fix a load of test

rad/static/css/anatomy.css

@@ -1057,7 +1057,7 @@ table .peninsula-trainee::before {
   user-select: none;
 }
 
-.form-control {
+.form-control, .form-control:focus, .form-control option {
   background-color: unset;
   color: unset
-}
+}

rad/tests/test_helpers.py

@@ -340,11 +340,11 @@ class ExamTester:
             search_exam = (
                 cid_scores_soup.find("div", {"id": "exam-assigned"})
                 .find("ul", {"class": self.exam.app_name.lower()})
-                .find_all("li", attrs={"data-exam-id": self.exam.pk})
+                .find("li", attrs={"data-exam-id": self.exam.pk})
             )
             assert search_exam
             assert self.exam.name in str(search_exam)
-            assert "Active" in str(search_exam)
+            assert len(search_exam.find("button", {"class": "start-button"})) > 0
             # assert "Active" in assigned_exams # check it is active
 
             invalid_exam = cid_scores_soup.find_all(

rad/tests/test_user_access.py

@@ -0,0 +1,91 @@
+
+from django.urls import reverse
+
+from rich.pretty import pprint
+
+from bs4 import BeautifulSoup
+
+from django.contrib.auth.models import Group
+import pytest
+
+
+@pytest.fixture
+def create_users(db, django_user_model):
+    user1 = django_user_model.objects.create_user(
+        "user1", "user1@user.com", "password"
+    )
+    user2 = django_user_model.objects.create_user(
+        "user2", "user2@user.com", "password"
+    )
+    #g = Group.objects.create(name="cid_user_manager")
+    #g.save()
+    #user.groups.add(g)
+    return user1, user2
+
+@pytest.fixture
+def create_cid_manager(db, django_user_model):
+    user = django_user_model.objects.create_user(
+        "cid_user", "cid@user.com", "password1234"
+    )
+    g = Group.objects.create(name="cid_user_manager")
+    g.save()
+    user.groups.add(g)
+    return user
+
+def test_profile_access_and_management(db, client, create_users, create_cid_manager):
+
+    response = client.get(reverse(f"profile"))
+
+    # should redirect to login page
+    assert response.status_code == 302
+    assert "accounts/login/" in response.url
+    # Test login
+
+    client.login(username="user1", password="password")
+
+    response = client.get(reverse(f"profile"))
+
+    assert response.status_code == 200
+
+    soup = BeautifulSoup(response.content, "html.parser")
+
+    assert soup.find(id="username").text == "user1"
+    assert soup.find(id="email").text == "user1@user.com"
+
+    # Check the links to change password and update profile
+    password_url = soup.find(id="password-change")["href"]
+    print(password_url)
+    password_change_response = client.get(password_url)
+    assert password_change_response.status_code == 200
+
+    password_soup = BeautifulSoup(password_change_response.content, "html.parser")
+    assert "Old password" in password_soup.text
+    assert "New password" in password_soup.text
+
+    update_profile = soup.find(id="update-profile-link")["href"]
+
+    assert update_profile == reverse("account_profile_update", kwargs={"slug": "user1"})
+
+    # check we can't access another users profile 
+    response_fail = client.get(reverse("account_profile_update", kwargs={"slug": "user2"}))
+    assert response_fail.status_code == 404
+    print(response_fail.content)
+
+    # And that we can access our own
+    update_profile_response = client.get(reverse("account_profile_update", kwargs={"slug": "user1"}))
+    assert update_profile_response.status_code == 200
+
+    assert "peninsula_trainee" not in BeautifulSoup(update_profile_response.content, "html.parser").text
+
+    update_response = client.post(reverse("account_profile_update", kwargs={"slug": "user1"}), {
+        "registration_number": 1234567
+    })
+    assert update_response.status_code == 302
+    # we reirect back to profile page on form submission
+    assert update_response.url == reverse("profile")
+
+    # check that the form has updated
+    update_profile_response = client.get(reverse("account_profile_update", kwargs={"slug": "user1"}))
+    assert BeautifulSoup(update_profile_response.content, "html.parser").find(id="id_registration_number")["value"]
+
+

rad/views.py

@@ -636,6 +636,8 @@ class UpdateUserProfileView(UpdateView):
         if request.user.is_superuser or request.user.groups.filter(name="cid_user_manager").exists():
             self.fields = ["supervisor", "grade", "registration_number", "peninsula_trainee"]
         # Check permissions for the request.user here
+        elif request.user != self.get_object().user:
+            raise Http404
         elif request.user.userprofile.peninsula_trainee:
             self.fields = ["supervisor", "grade", "registration_number"]
 
@@ -645,9 +647,14 @@ class UpdateUserProfileView(UpdateView):
 
 
     def get_success_url(self):
-        view_name = "account_profile"
-        # No need for reverse_lazy here, because it's called inside the method
-        return reverse(view_name, kwargs={"slug": self.object.username})
+        if self.request.user.is_superuser or self.request.user.groups.filter(name="cid_user_manager").exists():
+            view_name = "account_profile"
+            # No need for reverse_lazy here, because it's called inside the method
+            return reverse(view_name, kwargs={"slug": self.object.username})
+        else:
+            return reverse("profile")
+
+
 
 # class UpdateUser(TemplateView):
 #