def test_reviewer_can_update_nested_comment_fields_draft_registration(self):
        user = AuthUserFactory()
        user.system_tags.append(PREREG_ADMIN_TAG)
        user.save()

        payload = {
            "data": {
                "id": self.prereg_draft_registration._id,
                "type": "draft_registrations",
                "attributes": {
                    "registration_metadata": {
                        'q7': {
                            'value': {
                                 'question': {
                                    'comments': [{'value': 'Add some clarity here.'}]
                                }
                            }
                        }
                    }
                }
            }
        }

        url = '/{}nodes/{}/draft_registrations/{}/'.format(API_BASE, self.public_project._id, self.prereg_draft_registration._id)

        res = self.app.put_json_api(url, payload, auth=user.auth, expect_errors=True)
        assert_equal(res.status_code, 200)
        assert_equal(res.json['data']['attributes']['registration_metadata']['q7']['value']['question']['comments'][0]['value'], 'Add some clarity here.')

class TestMenbibAuthViews(OsfTestCase):

    def setUp(self):
        self.app = TestApp(app)
        self.user = AuthUserFactory()
        self.app.authenticate(*self.user.auth)

    def test_menbib_oauth_start(self):
        url = api_url_for('menbib_oauth_start_user')
        res = self.app.get(url)
        assert_is_redirect(res)

    @mock.patch('website.addons.menbib.views.auth.finish_auth')
    def test_menbib_oauth_finish(self, mock_finish):
        mock_finish.return_value = AuthResult('mytokenabc', 'myrefreshabc', 'cool', '3600')
        url = api_url_for('menbib_oauth_finish')
        res = self.app.get(url)
        assert_is_redirect(res)

    def test_menbib_oauth_delete_user(self):
        self.user.add_addon('menbib')
        user_settings = self.user.get_addon('menbib')
        user_settings.access_token = '12345abc'
        assert_true(user_settings.has_auth)
        self.user.save()
        url = api_url_for('menbib_oauth_delete_user')
        res = self.app.delete(url)
        user_settings.reload()
        assert_false(user_settings.has_auth)

    def test_reviewer_cannot_update_nested_value_fields_draft_registration(self):
        user = AuthUserFactory()
        user.system_tags.append(PREREG_ADMIN_TAG)
        user.save()

        payload = {
            "data": {
                "id": self.prereg_draft_registration._id,
                "type": "draft_registrations",
                "attributes": {
                    "registration_metadata": {
                        'q7': {
                            'value': {
                                 'question': {
                                    'value': 'This is the answer'
                                }
                            }
                        }
                    }
                }
            }
        }

        url = '/{}nodes/{}/draft_registrations/{}/'.format(API_BASE, self.public_project._id, self.prereg_draft_registration._id)

        res = self.app.put_json_api(url, payload, auth=user.auth, expect_errors=True)
        assert_equal(res.status_code, 400)
        assert_equal(res.json['errors'][0]['detail'], "Additional properties are not allowed (u'value' was unexpected)")

    def test_confirm_non_contrib_viewers_dont_have_pid_in_comments_view_timestamp(self):
        non_contributor = AuthUserFactory()
        url = self.project.api_url_for("update_comments_timestamp")
        res = self.app.put_json(url, {"page": "node", "rootId": self.project._id}, auth=self.user.auth)

        non_contributor.reload()
        assert_not_in(self.project._id, non_contributor.comments_viewed_timestamp)

class TestAssertion(OsfTestCase):

    def setUp(self):
        super(TestAssertion, self).setUp()
        self.user = AuthUserFactory()
        self.user.add_addon('badges', override=True)
        self.usersettings = self.user.get_addon('badges', self.user.auth)
        self.usersettings.save()
        self.project = ProjectFactory()
        self.node_settings = self.project.get_addon('badges')
        create_mock_badge(self.usersettings)
        self.badge = self.usersettings.badges[0]

    def test_parent(self):
        assertion = BadgeAssertion.create(self.badge, self.project)
        assert_equals(assertion.badge, self.badge)

