[Fixes #12513] add coverage

geonode/base/api/serializers.py

@@ -561,6 +561,7 @@ def to_internal_value(self, data):
         user_action = self.MAPPING.get(self.field_name)
         instance = self.root.instance or ResourceBase.objects.get(pk=self.root.initial_data["pk"])
         if getattr(user, user_action)(instance):
+            logger.debug("User can perform the action, the new value is returned")
             return new_val
         else:
             logger.warning(f"The user does not have the perms to update the value of {self.field_name}")

geonode/base/api/tests.py

@@ -812,6 +812,34 @@ def test_resource_base_serializer_with_settingsfield(self):
         self.assertTrue(data.get("is_published"))
         self.assertFalse(data.get("featured"))
 
+    def test_resource_settings_field(self):
+        """
+        Admin is able to change the is_published value
+        """
+        doc = create_single_doc("my_custom_doc")
+        factory = RequestFactory()
+        rq = factory.get("test")
+        rq.user = doc.owner
+        serializer = ResourceBaseSerializer(doc, context={"request": rq})
+        field = serializer.fields["is_published"]
+        self.assertIsNotNone(field)
+        self.assertTrue(field.to_internal_value(True))
+
+    def test_resource_settings_field_non_admin(self):
+        """
+        Non-Admin is not able to change the is_published value
+        if he is not the owner of the resource
+        """
+        doc = create_single_doc("my_custom_doc")
+        factory = RequestFactory()
+        rq = factory.get("test")
+        rq.user = get_user_model().objects.get(username="bobby")
+        serializer = ResourceBaseSerializer(doc, context={"request": rq})
+        field = serializer.fields["is_published"]
+        self.assertIsNotNone(field)
+        # the original value was true, so it should not return false
+        self.assertTrue(field.to_internal_value(False))
+
     def test_delete_user_with_resource(self):
         owner, created = get_user_model().objects.get_or_create(username="delet-owner")
         Dataset(