From b1f28018198f7660b5884c20b25e80daa267d31a Mon Sep 17 00:00:00 2001
From: Sergei Maertens <sergei@maykinmedia.nl>
Date: Tue, 31 Dec 2024 08:46:39 +0100
Subject: [PATCH] :white_check_mark: [#4650] Add tests for optional ownership
 check

* Added tests for configuration validation
* Added tests for runtime behaviour
---
 .../test_initial_data_ownership_validation.py | 16 +++++++
 .../tests/test_options_validation.py          | 47 +++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 src/openforms/prefill/contrib/objects_api/tests/test_options_validation.py

diff --git a/src/openforms/prefill/contrib/objects_api/tests/test_initial_data_ownership_validation.py b/src/openforms/prefill/contrib/objects_api/tests/test_initial_data_ownership_validation.py
index c3dbc7b227..b2b48fb087 100644
--- a/src/openforms/prefill/contrib/objects_api/tests/test_initial_data_ownership_validation.py
+++ b/src/openforms/prefill/contrib/objects_api/tests/test_initial_data_ownership_validation.py
@@ -159,3 +159,19 @@ def test_verify_initial_data_ownership_missing_auth_attribute_path_causes_failin
                 logs.filter_event("object_ownership_check_success").exists()
             )
             self.assertFalse(logs.filter_event("prefill_retrieve_success").exists())
+
+    def test_allow_prefill_when_ownership_check_is_skipped(self):
+        self.variable.prefill_options["skip_ownership_check"] = True
+        self.variable.save()
+        submission = SubmissionFactory.create(
+            form=self.form,
+            # invalid BSN
+            auth_info__value="000XXX000",
+            auth_info__attribute=AuthAttribute.bsn,
+            initial_data_reference=self.object_ref,
+        )
+
+        try:
+            prefill_variables(submission=submission)
+        except PermissionDenied as exc:
+            raise self.failureException("Ownership check should be skipped") from exc
diff --git a/src/openforms/prefill/contrib/objects_api/tests/test_options_validation.py b/src/openforms/prefill/contrib/objects_api/tests/test_options_validation.py
new file mode 100644
index 0000000000..0469c35aa0
--- /dev/null
+++ b/src/openforms/prefill/contrib/objects_api/tests/test_options_validation.py
@@ -0,0 +1,47 @@
+import uuid
+
+from rest_framework.test import APITestCase
+
+from openforms.contrib.objects_api.tests.factories import ObjectsAPIGroupConfigFactory
+
+from ..api.serializers import ObjectsAPIOptionsSerializer
+
+
+class OptionValidationTests(APITestCase):
+    """
+    Test the serializer used for options validation.
+    """
+
+    def test_auth_attribute_not_required(self):
+        api_group = ObjectsAPIGroupConfigFactory.create()
+        data = {
+            "objects_api_group": api_group.pk,
+            "objecttype_uuid": uuid.uuid4(),
+            "objecttype_version": 3,
+            "skip_ownership_check": True,
+            "auth_attribute_path": [],
+            "variables_mapping": [],
+        }
+        serializer = ObjectsAPIOptionsSerializer(data=data)
+
+        is_valid = serializer.is_valid()
+
+        self.assertTrue(is_valid)
+
+    def test_auth_attribute_required(self):
+        api_group = ObjectsAPIGroupConfigFactory.create()
+        data = {
+            "objects_api_group": api_group.pk,
+            "objecttype_uuid": uuid.uuid4(),
+            "objecttype_version": 3,
+            "skip_ownership_check": False,
+            "auth_attribute_path": [],
+            "variables_mapping": [],
+        }
+        serializer = ObjectsAPIOptionsSerializer(data=data)
+
+        is_valid = serializer.is_valid()
+
+        self.assertFalse(is_valid)
+        error = serializer.errors["auth_attribute_path"][0]
+        self.assertEqual(error.code, "empty")