django braces UserPassesTestMixin redirects to 'accounts/profile/' - django

Question

I'm adding django-braces to a system to ensure only certain users can perform certain actions. As a background, I've got some users who login and potentially have other users associated with their account, like a team leader.
Those team leaders are able to edit the details of their team so I've got a UserPassesTestMixin on that edit view and a LoginRequiredMixin on the dashboard view once they login.
Here are my views;
class Dashboard(DetailView, LoginRequiredMixin):
template_name = 'online_entry/entrant/dashboard.html'
model = FreeCycleEntrant
http_method_names = ['get']
class UpdateEntrantWizard(SignupWizard, UserPassesTestMixin):
template_name = 'online_entry/entrant/wizard_form.html'
form_list = [EditTeamMember]
model = Entrant
instance = None
def get_instance_obj(self):
if self.instance is None and 'pk' in self.kwargs:
self.instance = get_object_or_404(
Entrant, pk=self.kwargs['pk']
)
return self.instance
def test_func(self, user):
parent = Entrant.objects.get(user=user)
return self.get_instance_obj().user_has_access(user, parent=parent)
And the test function on my Entrant model is quite straightforward;
def user_has_access(self, user, parent=None):
"""
Indicates whether or not a user can edit this user. The passed in user
is the logged in user.
:type self: object
"""
if self.user == user:
return True
if isinstance(user, AnonymousUser):
return False
if parent and self.parent_entrant == parent:
return True
return False
So when I'm logged in as one of these users, and from the Dashboard attempt to go to that UpdateEntrantWizard view I'm redirected to /accounts/profile/ before the tests are hit (using breakpoints).
Am I missing something in my implementation of braces? It looks like you really only need to add the test & the mixin to get things working.

Answer 1

UserPassesTestMixin inherits from AccessMixin, which includes the login_url property. Simply set:
login_url = "/your_url/"
and it will redirect to a url of your choice.
As far as testing is concerned you can use the django Client. The example below from an app of mine should give the idea here. Obviously the user 'Claire' in this test should be created where the ellipses are, and with the permissions needed to pass the test.
def test_home_url_allows_authenticated_user(self):
c = Client()
...
c.login(username='Claire', password='pass')
content = c.get('/travel/')
self.assertEqual(content.status_code, 200)
Finally you may want to add a message in your login page along these lines:
{% if user.is_authenticated %}
<h2>You're logged in, but you might not have permission to view the page you requested.</h2>
{% else %}
...
Because that's where users will end up if they don't have the right permissions.

Answer 2

Try switching
class UpdateEntrantWizard(SignupWizard, UserPassesTestMixin):
To
class UpdateEntrantWizard(UserPassesTestMixin, SignupWizard):
When using something like :
class SomeProtectedView(views.LoginRequiredMixin,
views.PermissionRequiredMixin,
TemplateView):
the order in which you call the mixins matter. In this example it will check if user is logged in before checking permissions. And, if you were to put TemplateView first it would bypass the mixins altogether.