             }
         }
-        self.client.post(self.url, data, format='json')
+        self.client.post(self.url(), data, format='json')
         first_comment = FeedbackComment.objects.get(text='Nice meth!')
         self.assertEqual(first_comment.of_tutor, self.tutor)
         self.assertIsNotNone(first_comment.created)