    def test_recipient(self):
        assertion = BadgeAssertion.create(self.badge, self.project)
        test_data = {
            'idenity': self.project._id,
            'type': 'osfnode',
            'hashed': False
        }
        assert_equals(assertion.recipient, test_data)

    def test_awarder(self):
        assertion = BadgeAssertion.create(self.badge, self.project)
        assert_equals(assertion.awarder, self.usersettings)

    def setUp(self):
        super(TestNodeRelationshipInstitutions, self).setUp()

        self.institution2 = InstitutionFactory()
        self.institution1 = InstitutionFactory()

        self.user = AuthUserFactory()
        self.user.affiliated_institutions.append(self.institution1)
        self.user.affiliated_institutions.append(self.institution2)
        self.user.save()

        self.read_write_contributor = AuthUserFactory()
        self.read_write_contributor_institution = InstitutionFactory()
        self.read_write_contributor.affiliated_institutions.append(self.read_write_contributor_institution)
        self.read_write_contributor.save()

        self.read_only_contributor = AuthUserFactory()
        self.read_only_contributor_institution = InstitutionFactory()
        self.read_only_contributor.affiliated_institutions.append(self.read_only_contributor_institution)
        self.read_only_contributor.save()

        self.node = NodeFactory(creator=self.user)
        self.node.add_contributor(self.read_write_contributor, permissions=[permissions.WRITE])
        self.node.add_contributor(self.read_only_contributor, permissions=[permissions.READ])
        self.node.save()

        self.node_institutions_url = '/{0}nodes/{1}/relationships/institutions/'.format(API_BASE, self.node._id)

 def test_set_config_not_owner(self, mock_metadata):
     mock_metadata.return_value = {
         'data': {
             'name': 'Fake Folder'
         }
     }
     user = AuthUserFactory()
     user.add_addon('zotero')
     self.project.add_contributor(user)
     self.project.save()
     res = self.app.put_json(
         self.project.api_url_for('zotero_set_config'),
         {
             'external_account_id': self.account._id,
             'external_list_id': 'list',
         },
         auth=user.auth,
     )
     self.node_addon.reload()
     assert_equal(self.user_addon, self.node_addon.user_settings)
     serializer = ZoteroSerializer(node_settings=self.node_addon, user_settings=None)
     result = {
         'result': serializer.serialized_node_settings
     }
     assert_equal(res.json, result)

    def test_set_user_config_fail(self, mock_connection):

        mock_connection.return_value = create_mock_connection('wrong', 'info')

        # Create a user with no settings
        user = AuthUserFactory()
        user.add_addon('dataverse')
        user_settings = user.get_addon('dataverse')

        url = api_url_for('dataverse_set_user_config')
        params = {'dataverse_username': 'wrong',
                  'dataverse_password': 'info'}

        # Post incorrect credentials to existing user
        res = self.app.post_json(url, params, auth=self.user.auth,
                                 expect_errors=True)
        self.user_settings.reload()

        # Original user's info has not changed
        assert_equal(res.status_code, http.UNAUTHORIZED)
        assert_equal(self.user_settings.dataverse_username, 'snowman')
        assert_equal(self.user_settings.dataverse_password, 'frosty')

        # Post incorrect credentials to new user
        res = self.app.post_json(url, params, auth=user.auth,
                                 expect_errors=True)
        user_settings.reload()

        # New user's incorrect credentials were not saved
        assert_equal(res.status_code, http.UNAUTHORIZED)
        assert_equal(user_settings.dataverse_username, None)
        assert_equal(user_settings.dataverse_password, None)

class TestDataverseRestrictions(DataverseAddonTestCase, OsfTestCase):

    def setUp(self):

        super(DataverseAddonTestCase, self).setUp()

        # Nasty contributor who will try to access content that he shouldn't
        # have access to
        self.contrib = AuthUserFactory()
        self.project.add_contributor(self.contrib, auth=Auth(self.user))
        self.project.save()

    @mock.patch('addons.dataverse.views.client.connect_from_settings')
    def test_restricted_set_dataset_not_owner(self, mock_connection):
        mock_connection.return_value = create_mock_connection()

