File logging and route access control

hitier
2 parents ef44d9ee 38637852
Showing 25 changed files with 385 additions and 42 deletions Show diff stats
.gitignore
CHANGELOG.md
INSTALL.md
VERSION.txt
app/__init__.py
app/auth/models.py
app/auth/routes.py
app/auth/templates/login.html
app/commands/commands.py
app/errors/__init__.py
app/errors/handlers.py
app/errors/templates/error.html
app/main/routes.py
app/models.py
app/static/css/style.css
app/templates/base_page.html
app/templates/copy.html
app/templates/flash-messages.html
app/templates/heads.html
migrations/versions/4d5e5e207063_.py
@@ -11,3 +11,4 @@ _static
 _templates
 *db
 db_config.py
+logs
@@ -24,6 +24,13 @@ or major refactoring improvments.
 ## Unreleased
+## [0.2.pre-6] - 2021-03-29 - Role Controle, and per site configuration
+### New
+Route access control by User role
+Per site configuration
+Route error handling
+Logging to log file
+
 ## [0.2.pre-5] - 2021-03-19 - More Deploy facilities
 ### Changed
 More documentation
@@ -22,6 +22,8 @@
 ### Configurer l'application
     # D'abord les accés base de donnée
+    cp resources/pdc_config.py .
+    $(EDITOR) pdc_config.py 
     cp resources/db_config.py .
     $(EDITOR) db_config.py 
@@ -64,6 +66,7 @@ Utiliser l&#39;outil de ligne de commande fourni avec l&#39;application.
 Les fichiers concernés:
 - pdc_web.wsgi
+- pdc_config.py
 - db_config.py
 La procédure:
@@ -82,7 +85,7 @@ La procédure:
     python -m venv venv
     source venv/bin/activate
     pip install -r requirements.txt
-    $(EDITOR) db_config.py .flaskenv 
+    $(EDITOR) pdc_config.py db_config.py .flaskenv 
     # configurer le serveur web
     cp ./resources/apache2-virtual-host.conf /etc/apache2/sites-available/pdc-web.conf
@@ -141,5 +144,3 @@ Normalement, cette configuration permet de lire les variables positionées dans 
 Ainsi fait, exécutez votre projet depuis pycharm et testez.
-flask db update
-db_config
-0.2.pre-5
+0.2.pre-6
@@ -4,7 +4,18 @@ import sys
 from flask import Flask
 from flask_login import LoginManager
-from app.models import db, User
+import logging
+from logging.handlers import RotatingFileHandler
+from flask.logging import default_handler
+
+from app.models import db
+from app.auth.models import User
+
+from dotenv import load_dotenv
+
+app_dir = os.path.join(os.path.abspath(os.path.dirname(__file__)), '..')
+env_file = os.path.join(app_dir, ".flaskenv")
+load_dotenv(env_file, verbose=True)
 login_manager = LoginManager()
@@ -17,12 +28,13 @@ def load_user(user_id):
     return User.query.get(int(user_id))
+# TODO: move the following into create_app()
+#  and use app.logger system
 # Please, set a config file on top project dir
 # see in ../pdc_config.py
 try:
     from pdc_config import Config, ProdConfig, DevConfig, TestConfig
 except ImportError:
-    # TODO: use logging system
     print("Please set a pdc_config.py file in you PYTHON_PATH")
     print("See INSTALL.md for more info")
     sys.exit(-1)
@@ -56,6 +68,25 @@ def create_app(config_class=None):
     app = Flask(__name__)
     app.config.from_object(config_class)
+    # Log to stdout or to file
+    #
+    app.logger.removeHandler(default_handler)
+    if app.debug or app.testing or app.config['LOG_TO_STDOUT']:
+        log_handler = logging.StreamHandler()
+    else:
+        logs_file = app.config['PDC_LOGS_FILE']
+        logs_dir = os.path.dirname(logs_file)
+        if not os.path.exists(logs_dir):
+            os.mkdir(logs_dir)
+        log_handler = RotatingFileHandler(logs_file, maxBytes=10240, backupCount=10)
+
+    log_handler.setFormatter(logging.Formatter(
+        '%(asctime)s %(levelname)s: %(message)s [in %(pathname)s:%(lineno)d]'))
+    app.logger.addHandler(log_handler)
+
+    app.logger.setLevel(app.config['PDC_LOGS_LEVEL'])
