Тест на снятие разрешения, реализованный в form_valid() в Django

Я не могу понять, почему мой тест не проходит. Я использовал RequestFactory, как указано в этом ответе, который, к сожалению, оказался бесполезным для меня.

from io import BytesIO, StringIO
from django.contrib.auth.models import User, Permission
from django.test import TestCase, RequestFactory

from graph.views import NewRecord

class NewRecordViewTests(TestCase):
    def setUp(self):
        # Every test needs access to the request factory.
        self.factory = RequestFactory()
        self.user = User.objects.create_user(
            username='jacob', email='jacob@example.com', password='top_secret')
        permissions = [Permission.objects.get_by_natural_key('add_record', 'graph', 'record'), Permission.objects.get_by_natural_key('add_extend', 'graph', 'extend')]
        self.user.user_permissions.set(permissions)

    def test_user_permissions(self):
        """Tests that a user has been denied permission to add a record."""
        for i in range(2):
            img = BytesIO(b'mybinarydata')
            fp = StringIO('Auxillary info')
            img.name = 'myimage.jpg'
            data = {'name': 'New Record',
                    'description': 'A new record',
                    'picture': img,
                    'content': 'Content',
                    'files': fp,
                    'author': self.user}
            request = self.factory.post('/cascades/add', data=data)
            request.user = self.user
            response = NewRecord.as_view()(request)
        self.assertEqual(response.status_code, 403, "Access should be denied")
        self.assertFalse(self.user.has_perm('graph.add_record'), "Permission remains")
        self.assertTrue(self.user.has_perm('graph.add_extend'), "No permission to extend a record")

Вывод:

======================================================================
FAIL: test_user_permissions (graph.tests.NewRecordViewTests)
Tests that a user has been denied permission to add a record.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "C:\Users\pavel\Documents\repos\Artcascade\graph\tests.py", line 34, in test_user_permissions
    self.assertEqual(response.status_code, 403, "Access should be denied")
AssertionError: 200 != 403 : Access should be denied

views.py:

class NewRecord(LoginRequiredMixin, PermissionRequiredMixin, SuccessMessageMixin, generic.CreateView):
    model = Record
    fields = ['name', 'description', 'picture', 'content', 'files']
    permission_required = 'graph.add_record'
    permission_denied_message = 'Purchase an access to add a record'
    success_message = 'Record submitted.'
    
    def form_valid(self, form):
        form.instance.author = self.request.user
        permission = Permission.objects.get_by_natural_key('add_record', 'graph', 'record')
        form.instance.author.user_permissions.remove(permission)
        if self.request.FILES:
            form.instance.image = self.request.FILES['picture']
            form.instance.files = self.request.FILES['files']
        return super().form_valid(form)            

    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
        context['mode'] = 'add'
        return context

# notice graph.add_record is added here
permissions = [Permission.objects.get_by_natural_key('add_record', 'graph', 'record'), Permission.objects.get_by_natural_key('add_extend', 'graph', 'extend')]
self.user.user_permissions.set(permissions)

# notice graph.add_record is required here
permission_required = 'graph.add_record'