From 50c66458fc09ab96ff4b02e85cf9a3b577b24d34 Mon Sep 17 00:00:00 2001
From: Gabriel Augendre <gabriel@augendre.info>
Date: Mon, 14 Nov 2022 21:15:35 +0100
Subject: [PATCH] Validate notes access

---
 src/character/tests/test_access.py | 32 +++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/src/character/tests/test_access.py b/src/character/tests/test_access.py
index 181a6a3..b2c74c6 100644
--- a/src/character/tests/test_access.py
+++ b/src/character/tests/test_access.py
@@ -8,18 +8,20 @@ from party.models import Party
 
 @pytest.mark.django_db
 def test_can_access_own_character(client):
-    # Create a user
     player = User.objects.create_user("username", password="password")
 
-    character = baker.make(Character, player=player)
+    notes = "Some notes"
+    character = baker.make(Character, player=player, notes=notes)
     client.force_login(player)
     res = client.get(character.get_absolute_url())
     assert res.status_code == 200
 
+    body = res.content.decode("utf-8")
+    assert notes in body
+
 
 @pytest.mark.django_db
 def test_cant_access_random_character(client):
-    # Create a user
     player = User.objects.create_user("user", password="password")
     other = User.objects.create_user("other", password="password")
 
@@ -31,15 +33,35 @@ def test_cant_access_random_character(client):
 
 @pytest.mark.django_db
 def test_can_access_character_in_party(client):
-    # Create a user
     player = User.objects.create_user("user", password="password")
     friend = User.objects.create_user("friend", password="password")
 
     character = baker.make(Character, player=player)
-    friend_character = baker.make(Character, player=friend)
+    notes = "Some notes"
+    friend_character = baker.make(Character, player=friend, notes=notes)
     party = baker.make(Party)
     party.characters.add(character)
     party.characters.add(friend_character)
     client.force_login(player)
+    res = client.get(friend_character.get_absolute_url())
+    assert res.status_code == 200
+
+    body = res.content.decode("utf-8")
+    assert notes not in body
+
+
+@pytest.mark.django_db
+def test_game_master_can_access_character_in_party(client):
+    player = User.objects.create_user("user", password="password")
+    gm = User.objects.create_user("gm", password="password")
+
+    notes = "Some notes"
+    character = baker.make(Character, player=player, notes=notes)
+    party = baker.make(Party, game_master=gm)
+    party.characters.add(character)
+    client.force_login(gm)
     res = client.get(character.get_absolute_url())
     assert res.status_code == 200
+
+    body = res.content.decode("utf-8")
+    assert notes in body