Initial commit

backend/apps/users/tests.py

@@ -0,0 +1,144 @@
+from django.test import TestCase
+from django.contrib.auth import get_user_model
+from rest_framework.test import APIClient
+from rest_framework import status
+from .models import RegistrationDomainRule, RegistrationRestrictionSetting
+from apps.events.models import Event, TaskArea, Shift, ShiftSignup
+
+User = get_user_model()
+
+class UserRegistrationTests(TestCase):
+    def setUp(self):
+        self.client = APIClient()
+
+    def test_domain_restriction_enforcement(self):
+        # Enable domain restriction
+        setting = RegistrationRestrictionSetting.get_solo()
+        setting.is_restriction_enabled = True
+        setting.save()
+
+        # Add rule for verein.de
+        RegistrationDomainRule.objects.create(domain='verein.de', is_active=True)
+
+        # Attempt registration with non-allowed domain
+        res = self.client.post('/api/users/register/', {
+            'username': 'testuser',
+            'email': 'user@otherdomain.com',
+            'password': 'password123',
+            'display_name': 'Test User'
+        })
+        self.assertEqual(res.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn('Registrierungen sind derzeit nur für folgende E-Mail-Domains erlaubt', str(res.data))
+
+        # Attempt registration with allowed domain
+        res_ok = self.client.post('/api/users/register/', {
+            'username': 'alloweduser',
+            'email': 'user@verein.de',
+            'password': 'password123',
+            'display_name': 'Allowed User'
+        })
+        self.assertEqual(res_ok.status_code, status.HTTP_201_CREATED)
+        self.assertIn('token', res_ok.data)
+
+    def test_guest_shift_claiming_on_registration(self):
+        # Create event, task area, shift
+        event = Event.objects.create(title="Test Event", start_date="2026-08-01", end_date="2026-08-02")
+        ta = TaskArea.objects.create(event=event, name="Tresendienst")
+        shift = Shift.objects.create(task_area=ta, title="Frühschicht", start_time="09:00", end_time="13:00")
+
+        # Guest signs up with guest_name="Max Mustermann"
+        session = self.client.session
+        session.save()
+        session_key = session.session_key
+
+        signup = ShiftSignup.objects.create(
+            shift=shift,
+            guest_name="Max Mustermann",
+            guest_session_key=session_key
+        )
+
+        # Now register user with display_name="Max Mustermann"
+        res = self.client.post('/api/users/register/', {
+            'username': 'max_mustermann',
+            'email': 'max@example.com',
+            'password': 'password123',
+            'display_name': 'Max Mustermann'
+        })
+        self.assertEqual(res.status_code, status.HTTP_201_CREATED)
+        self.assertEqual(res.data['claimed_shifts_count'], 1)
+
+        signup.refresh_from_db()
+        self.assertIsNotNone(signup.user)
+        self.assertEqual(signup.user.username, 'max_mustermann')
+        self.assertIsNone(signup.guest_name)
+
+    def test_admin_approval_workflow(self):
+        # Enable admin approval requirement
+        setting = RegistrationRestrictionSetting.get_solo()
+        setting.require_admin_approval = True
+        setting.save()
+
+        # Register user
+        res_reg = self.client.post('/api/users/register/', {
+            'username': 'pending_user',
+            'email': 'pending@example.com',
+            'password': 'password123',
+            'display_name': 'Pending User'
+        })
+        self.assertEqual(res_reg.status_code, status.HTTP_201_CREATED)
+        self.assertTrue(res_reg.data.get('requires_approval'))
+        self.assertNotIn('token', res_reg.data)
+
+        # Attempt login before approval (should be blocked)
+        res_login_fail = self.client.post('/api/users/login/', {
+            'username': 'pending_user',
+            'password': 'password123'
+        })
+        self.assertEqual(res_login_fail.status_code, status.HTTP_403_FORBIDDEN)
+
+        # Admin approves user
+        admin = User.objects.create_superuser(username='admin', email='admin@test.com', password='adminpassword')
+        self.client.force_authenticate(user=admin)
+
+        pending_user = User.objects.get(username='pending_user')
+        res_approve = self.client.post(f'/api/users/{pending_user.id}/approve/')
+        self.assertEqual(res_approve.status_code, status.HTTP_200_OK)
+
+        # Attempt login after approval (should succeed)
+        self.client.logout()
+        res_login_ok = self.client.post('/api/users/login/', {
+            'username': 'pending_user',
+            'password': 'password123'
+        })
+        self.assertEqual(res_login_ok.status_code, status.HTTP_200_OK)
+        self.assertIn('token', res_login_ok.data)
+
+    def test_guest_claim_token_and_registration_link(self):
+        admin = User.objects.create_user(username="admin_gen", email="admin_gen@test.com", password="password123", is_admin_user=True)
+        event = Event.objects.create(title="Claim Event", start_date="2026-09-01", end_date="2026-09-02")
+        ta = TaskArea.objects.create(event=event, name="Kasse")
+        shift = Shift.objects.create(task_area=ta, title="Spätschicht", start_time="18:00", end_time="22:00")
+        signup = ShiftSignup.objects.create(shift=shift, guest_name="Erika Muster")
+
+        # Admin generates claim link
+        self.client.force_authenticate(user=admin)
+        res_token = self.client.post(f'/api/users/signups/{signup.id}/generate-claim-link/')
+        self.assertEqual(res_token.status_code, status.HTTP_200_OK)
+        claim_token = res_token.data['token']
+        self.assertEqual(res_token.data['guest_name'], 'Erika Muster')
+
+        # Recipient registers using claim_token
+        self.client.logout()
+        res_reg = self.client.post('/api/users/register/', {
+            'username': 'erika_muster',
+            'email': 'erika@muster.de',
+            'password': 'password123',
+            'display_name': 'Erika Muster',
+            'claim_token': claim_token
+        })
+        self.assertEqual(res_reg.status_code, status.HTTP_201_CREATED)
+
+        signup.refresh_from_db()
+        self.assertIsNotNone(signup.user)
+        self.assertEqual(signup.user.username, 'erika_muster')
+        self.assertIsNone(signup.guest_name)