137 lines
4.1 KiB
Python
137 lines
4.1 KiB
Python
"""Multi-user UI auth and RBAC."""
|
|
|
|
from app.models.user import USER_ROLE_MONITOR
|
|
|
|
|
|
def test_login_success(client):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "test-admin", "password": "test-admin-password"},
|
|
)
|
|
assert response.status_code == 200
|
|
body = response.json()
|
|
assert body["username"] == "test-admin"
|
|
assert body["role"] == "admin"
|
|
assert body["access_token"]
|
|
|
|
|
|
def test_login_monitor(client):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "test-monitor", "password": "test-monitor-password"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["role"] == USER_ROLE_MONITOR
|
|
|
|
|
|
def test_login_invalid_password(client):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "test-admin", "password": "wrong"},
|
|
)
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_auth_me(client, jwt_headers):
|
|
response = client.get("/api/v1/auth/me", headers=jwt_headers)
|
|
assert response.status_code == 200
|
|
assert response.json() == {"username": "test-admin", "role": "admin"}
|
|
|
|
|
|
def test_settings_forbidden_for_monitor(client, jwt_monitor_headers):
|
|
response = client.get("/api/v1/settings/notifications", headers=jwt_monitor_headers)
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_events_allowed_for_monitor(client, jwt_monitor_headers):
|
|
response = client.get("/api/v1/events", headers=jwt_monitor_headers)
|
|
assert response.status_code == 200
|
|
|
|
|
|
def test_admin_create_monitor_user(client, jwt_headers):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
headers=jwt_headers,
|
|
json={"username": "new-monitor", "password": "longpassword1", "role": "monitor"},
|
|
)
|
|
assert response.status_code == 201
|
|
assert response.json()["username"] == "new-monitor"
|
|
assert response.json()["role"] == "monitor"
|
|
|
|
|
|
def test_monitor_cannot_list_users(client, jwt_monitor_headers):
|
|
response = client.get("/api/v1/users", headers=jwt_monitor_headers)
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_admin_update_user_role_and_password(client, jwt_headers):
|
|
create = client.post(
|
|
"/api/v1/users",
|
|
headers=jwt_headers,
|
|
json={"username": "patch-me", "password": "longpassword1", "role": "monitor"},
|
|
)
|
|
assert create.status_code == 201
|
|
user_id = create.json()["id"]
|
|
|
|
response = client.patch(
|
|
f"/api/v1/users/{user_id}",
|
|
headers=jwt_headers,
|
|
json={"role": "admin", "password": "newpassword9"},
|
|
)
|
|
assert response.status_code == 200
|
|
body = response.json()
|
|
assert body["role"] == "admin"
|
|
|
|
login = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "patch-me", "password": "newpassword9"},
|
|
)
|
|
assert login.status_code == 200
|
|
assert login.json()["role"] == "admin"
|
|
|
|
|
|
def test_admin_update_username(client, jwt_headers):
|
|
create = client.post(
|
|
"/api/v1/users",
|
|
headers=jwt_headers,
|
|
json={"username": "old-name", "password": "longpassword1", "role": "monitor"},
|
|
)
|
|
user_id = create.json()["id"]
|
|
|
|
response = client.patch(
|
|
f"/api/v1/users/{user_id}",
|
|
headers=jwt_headers,
|
|
json={"username": "new-name"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["username"] == "new-name"
|
|
|
|
login = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "new-name", "password": "longpassword1"},
|
|
)
|
|
assert login.status_code == 200
|
|
|
|
|
|
def test_admin_deactivate_user(client, jwt_headers):
|
|
create = client.post(
|
|
"/api/v1/users",
|
|
headers=jwt_headers,
|
|
json={"username": "to-disable", "password": "longpassword1", "role": "monitor"},
|
|
)
|
|
user_id = create.json()["id"]
|
|
|
|
response = client.patch(
|
|
f"/api/v1/users/{user_id}",
|
|
headers=jwt_headers,
|
|
json={"is_active": False},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["is_active"] is False
|
|
|
|
login = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "to-disable", "password": "longpassword1"},
|
|
)
|
|
assert login.status_code == 401
|