Added PATCH support for organizations

With a PATCH request you can now:
  - assign users,
  - remove a user,
  - edit the name, description, and website fields.

Only the organization admin user can do this.

tests/test_api/test_organizations.py

@@ -156,3 +156,174 @@ class OrganizationCruTest(AbstractPillarTest):
         # The unknown members list should be empty.
         db_org1 = orgs_coll.find_one(org1['_id'])
         self.assertEqual(db_org1['unknown_members'], [])
+
+
+class OrganizationPatchTest(AbstractPillarTest):
+    """Test PATCHing organizations."""
+
+    def test_assign_users(self):
+        self.enter_app_context()
+
+        admin_uid = self.create_user(24 * 'a', token='admin-token')
+        member1_uid = self.create_user(24 * 'b', email='member1@example.com')
+
+        om = self.app.org_manager
+        org_doc = om.create_new_org('Хакеры', admin_uid, 25)
+        org_id = org_doc['_id']
+
+        # Try the PATCH
+        resp = self.patch(f'/api/organizations/{org_id}',
+                          json={
+                              'op': 'assign-users',
+                              'emails': ['member1@example.com', 'member2@example.com'],
+                          },
+                          auth_token='admin-token')
+        new_org_doc = resp.get_json()
+
+        db = self.app.db('organizations')
+        db_org = db.find_one(org_id)
+
+        self.assertEqual([member1_uid], db_org['members'])
+        self.assertEqual(['member2@example.com'], db_org['unknown_members'])
+
+        self.assertEqual([str(member1_uid)], new_org_doc['members'])
+        self.assertEqual(['member2@example.com'], new_org_doc['unknown_members'])
+
+    def test_assign_users_access_denied(self):
+        self.enter_app_context()
+
+        admin_uid = self.create_user(24 * 'a', token='admin-token')
+        self.create_user(24 * 'b', email='member1@example.com', token='monkey-token')
+
+        om = self.app.org_manager
+        org_doc = om.create_new_org('Хакеры', admin_uid, 25)
+        org_id = org_doc['_id']
+
+        # Try the PATCH
+        self.patch(f'/api/organizations/{org_id}',
+                   json={
+                       'op': 'assign-users',
+                       'emails': ['member1@example.com', 'member2@example.com'],
+                   },
+                   auth_token='monkey-token',
+                   expected_status=403)
+
+        db = self.app.db('organizations')
+        db_org = db.find_one(org_id)
+
+        self.assertEqual([], db_org['members'])
+        self.assertEqual([], db_org['unknown_members'])
+
+    def test_remove_user_by_email(self):
+        self.enter_app_context()
+        om = self.app.org_manager
+
+        admin_uid = self.create_user(24 * 'a', token='admin-token')
+        self.create_user(24 * 'b', email='member1@example.com')
+        org_doc = om.create_new_org('Хакеры', admin_uid, 25)
+        org_id = org_doc['_id']
+
+        om.assign_users(org_id, ['member1@example.com', 'member2@example.com'])
+
+        # Try the PATCH to remove a known user
+        resp = self.patch(f'/api/organizations/{org_id}',
+                          json={
+                              'op': 'remove-user',
+                              'email': 'member1@example.com',
+                          },
+                          auth_token='admin-token')
+        new_org_doc = resp.get_json()
+
+        db = self.app.db('organizations')
+        db_org = db.find_one(org_id)
+
+        self.assertEqual([], db_org['members'])
+        self.assertEqual(['member2@example.com'], db_org['unknown_members'])
+
+        self.assertEqual([], new_org_doc['members'])
+        self.assertEqual(['member2@example.com'], new_org_doc['unknown_members'])
+
+        # Try the PATCH to remove an unknown user
+        resp = self.patch(f'/api/organizations/{org_id}',
+                          json={
+                              'op': 'remove-user',
+                              'email': 'member2@example.com',
+                          },
+                          auth_token='admin-token')
+        new_org_doc = resp.get_json()
+
+        db_org = db.find_one(org_id)
+
+        self.assertEqual([], db_org['members'])
+        self.assertEqual([], db_org['unknown_members'])
+
+        self.assertEqual([], new_org_doc['members'])
+        self.assertEqual([], new_org_doc['unknown_members'])
+
+    def test_remove_user_by_id(self):
+        self.enter_app_context()
+        om = self.app.org_manager
+
+        admin_uid = self.create_user(24 * 'a', token='admin-token')
+        member_uid = self.create_user(24 * 'b', email='member1@example.com')
+        org_doc = om.create_new_org('Хакеры', admin_uid, 25)
+        org_id = org_doc['_id']
+
+        om.assign_users(org_id, ['member1@example.com', 'member2@example.com'])
+
+        # Try the PATCH to remove a known user
+        resp = self.patch(f'/api/organizations/{org_id}',
+                          json={
+                              'op': 'remove-user',
+                              'user_id': str(member_uid),
+                          },
+                          auth_token='admin-token')
+        new_org_doc = resp.get_json()
+
+        db = self.app.db('organizations')
+        db_org = db.find_one(org_id)
+
+        self.assertEqual([], db_org['members'])
+        self.assertEqual(['member2@example.com'], db_org['unknown_members'])
+
+        self.assertEqual([], new_org_doc['members'])
+        self.assertEqual(['member2@example.com'], new_org_doc['unknown_members'])
+
+        # Try the PATCH to remove an unknown user
+        resp = self.patch(f'/api/organizations/{org_id}',
+                          json={
+                              'op': 'remove-user',
+                              'user_id': 24 * 'f',
+                          },
+                          auth_token='admin-token',
+                          expected_status=422)
+
+        db_org = db.find_one(org_id)
+        self.assertEqual([], db_org['members'])
+        self.assertEqual(['member2@example.com'], db_org['unknown_members'])
+
+    def test_edit_from_web(self):
+        self.enter_app_context()
+        om = self.app.org_manager
+
+        admin_uid = self.create_user(24 * 'a', token='admin-token')
+        org_doc = om.create_new_org('Хакеры', admin_uid, 25)
+        org_id = org_doc['_id']
+
+        # Try the PATCH to remove a known user
+        self.patch(f'/api/organizations/{org_id}',
+                   json={
+                       'op': 'edit-from-web',
+                       'name': '  Blender Institute ',
+                       'description': '\nOpen Source animation studio ',
+                       'website': '   https://blender.institute/  ',
+                   },
+                   auth_token='admin-token',
+                   expected_status=204)
+
+        db = self.app.db('organizations')
+        db_org = db.find_one(org_id)
+
+        self.assertEqual('Blender Institute', db_org['name'])
+        self.assertEqual('Open Source animation studio', db_org['description'])
+        self.assertEqual('https://blender.institute/', db_org['website'])