add tests

tests/conftest.py

@@ -140,6 +140,17 @@ def groups(superuser, manager, planner, volunteer):
     return managers, planners, volunteers
 
 
+@pytest.fixture
+def hr_group(volunteer):
+    hr_group = Group.objects.create(name="HR")
+    assign_perm("core.view_userprofile", hr_group)
+    assign_perm("core.add_userprofile", hr_group)
+    assign_perm("core.change_userprofile", hr_group)
+    assign_perm("core.delete_userprofile", hr_group)
+    hr_group.user_set.add(volunteer)
+    return hr_group
+
+
 @pytest.fixture
 def event(groups, service_event_type, planner, tz):
     managers, planners, volunteers = groups

tests/core/test_views_userprofile.py

@@ -113,3 +113,24 @@ def test_userprofile_delete(self, django_app, groups, volunteer, manager):
         assert response.status_code == 302
         with pytest.raises(UserProfile.DoesNotExist):
             UserProfile.objects.get(email=userprofile.email).exists()
+
+    def test_userprofile_edit_by_hr_allowed(self, django_app, volunteer, hr_group, groups):
+        managers, planners, volunteers = groups
+        form = django_app.get(
+            reverse("core:userprofile_edit", kwargs={"pk": volunteer.id}), user=volunteer
+        ).form
+        form["groups"].force_value([volunteers.id])
+        response = form.submit()
+        assert response.status_code == 302
+        assert set(volunteer.groups.all()) == {volunteers}
+
+    def test_userprofile_edit_by_hr_forbidden(self, django_app, volunteer, hr_group, groups):
+        managers, planners, volunteers = groups
+        assert set(volunteer.groups.all()) == {hr_group, volunteers}
+        form = django_app.get(
+            reverse("core:userprofile_edit", kwargs={"pk": volunteer.id}), user=volunteer
+        ).form
+        form["groups"].force_value([managers.id])
+        response = form.submit()
+        assert response.status_code == 200
+        assert set(volunteer.groups.all()) == {hr_group, volunteers}