SLE bulk permission and tests

cookbook/tests/api/test_api_shopping_list_entry.py

@@ -13,7 +13,9 @@ DETAIL_URL = 'api:shoppinglistentry-detail'
 
 @pytest.fixture()
 def obj_1(space_1, u1_s1):
-    e = ShoppingListEntry.objects.create(created_by=auth.get_user(u1_s1), food=Food.objects.get_or_create(name='test 1', space=space_1)[0], space=space_1)
+    e = ShoppingListEntry.objects.create(created_by=auth.get_user(u1_s1),
+                                         food=Food.objects.get_or_create(name='test 1', space=space_1)[0],
+                                         space=space_1)
     s = ShoppingList.objects.create(created_by=auth.get_user(u1_s1), space=space_1, )
     s.entries.add(e)
     return e
@@ -21,7 +23,9 @@ def obj_1(space_1, u1_s1):
 
 @pytest.fixture
 def obj_2(space_1, u1_s1):
-    e = ShoppingListEntry.objects.create(created_by=auth.get_user(u1_s1), food=Food.objects.get_or_create(name='test 2', space=space_1)[0], space=space_1)
+    e = ShoppingListEntry.objects.create(created_by=auth.get_user(u1_s1),
+                                         food=Food.objects.get_or_create(name='test 2', space=space_1)[0],
+                                         space=space_1)
     s = ShoppingList.objects.create(created_by=auth.get_user(u1_s1), space=space_1, )
     s.entries.add(e)
     return e
@@ -79,6 +83,29 @@ def test_update(arg, request, obj_1):
         assert response['amount'] == 2
 
 
+@pytest.mark.parametrize("arg", [
+    ['a_u', 403],
+    ['g1_s1', 403],
+    ['u1_s1', 200],
+    ['a1_s1', 200],
+    ['g1_s2', 403],
+    ['u1_s2', 200],
+    ['a1_s2', 200],
+])
+def test_bulk_update(arg, request, obj_1, obj_2):
+    c = request.getfixturevalue(arg[0])
+    r = c.post(
+        reverse(LIST_URL, ) + 'bulk/',
+        {'ids': [obj_1.id, obj_2.id], 'checked': True},
+        content_type='application/json'
+    )
+    assert r.status_code == arg[1]
+    assert r
+    if r.status_code == 200:
+        obj_1.refresh_from_db()
+        assert obj_1.checked == (arg[0] == 'u1_s1')
+
+
 @pytest.mark.parametrize("arg", [
     ['a_u', 403],
     ['g1_s1', 201],

cookbook/views/api.py

@@ -1180,6 +1180,7 @@ class ShoppingListEntryViewSet(viewsets.ModelViewSet):
         detail=False,
         methods=['POST'],
         serializer_class=ShoppingListEntryBulkSerializer,
+        permission_classes=[CustomIsUser]
     )
     def bulk(self, request):
         serializer = self.serializer_class(data=request.data)