fix "AttributeError: 'Request' object has no attribute 'user'"; add 1 test case for apijson-head

zhangchunlin · zhangchunlin · commit 9461f446b9f7 · 2019-10-11T15:42:35.000+08:00
diff --git a/tests/test.py b/tests/test.py
@@ -864,4 +864,15 @@ def test_apijson_head():
     >>> d = json_loads(r.data)
     >>> print(d)
     {'code': 400, 'msg': "no login user for role 'ADMIN'"}
+
+    >>> #apijson head, without user and @role
+    >>> data ='''{
+    ...     "privacy": {
+    ...         "id": 1
+    ...     }
+    ... }'''
+    >>> r = handler.post('/apijson/head', data=data, middlewares=[])
+    >>> d = json_loads(r.data)
+    >>> print(d)
+    {'code': 400, 'msg': "role 'UNKNOWN' not have permission HEAD for 'privacy'"}
     """
diff --git a/uliweb_apijson/apijson/views.py b/uliweb_apijson/apijson/views.py
@@ -112,12 +112,12 @@ def _get_one(self,key):
         roles = GET.get("roles")
         permission_check_ok = False
         if not params_role:
-            if hasattr(request,"user"):
+            if hasattr(request,"user") and request.user:
                 params_role = "LOGIN"
             else:
                 params_role = "UNKNOWN"
         elif params_role != "UNKNOWN":
-            if not hasattr(request,"user"):
+            if not (hasattr(request,"user") and request.user):
                 return json({"code":400,"msg":"no login user for role '%s'"%(params_role)})
         if params_role not in roles:
             return json({"code":400,"msg":"'%s' not accessible by role '%s'"%(model_name,params_role)})
@@ -290,15 +290,15 @@ def _head(self,key):
         roles = HEAD.get("roles")
         permission_check_ok = False
         if not params_role:
-            if request.user:
+            if hasattr(request,"user") and request.user:
                 params_role = "LOGIN"
             else:
                 params_role = "UNKNOWN"
         if params_role not in roles:
             return json({"code":400,"msg":"role '%s' not have permission HEAD for '%s'"%(params_role,model_name)})
         if params_role == "UNKNOWN":
             permission_check_ok = True
-        elif not hasattr(request,"user"):
+        elif not (hasattr(request,"user") and request.user):
             return json({"code":400,"msg":"no login user for role '%s'"%(params_role)})
         elif functions.has_role(request.user,params_role):
             permission_check_ok = True
@@ -387,7 +387,7 @@ def _post_one(self,key,tag):
             if roles:
                 for role in roles:
                     if role == "OWNER":
-                        if request.user:
+                        if hasattr(request,"user") and request.user:
                             permission_check_ok = True
                             if user_id_field:
                                 params[user_id_field] = request.user.id
@@ -506,7 +506,7 @@ def _put_one(self,key,tag):
             if roles:
                 for role in roles:
                     if role == "OWNER":
-                        if request.user:
+                        if hasattr(request,"user") and request.user:
                             if user_id_field:
                                 if obj.to_dict().get(user_id_field)==request.user.id:
                                     permission_check_ok = True
@@ -627,7 +627,7 @@ def _delete_one(self,key,tag):
             if roles:
                 for role in roles:
                     if role == "OWNER":
-                        if request.user:
+                        if hasattr(request,"user") and request.user:
                             if user_id_field:
                                 if obj.to_dict().get(user_id_field)==request.user.id:
                                     permission_check_ok = True
