Add initial implementations for forms and organization apps with serializers, factories, and admin configurations

tests/apps/forms/test_api_read_only.py

@@ -0,0 +1,56 @@
+"""Tests that form record endpoints are read-only."""
+
+from __future__ import annotations
+
+from django.test import override_settings
+from rest_framework import status
+from rest_framework.test import APITestCase
+
+from tests.apps.form_2.factories import FormF2RecordFactory
+from tests.apps.form_3.factories import FormF3RecordFactory
+from tests.apps.form_4.factories import FormF4RecordFactory
+from tests.apps.form_5.factories import FormF5RecordFactory
+from tests.apps.form_6.factories import FormF6RecordFactory
+from tests.apps.user.factories import UserFactory
+
+
+@override_settings(ROOT_URLCONF="core.urls")
+class FormRecordsReadOnlyApiTest(APITestCase):
+    """Mutating HTTP methods must be disabled for form records."""
+
+    def setUp(self):
+        self.user = UserFactory.create_user()
+        self.client.force_authenticate(self.user)
+        self.endpoints = {
+            "f2": ("/api/v1/forms/f2/records/", FormF2RecordFactory.create()),
+            "f3": ("/api/v1/forms/f3/records/", FormF3RecordFactory.create()),
+            "f4": ("/api/v1/forms/f4/records/", FormF4RecordFactory.create()),
+            "f5": ("/api/v1/forms/f5/records/", FormF5RecordFactory.create()),
+            "f6": ("/api/v1/forms/f6/records/", FormF6RecordFactory.create()),
+        }
+
+    def test_post_is_not_allowed_for_form_records(self):
+        for base_url, _record in self.endpoints.values():
+            response = self.client.post(base_url, {}, format="json")
+            self.assertEqual(response.status_code, status.HTTP_405_METHOD_NOT_ALLOWED)
+
+    def test_put_patch_delete_are_not_allowed_for_form_record_detail(self):
+        for base_url, record in self.endpoints.values():
+            detail_url = f"{base_url}{record.pk}/"
+
+            put_response = self.client.put(detail_url, {}, format="json")
+            patch_response = self.client.patch(detail_url, {}, format="json")
+            delete_response = self.client.delete(detail_url)
+
+            self.assertEqual(
+                put_response.status_code,
+                status.HTTP_405_METHOD_NOT_ALLOWED,
+            )
+            self.assertEqual(
+                patch_response.status_code,
+                status.HTTP_405_METHOD_NOT_ALLOWED,
+            )
+            self.assertEqual(
+                delete_response.status_code,
+                status.HTTP_405_METHOD_NOT_ALLOWED,
+            )