+    app.logger.info("Starting PDC-WEB")
+
     db.init_app(app)
     login_manager.init_app(app)
@@ -63,7 +94,11 @@ def create_app(config_class=None):
     #
     from .main import bp as main_bp
     app.register_blueprint(main_bp)
+
     from .auth import bp as auth_bp
     app.register_blueprint(auth_bp)
+    from .errors import bp as errors_bp
+    app.register_blueprint(errors_bp)
+
     return app
@@ -0,0 +1,70 @@
+from pprint import pprint
+
+from flask_login import UserMixin, current_user
+from app.models import db
+
+#
+# Roles
+#
+
+ADMIN = 50
+PROJECT = 40
+SERVICE = 30
+AGENT = 10
+PUBLIC = 0
+
+_roleToName = {
+    ADMIN: 'ADMIN',
+    PROJECT: 'PROJECT',
+    SERVICE: 'SERVICE',
+    AGENT: 'AGENT',
+    PUBLIC: 'PUBLIC',
+}
+_nameToRole = {
+    'ADMIN': ADMIN,
+    'PROJECT': PROJECT,
+    'SERVICE': SERVICE,
+    'AGENT': AGENT,
+    'PUBLIC': PUBLIC,
+}
+
+
+def _checkRole(role):
+    if isinstance(role, int):
+        rv = role
+    elif str(role) == role:
+        role = role.upper()
+        if role not in _nameToRole:
+            raise ValueError("Unknown role: %r" % role)
+        rv = _nameToRole[role]
+    else:
+        raise TypeError("Role not an integer or a valid string: %r" % role)
+    return rv
+
+
+class User(UserMixin, db.Model):
+    id = db.Column(db.Integer, primary_key=True)  # primary keys are required by SQLAlchemy
+    email = db.Column(db.String(100), unique=True)
+    name = db.Column(db.String(100))
+    login = db.Column(db.String(100), unique=True)
+    password = db.Column(db.String(100))
+    role = db.Column(db.Integer, default=0)
+
+    def __repr__(self):
+        return "i: {}, n: {}, e: {}, l: {}".format(self.id, self.name, self.email, self.login)
+
+    # Set role at construction time
+    def __init__(self, **kwargs):
+        super(User, self).__init__(**kwargs)
+        self.set_role(kwargs['role'])
+
+    def set_role(self, role):
+        self.role = _checkRole(role)
+
+    def has_role(self, role):
+        role = _checkRole(role)
+        return self.role == role
+
+    def has_role_or_higher(self, role):
+        role = _checkRole(role)
+        return self.role and (self.role >= role)
-from flask import render_template, request, redirect, url_for, flash
+from functools import wraps
+
+from flask_login import current_user
+from flask import render_template, request, redirect, url_for, flash, current_app
 from flask_login import login_user, logout_user
-from app.models import User
-from . import bp
+from app.auth.models import User
+from app.auth import bp
+
+
+#
+# Decorator used to protect routes by role
+# inspired from https://flask.palletsprojects.com/en/master/patterns/viewdecorators/
+#
+def role_required(role):
+    def decorator(f):
+        @wraps(f)
+        def decorated_function(*args, **kwargs):
+            try:
+                if current_app.config['ROLE_DISABLED']:
+                    return f(*args, **kwargs)
+            except KeyError:
+                # no such config, juste ignore
+                pass
+            # first check use is logged in
+            if not current_user or not current_user.is_authenticated:
+                flash(f"Vous devez vous authentifier avec la fonction '{role}'", 'warning')
+                return redirect(url_for('auth.login'))
+            # then check role status
+            try:
+                is_authorised = current_user.has_role_or_higher(role)
+            except ValueError:
+                raise Exception("Unknowk role provided %s" % role)
+            if not is_authorised:
+                flash("Vous n'avez pas les autorisations pour accéder à cette page", 'dark')
+                return redirect(url_for('main.index'))
+            return f(*args, **kwargs)
+
+        return decorated_function
