slapos_erp5: test Access Token local roles

master/bt5/slapos_erp5/PortalTypeRolesTemplateItem/Restricted%20Access%20Token.xml

@@ -5,10 +5,4 @@
    <multi_property id='categories'>local_role_group/user</multi_property>
    <multi_property id='base_category'>agent</multi_property>
   </role>
-  <role id='Assignor'>
-   <property id='title'>Group company</property>
-   <multi_property id='categories'>local_role_group/group</multi_property>
-   <multi_property id='category'>group/company</multi_property>
-   <multi_property id='base_category'>group</multi_property>
-  </role>
 </type_roles>
\ No newline at end of file

master/bt5/slapos_erp5/TestTemplateItem/portal_components/test.erp5.testSlapOSERP5GroupRoleSecurity.py

@@ -1948,3 +1948,34 @@ class TestCredentialUpdateModule(TestSlapOSGroupRoleSecurityMixin):
     self.assertRoles(module, 'F-SALE*', ['Auditor', 'Author'])
     self.assertRoles(module, module.Base_getOwnerId(), ['Owner'])
 
+
+class TestAccessTokenModule(TestSlapOSGroupRoleSecurityMixin):
+  def test_AccessTokenModule(self):
+    module = self.portal.access_token_module
+    self.assertSecurityGroup(module,
+        ['F-PRODUCTION*', module.Base_getOwnerId()], False)
+    self.assertRoles(module, 'F-PRODUCTION*', ['Author'])
+    self.assertRoles(module, module.Base_getOwnerId(), ['Owner'])
+
+
+class TestRestrictedAccessToken(TestSlapOSGroupRoleSecurityMixin):
+  def test_RestrictedAccessToken_default(self):
+    delivery = self.portal.access_token_module.newContent(
+      portal_type='Restricted Access Token'
+    )
+    self.assertSecurityGroup(delivery,
+        [self.user_id], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+
+  def test_RestrictedAccessToken_agent(self):
+    # There is no interaction workflow to recalculate local roles
+    person = self.portal.person_module.newContent(portal_type='Person')
+    delivery = self.portal.access_token_module.newContent(
+      agent_value=person,
+      portal_type='Restricted Access Token'
+    )
+    self.assertSecurityGroup(delivery,
+        [person.getUserId(), self.user_id], False)
+    self.assertRoles(delivery, self.user_id, ['Owner'])
+    self.assertRoles(delivery, person.getUserId(), ['Auditor'])
+