From ae60dfee08bf6995428418cac4861fc249d5ba1b Mon Sep 17 00:00:00 2001
From: Mattia <mattia.giupponi@gmail.com>
Date: Fri, 23 Aug 2024 10:34:24 +0200
Subject: [PATCH] [Fixes #12513] add coverage

---
 geonode/base/api/serializers.py |  1 +
 geonode/base/api/tests.py       | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/geonode/base/api/serializers.py b/geonode/base/api/serializers.py
index 8ab5063096d..560f638b703 100644
--- a/geonode/base/api/serializers.py
+++ b/geonode/base/api/serializers.py
@@ -561,6 +561,7 @@ def to_internal_value(self, data):
         user_action = self.MAPPING.get(self.field_name)
         instance = self.root.instance or ResourceBase.objects.get(pk=self.root.initial_data["pk"])
         if getattr(user, user_action)(instance):
+            logger.debug("User can perform the action, the new value is returned")
             return new_val
         else:
             logger.warning(f"The user does not have the perms to update the value of {self.field_name}")
diff --git a/geonode/base/api/tests.py b/geonode/base/api/tests.py
index 541c07c230d..ac4b622a556 100644
--- a/geonode/base/api/tests.py
+++ b/geonode/base/api/tests.py
@@ -812,6 +812,34 @@ def test_resource_base_serializer_with_settingsfield(self):
         self.assertTrue(data.get("is_published"))
         self.assertFalse(data.get("featured"))
 
+    def test_resource_settings_field(self):
+        """
+        Admin is able to change the is_published value
+        """
+        doc = create_single_doc("my_custom_doc")
+        factory = RequestFactory()
+        rq = factory.get("test")
+        rq.user = doc.owner
+        serializer = ResourceBaseSerializer(doc, context={"request": rq})
+        field = serializer.fields["is_published"]
+        self.assertIsNotNone(field)
+        self.assertTrue(field.to_internal_value(True))
+
+    def test_resource_settings_field_non_admin(self):
+        """
+        Non-Admin is not able to change the is_published value
+        if he is not the owner of the resource
+        """
+        doc = create_single_doc("my_custom_doc")
+        factory = RequestFactory()
+        rq = factory.get("test")
+        rq.user = get_user_model().objects.get(username="bobby")
+        serializer = ResourceBaseSerializer(doc, context={"request": rq})
+        field = serializer.fields["is_published"]
+        self.assertIsNotNone(field)
+        # the original value was true, so it should not return false
+        self.assertTrue(field.to_internal_value(False))
+
     def test_delete_user_with_resource(self):
         owner, created = get_user_model().objects.get_or_create(username="delet-owner")
         Dataset(