+
+    return decorator
 @bp.route('/login')
@@ -2,6 +2,7 @@
 <html lang="fr">
 <head>
   {% include 'heads.html' %}
+  <link href="{{ url_for('static', filename='css/style.css') }}" rel="stylesheet" type="text/css"/>
   <link href="{{ url_for('auth.static', filename='signin.css') }}" rel="stylesheet" type="text/css"/>
 </head>
 <body class="text-center">
@@ -9,7 +10,7 @@
     {% include 'flash-messages.html' %}
     <a href="{{url_for('main.index')}}">
-      <img class="mb-4" height="72" src="{{ url_for('static', filename='img/pdc.png') }}" width="72">
+      <img class="mb-4 {{config.PDC_SITE_CLASS}}" height="72" src="{{ url_for('static', filename='img/pdc.png') }}" width="72">
     </a>
     <h1 class="h3 font-weight-normal mb-3">Connectez vous</h1>
     <label class="sr-only" for="login">Email Adress</label>
@@ -2,15 +2,15 @@ import sys
 import click
 import random
+from flask import current_app
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.sql import func
 from sqlalchemy.ext.automap import automap_base
 from sqlalchemy.orm import Session
 from sqlalchemy import create_engine
-from app.models import db, User, Agent, Service, Project, Capacity, Period, Charge
-
-from db_config import mysql_lesia_uri
+from app.models import db, Agent, Service, Project, Capacity, Period, Charge
+from app.auth.models import User
 from . import bp
@@ -23,7 +23,7 @@ def feed_from_lesia():
     """
     Base = automap_base()
-    engine = create_engine(mysql_lesia_uri)
+    engine = create_engine(current_app.config['LESIA_AGENTS_DB_URI'])
     # reflect the tables
     try:
@@ -33,7 +33,6 @@ def feed_from_lesia():
         print("Please, configure the mysql database (see db_config.py)")
         sys.exit(-1)
-
     # mapped classes are now created with names by default
     # matching that of the table name.
     LesiaAgent = Base.classes.agent
@@ -97,7 +96,7 @@ def feed_random_charges(agent):
             .filter(Charge.agent_id == agent_id,
                     Charge.period_id == period_id
                     ).scalar()
-        if total_charge is not None and (total_charge + percent)>= 100:
+        if total_charge is not None and (total_charge + percent) >= 100:
             print("Skipping agent {} for period {}".format(agent_id, period_id))
             continue
         charge = Charge(agent_id=agent_id,
@@ -124,7 +123,7 @@ def user_delete(user_id):
 def create_db():
     """ Create the database structure."""
     db.create_all()
-    admin = User(email='admin@nowhere.org', name='admin', login='admin', password='admin')
+    admin = User(email='admin@nowhere.org', name='admin', login='admin', password='admin', role='admin')
     db.session.add(admin)
     db.session.commit()
@@ -0,0 +1,5 @@
+from flask import Blueprint
+
+bp = Blueprint('errors', __name__, url_prefix='/auth', template_folder='templates')
+
+from . import handlers
@@ -0,0 +1,31 @@
+from flask import render_template
+from app import db
+from . import bp
+
+
+# Inspired by:
+#   https://flask.palletsprojects.com/en/master/patterns/errorpages/
+
+@bp.app_errorhandler(403)
+def forbidden_error(error):
+    error_title = "Page Interdite"
+    return render_template('error.html', error_title=error_title, error_msg=error), 403
+
+
+@bp.app_errorhandler(404)
+def not_found_error(error):
+    error_title = "Page Introuvable."
+    return render_template('error.html', error_title=error_title, error_msg=error), 404
+
+
+@bp.app_errorhandler(405)
+def method_error(error):
+    error_title = "Erreur de Méthode."
+    return render_template('error.html', error_title=error_title, error_msg=error), 405
+
+
+@bp.app_errorhandler(500)
+def internal_error(error):
+    db.session.rollback()
+    error_title = "Erreur Interne. Administrateur Prévenu."