        # Contributor has dataverse auth, but is not the node authorizer
        self.contrib.add_addon('dataverse')
        self.contrib.save()

        url = api_url_for('dataverse_set_config', pid=self.project._primary_key)
        params = {
            'dataverse': {'alias': 'ALIAS1'},
            'dataset': {'doi': 'doi:12.3456/DVN/00002'},
        }
        res = self.app.post_json(url, params, auth=self.contrib.auth,
                                 expect_errors=True)
        assert_equal(res.status_code, http.FORBIDDEN)

class TestUserGet(AdminTestCase):
    def setUp(self):
        super(TestUserGet, self).setUp()
        User.remove()
        self.user_1 = AuthUserFactory()
        self.auth = Auth(user=self.user_1)
        self.project = ProjectFactory(creator=self.user_1)
        self.project.add_unregistered_contributor(
            email='[email protected]',
            fullname='Weezy F. Baby',
            auth=self.auth
        )
        self.user_3 = AuthUserFactory()
        self.user_3.date_confirmed = None
        self.user_3.save()
        self.user_4 = AuthUserFactory()

    def test_get_all_user_count(self):
        time_now = datetime.utcnow()
        count = get_all_user_count(time_now)
        nt.assert_equal(count, 4)

    def test_get_unregistered_users(self):
        count = get_unregistered_users()
        nt.assert_equal(count, 1)

class TestBadge(OsfTestCase):

    def setUp(self):
        super(TestBadge, self).setUp()
        self.user = AuthUserFactory()
        self.user.add_addon('badges', override=True)
        self.usersettings = self.user.get_addon('badges', self.user.auth)
        self.usersettings.save()

    def test_fields(self):
        badgedata = create_badge_dict()
        create_mock_badge(self.usersettings, badge_data=badgedata)
        badge = self.usersettings.badges[0]
        assert_equals(badge.name, badgedata['badgeName'])
        assert_equals(badge.description, badgedata['description'])
        assert_equals(badge.image, 'temp.png')
        assert_equals(badge.criteria, badgedata['criteria'])

    def test_system_badge(self):
        create_mock_badge(self.usersettings)
        badge = self.usersettings.badges[0]
        badge.make_system_badge()
        assert_true(badge.is_system_badge)
        assert_equals(badge, Badge.get_system_badges()[0])

    def test_assertions(self):
        create_mock_badge(self.usersettings)
        badge = self.usersettings.badges[0]
        assert_equals(len(badge.assertions), 0)
        for n in xrange(4):
            BadgeAssertion.create(badge, None)
            assert_equals(len(badge.assertions), n + 1)

class TestUserSettingsModel(OsfTestCase):

    def setUp(self):
        super(TestUserSettingsModel, self).setUp()
        self.user = AuthUserFactory()
        self.user.add_addon('badges', override=True)
        self.usersettings = self.user.get_addon('badges')
        self.usersettings.save()

    def test_can_award(self):
        assert_false(self.usersettings.can_award)
        create_mock_badge(self.usersettings)
        assert_true(self.usersettings.can_award)

    def test_to_openbadge(self):
        self.user.fullname = 'HoneyBadger'
        self.user.username = '[email protected]'
        self.user.save()

        test = {
            'name': 'HoneyBadger',
            'email': '[email protected]'
        }

        assert_equal(self.usersettings.to_openbadge(), test)

    def test_badges(self):
        create_mock_badge(self.usersettings)
        create_mock_badge(self.usersettings)
        assert_equal(len(self.usersettings.badges), 2)
        create_mock_badge(self.usersettings)
        assert_equal(len(self.usersettings.badges), 3)

 def test_revoke_remote_access_not_called(self, mock_decorator, mock_revoke):
     mock_decorator.return_value = self.user
     user2 = AuthUserFactory()
     user2.external_accounts.append(self.external_account)
     user2.save()
     self.user_settings.delete()
     assert_equal(mock_revoke.call_count, 0)

    def test_set_user_config_fail(self, mock_connection):

        mock_connection.side_effect = UnauthorizedError('Bad credentials!')

