feat: backoffice setup

backoffice/tests/test_access.py

@@ -0,0 +1,31 @@
+from django.contrib.auth.models import User
+from django.test import TestCase
+from django.urls import reverse
+
+
+class TestBackofficeAccess(TestCase):
+    def test_anonymous_user_is_redirected_to_login(self):
+        response = self.client.get(reverse('backoffice:dashboard'))
+        assert response.status_code == 302
+        assert reverse('users:login') in response.url
+
+    def test_authenticated_non_staff_user_gets_forbidden(self):
+        user = User.objects.create_user('luke', 'luke@rebels.com', 'ihatesand', is_staff=False)
+        self.client.force_login(user)
+
+        response = self.client.get(reverse('backoffice:dashboard'))
+        assert response.status_code == 403
+
+    def test_superuser_can_access_dashboard(self):
+        user = User.objects.create_superuser('vader', 'vader@empire.com', 'ihatesand')
+        self.client.force_login(user)
+
+        response = self.client.get(reverse('backoffice:dashboard'))
+        assert response.status_code == 200
+
+    def test_staff_without_specific_permission_gets_forbidden_on_product_list(self):
+        user = User.objects.create_user('han', 'han@falcon.com', 'ihatesand', is_staff=True)
+        self.client.force_login(user)
+
+        response = self.client.get(reverse('backoffice:product_list'))
+        assert response.status_code == 403