+    return render_template('error.html', error_title=error_title, error_msg=error), 500
@@ -0,0 +1,7 @@
+{% extends "base_page.html" %}
+
+{% block content %}
+<h2 class="error_title">{{ error_title }}</h2>
+<div class="error_msg">{{ error_msg }}</div>
+<a href="{{url_for('main.index')}}">Retour à l'accueil</a>
+{% endblock %}
 import json
-from flask import render_template, make_response
+from flask import render_template, make_response, current_app, redirect, url_for, request
+from flask_login import login_required, current_user
 from . import bp
 from app.models import Agent, Project, Service, Capacity, Period
-from .. import db_mgr
+from app import db_mgr
+from app.auth.routes import role_required
+
+
+@bp.before_request
+def site_login():
+    try:
+        if current_app.config['SITE_LOGIN'] \
+                and not current_user.is_authenticated:
+            return redirect(url_for('auth.login'))
+    except KeyError:
+        # no such config, juste ignore
+        pass
+
+@bp.before_request
+def catch_all_route():
+    current_app.logger.info(f"{request.method} {request.path}")
 @bp.route('/')
@@ -14,6 +31,7 @@ def index():
 @bp.route('/services')
+@role_required('service')
 def services():
     # get services list
     all_services = Service.query.order_by(Service.name).all()
@@ -24,6 +42,7 @@ def services():
 @bp.route('/projects')
+@role_required('project')
 def projects():
     # get projects list
     all_projects = Project.query.order_by(Project.name).all()
@@ -34,6 +53,7 @@ def projects():
 @bp.route('/agents')
+@role_required('project')
 def agents():
     # get agents list
     all_agents = Agent.query.order_by(Agent.firstname).all()
@@ -44,6 +64,7 @@ def agents():
 @bp.route('/capacities')
+@login_required
 def capacities():
     # get capacities list
     all_capacities = Capacity.query.order_by(Capacity.name).all()
@@ -54,6 +75,7 @@ def capacities():
 @bp.route('/periods')
+@login_required
 def periods():
     # get capacities list
     all_periods = Period.query.order_by(Period.name).all()
@@ -64,11 +86,13 @@ def periods():
 @bp.route('/charge/add')
+@role_required('service')
 def charge_add():
     return render_template('charge.html', subtitle="Affecter un agent")
 @bp.route('/charge/agent/<agent_id>')
+@role_required('service')
 def charge_agent(agent_id):
     agent_charges = []
     for [period, charge] in db_mgr.charges_by_agent(agent_id):
@@ -80,8 +104,10 @@ def charge_agent(agent_id):
 @bp.route('/agent/<agent_id>')
+@role_required('agent')
 def agent(agent_id):
-    agent = Agent.query.get(int(agent_id))
+    # TODO: am i the agent, the service or project manager , or the admin ?
+    this_agent = Agent.query.get(int(agent_id))
     return render_template('agent.html',
-                           agent=agent,
+                           agent=this_agent,
                            subtitle="{} {}".format(agent.firstname, agent.secondname))
-from flask_login import UserMixin
 from flask_sqlalchemy import SQLAlchemy
 db = SQLAlchemy()
-class User(UserMixin, db.Model):
-    id = db.Column(db.Integer, primary_key=True)  # primary keys are required by SQLAlchemy
-    email = db.Column(db.String(100), unique=True)
-    name = db.Column(db.String(100))
-    login = db.Column(db.String(100), unique=True)
-    password = db.Column(db.String(100))
-
-    def __repr__(self):
-        return "i: {}, n: {}, e: {}, l: {}".format(self.id, self.name, self.email, self.login)
-
-
 class Agent(db.Model):
     id = db.Column(db.Integer, primary_key=True)
     firstname = db.Column(db.String(100))
@@ -57,3 +57,22 @@ nav.sidebar a.disabled {
     padding-bottom: 15px;
     border-bottom: 1px solid #ddd
 }
+
+/* -- - - - - - - - - -  per site icon settings - - - - - - - - - -- */
+
+.admin-icon {
+    filter: hue-rotate(300deg) saturate(1000%);
+}
+
+.public-icon {
+    filter: saturate(200%);
+    /* hue-rotate(300deg) */
+}
+
+.dev-icon {
+    filter: hue-rotate(200deg) saturate(1000%);