        # Create a user with no settings
        user = AuthUserFactory()
        user.add_addon('dataverse')
        user_settings = user.get_addon('dataverse')

        url = api_url_for('dataverse_set_user_config')
        params = {'api_token': 'wrong-info'}

        # Post incorrect credentials to existing user
        res = self.app.post_json(url, params, auth=self.user.auth,
                                 expect_errors=True)
        self.user_settings.reload()

        # Original user's info has not changed
        assert_equal(res.status_code, http.UNAUTHORIZED)
        assert_equal(self.user_settings.api_token, 'snowman-frosty')

        # Post incorrect credentials to new user
        res = self.app.post_json(url, params, auth=user.auth,
                                 expect_errors=True)
        user_settings.reload()

        # New user's incorrect credentials were not saved
        assert_equal(res.status_code, http.UNAUTHORIZED)
        assert_equal(user_settings.api_token, None)

 def setUp(self):
     super(TestUserSpamListView, self).setUp()
     self.project = ProjectFactory(is_public=True)
     self.user_1 = AuthUserFactory()
     self.user_2 = AuthUserFactory()
     self.project.add_contributor(self.user_1)
     self.project.add_contributor(self.user_2)
     self.project.save()
     self.user_2.save()
     self.user_1.save()
     self.comment_1 = CommentFactory(node=self.project, user=self.user_1)
     self.comment_2 = CommentFactory(node=self.project, user=self.user_1)
     self.comment_3 = CommentFactory(node=self.project, user=self.user_1)
     self.comment_4 = CommentFactory(node=self.project, user=self.user_1)
     self.comment_5 = CommentFactory(node=self.project, user=self.user_2)
     self.comment_6 = CommentFactory(node=self.project, user=self.user_2)
     self.comment_1.report_abuse(user=self.user_2, save=True,
                                 category='spam')
     self.comment_2.report_abuse(user=self.user_2, save=True,
                                 category='spam')
     self.comment_3.report_abuse(user=self.user_2, save=True,
                                 category='spam')
     self.comment_4.report_abuse(user=self.user_2, save=True,
                                 category='spam')
     self.comment_5.report_abuse(user=self.user_1, save=True,
                                 category='spam')
     self.comment_6.report_abuse(user=self.user_1, save=True,
                                 category='spam')

class TestUsers(ApiTestCase):

    def setUp(self):
        super(TestUsers, self).setUp()
        self.user_one = AuthUserFactory()
        self.user_two = AuthUserFactory()

    def tearDown(self):
        super(TestUsers, self).tearDown()

    def test_returns_200(self):
        res = self.app.get('/{}users/'.format(API_BASE))
        assert_equal(res.status_code, 200)
        assert_equal(res.content_type, 'application/vnd.api+json')

    def test_find_user_in_users(self):
        url = "/{}users/".format(API_BASE)

        res = self.app.get(url)
        user_son = res.json['data']

        ids = [each['id'] for each in user_son]
        assert_in(self.user_two._id, ids)

    def test_all_users_in_users(self):
        url = "/{}users/".format(API_BASE)

        res = self.app.get(url)
        user_son = res.json['data']

        ids = [each['id'] for each in user_son]
        assert_in(self.user_one._id, ids)
        assert_in(self.user_two._id, ids)

    def test_find_multiple_in_users(self):
        url = "/{}users/?filter[fullname]=fred".format(API_BASE)

        res = self.app.get(url)
        user_json = res.json['data']
        ids = [each['id'] for each in user_json]
        assert_in(self.user_one._id, ids)
        assert_in(self.user_two._id, ids)

    def test_find_single_user_in_users(self):
        url = "/{}users/?filter[fullname]=my".format(API_BASE)
        self.user_one.fullname = 'My Mom'
        self.user_one.save()
        res = self.app.get(url)
        user_json = res.json['data']
        ids = [each['id'] for each in user_json]
        assert_in(self.user_one._id, ids)
        assert_not_in(self.user_two._id, ids)

