chore(home): mirror from kalinamall (9883e6a) with papatramp URLs

backend/tests/test_users_auth.py

@@ -0,0 +1,136 @@
+"""Multi-user UI auth and RBAC."""
+
+from app.models.user import USER_ROLE_MONITOR
+
+
+def test_login_success(client):
+    response = client.post(
+        "/api/v1/auth/login",
+        json={"username": "test-admin", "password": "test-admin-password"},
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert body["username"] == "test-admin"
+    assert body["role"] == "admin"
+    assert body["access_token"]
+
+
+def test_login_monitor(client):
+    response = client.post(
+        "/api/v1/auth/login",
+        json={"username": "test-monitor", "password": "test-monitor-password"},
+    )
+    assert response.status_code == 200
+    assert response.json()["role"] == USER_ROLE_MONITOR
+
+
+def test_login_invalid_password(client):
+    response = client.post(
+        "/api/v1/auth/login",
+        json={"username": "test-admin", "password": "wrong"},
+    )
+    assert response.status_code == 401
+
+
+def test_auth_me(client, jwt_headers):
+    response = client.get("/api/v1/auth/me", headers=jwt_headers)
+    assert response.status_code == 200
+    assert response.json() == {"username": "test-admin", "role": "admin"}
+
+
+def test_settings_forbidden_for_monitor(client, jwt_monitor_headers):
+    response = client.get("/api/v1/settings/notifications", headers=jwt_monitor_headers)
+    assert response.status_code == 403
+
+
+def test_events_allowed_for_monitor(client, jwt_monitor_headers):
+    response = client.get("/api/v1/events", headers=jwt_monitor_headers)
+    assert response.status_code == 200
+
+
+def test_admin_create_monitor_user(client, jwt_headers):
+    response = client.post(
+        "/api/v1/users",
+        headers=jwt_headers,
+        json={"username": "new-monitor", "password": "longpassword1", "role": "monitor"},
+    )
+    assert response.status_code == 201
+    assert response.json()["username"] == "new-monitor"
+    assert response.json()["role"] == "monitor"
+
+
+def test_monitor_cannot_list_users(client, jwt_monitor_headers):
+    response = client.get("/api/v1/users", headers=jwt_monitor_headers)
+    assert response.status_code == 403
+
+
+def test_admin_update_user_role_and_password(client, jwt_headers):
+    create = client.post(
+        "/api/v1/users",
+        headers=jwt_headers,
+        json={"username": "patch-me", "password": "longpassword1", "role": "monitor"},
+    )
+    assert create.status_code == 201
+    user_id = create.json()["id"]
+
+    response = client.patch(
+        f"/api/v1/users/{user_id}",
+        headers=jwt_headers,
+        json={"role": "admin", "password": "newpassword9"},
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert body["role"] == "admin"
+
+    login = client.post(
+        "/api/v1/auth/login",
+        json={"username": "patch-me", "password": "newpassword9"},
+    )
+    assert login.status_code == 200
+    assert login.json()["role"] == "admin"
+
+
+def test_admin_update_username(client, jwt_headers):
+    create = client.post(
+        "/api/v1/users",
+        headers=jwt_headers,
+        json={"username": "old-name", "password": "longpassword1", "role": "monitor"},
+    )
+    user_id = create.json()["id"]
+
+    response = client.patch(
+        f"/api/v1/users/{user_id}",
+        headers=jwt_headers,
+        json={"username": "new-name"},
+    )
+    assert response.status_code == 200
+    assert response.json()["username"] == "new-name"
+
+    login = client.post(
+        "/api/v1/auth/login",
+        json={"username": "new-name", "password": "longpassword1"},
+    )
+    assert login.status_code == 200
+
+
+def test_admin_deactivate_user(client, jwt_headers):
+    create = client.post(
+        "/api/v1/users",
+        headers=jwt_headers,
+        json={"username": "to-disable", "password": "longpassword1", "role": "monitor"},
+    )
+    user_id = create.json()["id"]
+
+    response = client.patch(
+        f"/api/v1/users/{user_id}",
+        headers=jwt_headers,
+        json={"is_active": False},
+    )
+    assert response.status_code == 200
+    assert response.json()["is_active"] is False
+
+    login = client.post(
+        "/api/v1/auth/login",
+        json={"username": "to-disable", "password": "longpassword1"},
+    )
+    assert login.status_code == 401