+}
+
+.dev2-icon {
+    filter: hue-rotate(100deg) saturate(1000%);
+}
@@ -9,8 +9,8 @@
 <body>
   <nav class="navbar navbar-dark sticky-top bg-dark navbar-expand-lg p-1">
     <a class="navbar-brand col-sm-3 col-md-2 " href="{{url_for('main.index')}}">
-      <img class="m-0 mr-1" height="30" src="{{ url_for('static', filename='img/pdc-ico.png') }}" width="30"/>
-      Plan de Charges</a>
+      <img class="m-0 mr-1 {{config.PDC_SITE_CLASS}}" src="{{ url_for('static', filename='img/pdc-ico.png') }}" height="30" width="30"/>
+      {{config.PDC_APP_NAME}} - {{config.PDC_SITE_NAME}}</a>
     <ul class="navbar-nav ml-auto">
       {% if not current_user.is_anonymous %}
       <li class="nav-item">
 <p class="text-muted text-center">
-  Plan de Charge - {{ config.VERSION }}<br/>
+  {{ config.PDC_APP_NAME }} - {{ config.VERSION }}<br/>
   © 2021 IRAP
 </p>
@@ -3,7 +3,7 @@
   <div id="messages" class="mt-1">
     {% for level, message in messages %}
     {% if level == 'message' %}
-    <div class="alert alert-primary}" role="alert">{{ message }}
+    <div class="alert alert-primary" role="alert">{{ message }}
     {% else %}
     <div class="alert alert-{{level}}" role="alert">{{ message }}
     {% endif %}
@@ -2,4 +2,4 @@
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <link href="{{ url_for('static', filename='img/pdc-ico.png') }}" rel="icon"/>
   <link href="{{ url_for('static', filename='css/bootstrap.min.css') }}" rel="stylesheet" type="text/css"/>
-  <title>{% if title %} {{title}} {% else %}Plan de Charge{%endif%}</title>
 \ No newline at end of file
+  <title>{% if title %} {{title}} {% else %}{{config.PDC_APP_NAME}} - {{config.PDC_SITE_NAME}}{%endif%}</title>
 \ No newline at end of file
@@ -0,0 +1,28 @@
+"""empty message
+
+Revision ID: 4d5e5e207063
+Revises: 6f7e51f380eb
+Create Date: 2021-03-26 18:34:03.768661
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '4d5e5e207063'
+down_revision = '6f7e51f380eb'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column('user', sa.Column('role', sa.Integer(), nullable=True))
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('user', 'role')
+    # ### end Alembic commands ###
@@ -0,0 +1,21 @@
+#/bin/env sh
+
+#
+# Shell wrapper to locally run the flask app as any user:
+#
+#   sudo -u www-data  ./pdc_web.sh
+#
+#  Of course, any prerequisites, installation procedure and configuration files may have been fullfilled.
+#  See README.md and INSTALL.md for more details
+#
+
+SCRIPT_PATH=$(readlink -f $0)
+SCRIPT_DIR=$(dirname $SCRIPT_PATH)
+
+cd $SCRIPT_DIR
+
+[ ! -f ./venv/bin/activate ] && echo "Create python virtual env ./venv/" && exit
+[ ! -f .flaskenv ] && echo "Create .flaskenv file" && exit
+
+. ./venv/bin/activate
+flask run
@@ -39,6 +39,7 @@ POSTGRESTEST = {
 }
 postgres_test_uri = 'postgresql://%(user)s:%(pw)s@%(host)s:%(port)s/%(db)s' % POSTGRESTEST
+# The lesia mysql agents database
 MYSQL_LESIA = {
     'user': 'mysql',
     'pw': 'mysql',
@@ -75,10 +75,10 @@
       <h1 class="h3 font-weight-normal my-5">Plan de Charge</h1>
       <p class="lead">
-        Place centrale de redirection vers les différents sites de la ferme d'applications sur le site de l'Irap.
+        Les différentes instances de l'application hébergées à l'Irap:
       </p>
       <p class="lead">
-        <a class="btn btn-lg btn-secondary" href="https://plan-de-charges.irap.omp.eu/public/">Pour tous</a>
+        <a class="btn btn-lg btn-secondary" href="https://plan-de-charges.irap.omp.eu/public/">Public</a>
         <a class="btn btn-lg btn-secondary" href="https://plan-de-charges.irap.omp.eu/irap/">Irap</a>
       </p>
     </main>
@@ -10,6 +10,38 @@ root_dir = os.path.abspath(os.path.dirname(__file__))
 class Config(object):
     SECRET_KEY = 'dev'
+
+    # Please change the following to fit you own site parameters
+    #
+    PDC_APP_NAME = 'Plan de Charge'
+    PDC_SITE_NAME = 'NO_SITE'  # choose among IRAP, PUBLIC, ...