    def test_find_no_user_in_users(self):
        url = "/{}users/?filter[fullname]=NotMyMom".format(API_BASE)
        res = self.app.get(url)
        user_json = res.json['data']
        ids = [each['id'] for each in user_json]
        assert_not_in(self.user_one._id, ids)
        assert_not_in(self.user_two._id, ids)

class TestGoogleDriveHgridViews(OsfTestCase):

    def setUp(self):
        super(TestGoogleDriveHgridViews, self).setUp()
        self.user = AuthUserFactory()
        self.user.add_addon('googledrive')
        self.project = ProjectFactory(creator=self.user)
        self.project.add_addon('googledrive', Auth(self.user))
        self.node_settings = self.project.get_addon('googledrive')
        self.user_settings = self.user.get_addon('googledrive')
        self.node_settings.user_settings = self.user_settings
        self.user_settings.save()
        self.node_settings.save()
        # Log user in
        self.app.authenticate(*self.user.auth)

    @mock.patch('website.addons.googledrive.views.hgrid.GoogleDriveClient.folders')
    def test_googledrive_folders(self, mock_drive_client_folders):
        folderId = '12345'
        mock_drive_client_folders.return_value = mock_folders['items']
        url = api_url_for('googledrive_folders', pid=self.project._primary_key, folderId=folderId)
        res = self.app.get(url, auth=self.user.auth)
        assert_equal(res.status_code, 200)
        assert_equal(len(res.json), len(mock_folders['items']))

    @mock.patch('website.addons.googledrive.views.hgrid.GoogleDriveClient.about')
    def test_googledrive_folders_returns_only_root(self, mock_about):
        mock_about.return_value = {'rootFolderId': '24601'}

        url = self.project.api_url_for('googledrive_folders')
        res = self.app.get(url, auth=self.user.auth)

        assert_equal(len(res.json), 1)
        assert_equal(res.status_code, 200)
        assert_equal(res.json[0]['id'], '24601')

class TestAuthViews(OsfTestCase):

    def setUp(self):
        self.app = TestApp(app)
        self.user = AuthUserFactory()
        self.app.authenticate(*self.user.auth)


    def test_mendeley_oauth_start(self):
        self.user.add_addon('mendeley')
        settings = self.user.get_addon('mendeley')
        settings.access_token = '12345abc'
        print settings.has_auth
        settings.save()
       # assert_true(settings.has_auth)
        url = views.mendeley_oauth_start(self)
        print url



    def test_mendeley_oauth_delete_user(self):
        pass

    def test_mendeley_oauth_delete_node(self):
        pass

    def test_mendeley_oauth_callback(self):
        pass

    def test_claim_user_registered_with_correct_password(self):
        reg_user = AuthUserFactory()
        reg_user.set_password('killerqueen')
        reg_user.save()
        url = self.user.get_claim_url(self.project._primary_key)
        # Follow to password re-enter page
        res = self.app.get(url, auth=reg_user.auth).follow(auth=reg_user.auth)

        # verify that the "Claim Account" form is returned
        assert_in('Claim Contributor', res.body)

        form = res.forms['claimContributorForm']
        form['password'] = 'killerqueen'
        res = form.submit(auth=reg_user.auth).follow(auth=reg_user.auth)

        self.project.reload()
        self.user.reload()
        # user is now a contributor to the project
        assert_in(reg_user._primary_key, self.project.contributors)

        # the unregistered user (self.user) is removed as a contributor, and their
        assert_not_in(self.user._primary_key, self.project.contributors)

        # unclaimed record for the project has been deleted
        assert_not_in(self.project._primary_key, self.user.unclaimed_records)

    def test_s3_set_bucket_no_auth(self):

        user = AuthUserFactory()
        user.add_addon("s3")
        self.project.add_contributor(user, save=True)
        url = self.project.api_url_for("s3_post_node_settings")
        res = self.app.post_json(url, {"s3_bucket": "hammertofall"}, auth=user.auth, expect_errors=True)
        assert_equal(res.status_code, http.BAD_REQUEST)