Add device security profiles (#1806)

src/tests/api/test_auth.py

@@ -76,3 +76,16 @@ def test_device_auth_revoked(client, device):
     resp = client.get('/api/v1/organizers/')
     assert resp.status_code == 401
     assert str(resp.data['detail']) == "Device access has been revoked."
+
+
+@pytest.mark.django_db
+def test_device_auth_security_profile(client, device):
+    client.credentials(HTTP_AUTHORIZATION='Device ' + device.api_token)
+    device.security_profile = "pretixscan"
+    device.save()
+    resp = client.get('/api/v1/organizers/dummy/giftcards/')
+    assert resp.status_code == 403
+    device.security_profile = "pretixpos"
+    device.save()
+    resp = client.get('/api/v1/organizers/dummy/giftcards/')
+    assert resp.status_code == 200

src/tests/api/test_devices.py

@@ -38,7 +38,8 @@ TEST_DEV_RES = {
     "hardware_brand": "Zebra",
     "hardware_model": "TC25",
     "software_brand": "pretixSCAN",
-    "software_version": "1.5.1"
+    "software_version": "1.5.1",
+    "security_profile": "full"
 }
 
 

src/tests/control/test_devices.py

@@ -50,8 +50,8 @@ def test_create_device(event, admin_user, admin_team, client):
     resp = client.post('/control/organizer/dummy/device/add', {
         'name': 'Foo',
         'limit_events': str(event.pk),
+        'security_profile': 'full',
     }, follow=True)
-    print(resp.status_code, resp.content)
     with scopes_disabled():
         d = Device.objects.last()
         assert d.name == 'Foo'
@@ -66,6 +66,7 @@ def test_update_device(event, admin_user, admin_team, device, client):
     client.post('/control/organizer/dummy/device/{}/edit'.format(device.pk), {
         'name': 'Cashdesk 2',
         'limit_events': str(event.pk),
+        'security_profile': 'full',
     }, follow=True)
     device.refresh_from_db()
     assert device.name == 'Cashdesk 2'