+    PDC_SITE_CLASS = 'public-icon'  # choose among admin-icon, public-icon
+    PDC_LOGS_LEVEL = 'DEBUG'  # choose within  DEBUG, INFO, WARN, ERROR ( more levels in logging module )
+    PDC_LOGS_DIR = os.path.join(root_dir, 'logs')
+    PDC_LOGS_FILE = os.path.join(PDC_LOGS_DIR, 'pdc.log')
+
+    # Uncomment for role access control
+    #   if True, will disable any role control on routes
+    #   note that this doesnt disable the @login_required
+    #
+    # ROLE_DISABLED = False
+
+    # Uncomment for site access control
+    #   if True, will force login access on any site page 
+    #   note that this doesnt disable the @login_required 
+    #
+    # SITE_LOGIN = False
+
+    #
+    # No need to Edit below
+    #
+
+    # You can force logging to stdout in production environment
+    # (make sure your httpd/wsgi server can redirect to log files)
+    LOG_TO_STDOUT = os.environ.get('LOG_TO_STDOUT')
+    if LOG_TO_STDOUT and LOG_TO_STDOUT.upper() == "true".upper():
+        LOG_TO_STDOUT = True
+
     SQLALCHEMY_TRACK_MODIFICATIONS = False
     # Trying to set specific db uri from ./db_config.py
@@ -19,6 +51,12 @@ class Config(object):
         SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL') or \
                                   'sqlite:///' + os.path.join(root_dir, 'pdc_app.db')
+    try:
+        LESIA_AGENTS_DB_URI = mysql_lesia_uri
+    except NameError:
+        LESIA_AGENTS_DB_URI = os.environ.get('LESIA_AGENTS_DB_URI') or \
+                              'sqlite:///' + os.path.join(root_dir, 'lesia.db')
+
     with open(os.path.join(root_dir, 'VERSION.txt')) as version_file:
         VERSION = version_file.read().strip()
@@ -36,11 +74,16 @@ class DevConfig(Config):
     except NameError:
         SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL') or \
                                   'sqlite:///' + os.path.join(root_dir, 'pdc_app_dev.db')
+    # ignores @login_required decorator
+    LOGIN_DISABLED = True
+    # ignores @role_required decorator
+    ROLE_DISABLED = True
 class TestConfig(Config):
     TESTING = True
     DEBUG = True
+    PDC_LOGS_LEVEL = 'ERROR'  # choose within  DEBUG, INFO, WARN, ERROR ( more levels in logging module )
     # Trying to set specific db uri from ./db_config.py
     try:
         SQLALCHEMY_DATABASE_URI = sqlalchemy_testdb_uri
@@ -48,6 +91,8 @@ class TestConfig(Config):
         SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL') or \
                                   'sqlite:///' + os.path.join(root_dir, 'pdc_app_test.db')
     # ignores @login_required decorator
-    # LOGIN_DISABLED = True
+    LOGIN_DISABLED = True
+    # ignores @role_required decorator
+    ROLE_DISABLED = True
 # vim: tw=0
 import unittest
 from pdc_config import TestConfig
-from app import create_app, db_mgr
+from app import create_app, db_mgr, db
+from app.auth.models import User
 class BaseTestCase(unittest.TestCase):
@@ -9,6 +10,10 @@ class BaseTestCase(unittest.TestCase):
         self.app = create_app(TestConfig)
         self.app_context = self.app.app_context()
         self.app_context.push()
+        db.create_all()
+        admin = User(email='admin@nowhere.org', name='admin', login='admin', password='admin', role='admin')
+        db.session.add(admin)
+        db.session.commit()
     def tearDown(self):
         self.app_context.pop()
@@ -27,3 +32,20 @@ class DbMgrTestCase(BaseTestCase):
     def test_charges_by_agent(self):
         all_charges = db_mgr.charges_by_agent(355)
         self.assertEqual(6, len(all_charges))
+
+
+class AuthModelTestCase(BaseTestCase):
+
+    def test_setrole(self):
+        admin = User.query.filter(User.name == 'admin').one_or_none()
+        admin.set_role("ADMIN")
+        db.session.commit()
+        admin = User.query.filter(User.name == 'admin').one_or_none()
+        self.assertTrue(admin is not None)
+        self.assertTrue(admin.has_role("ADMIN"))
+        self.assertFalse(admin.has_role("SERVICE"))
+
+    def test_setrole_valueerror(self):
+        admin = User(email='me@nowhere.org', name='me', login='me', password='me', role='admin')
+        with self.assertRaises(ValueError) as ve:
+            admin.set_role("NOSUCHROLE")