[fix] Added negative case for cascade delete permission #256

Added a subTest to verify that cascade deletes still respect child-model permissions.

Fixes #256

Author: UltraBot05

tests/test_project/tests/test_admin.py

@@ -1,8 +1,7 @@
 from unittest.mock import MagicMock, patch
 
 from django.contrib.admin.sites import AdminSite
-from django.contrib.auth import get_user_model
-from django.contrib.auth.models import Permission
+from django.contrib.auth.models import Permission, User
 from django.core.exceptions import ImproperlyConfigured
 from django.test import TestCase
 from django.urls import reverse
@@ -22,8 +21,6 @@
 )
 from . import AdminTestMixin, CreateMixin
 
-User = get_user_model()
-
 
 class TestAdmin(AdminTestMixin, CreateMixin, TestCase):
     TEST_KEY = "w1gwJxKaHcamUw62TQIPgYchwLKn3AA0"
@@ -135,6 +132,13 @@ def test_readonlyadmin_has_delete_permission(self):
             ).wsgi_request
             self.assertFalse(modeladmin.has_delete_permission(request))
 
+        with self.subTest("delete URL returns False"):
+            obj = self._create_radius_accounting(username="delete-test", session_id="2")
+            request = self.client.get(
+                reverse("admin:test_project_radiusaccounting_delete", args=[obj.pk])
+            ).wsgi_request
+            self.assertFalse(modeladmin.has_delete_permission(request))
+
         with self.subTest("cascade delete from unrelated URL returns True"):
             # Simulate being called from a parent model's delete
             # confirmation (cascade), not from the model's own views.
@@ -153,6 +157,21 @@ def test_readonlyadmin_has_delete_permission(self):
             request.resolver_match = None
             self.assertTrue(modeladmin.has_delete_permission(request))
 
+        with self.subTest("cascade delete without child permission returns False"):
+            user = User.objects.create(
+                username="readonly-staff",
+                password="pass",
+                is_staff=True,
+                is_superuser=False,
+            )
+            self.client.force_login(user)
+            request = self.client.get(reverse("admin:index")).wsgi_request
+
+            mock_resolver = MagicMock()
+            mock_resolver.url_name = "index"
+            request.resolver_match = mock_resolver
+            self.assertFalse(modeladmin.has_delete_permission(request))
+
     def test_context_processor(self):
         url = reverse("admin:index")
         response = self.client.get(url)