57 lines
1.6 KiB
Python
57 lines
1.6 KiB
Python
"""Unit tests for _ensure_admin and require_admin in server/auth.py."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
from fastapi import HTTPException
|
|
|
|
|
|
def _fake_request(auth_type: str = "none"):
|
|
return SimpleNamespace(state=SimpleNamespace(auth_type=auth_type))
|
|
|
|
|
|
def test_ensure_admin_passes_for_admin_user(admin_user):
|
|
from auth import _ensure_admin
|
|
|
|
_ensure_admin(_fake_request("bearer"), admin_user) # must not raise
|
|
|
|
|
|
def test_ensure_admin_passes_for_admin_api_key_auth_type():
|
|
from auth import _ensure_admin
|
|
|
|
_ensure_admin(_fake_request("admin_api_key"), None) # must not raise
|
|
|
|
|
|
def test_ensure_admin_passes_for_auth_disabled():
|
|
from auth import _ensure_admin
|
|
|
|
_ensure_admin(_fake_request("disabled"), None) # must not raise
|
|
|
|
|
|
def test_ensure_admin_rejects_non_admin_user(member_user):
|
|
from auth import _ensure_admin
|
|
|
|
with pytest.raises(HTTPException) as exc:
|
|
_ensure_admin(_fake_request("bearer"), member_user)
|
|
assert exc.value.status_code == 403
|
|
assert "Admin role required" in exc.value.detail
|
|
|
|
|
|
def test_ensure_admin_rejects_no_user_with_no_legacy_path():
|
|
from auth import _ensure_admin
|
|
|
|
with pytest.raises(HTTPException) as exc:
|
|
_ensure_admin(_fake_request("none"), None)
|
|
assert exc.value.status_code == 403
|
|
|
|
|
|
def test_ensure_admin_rejects_bearer_with_no_user():
|
|
"""Defense-in-depth: a 'bearer' auth_type without a User should not pass."""
|
|
from auth import _ensure_admin
|
|
|
|
with pytest.raises(HTTPException) as exc:
|
|
_ensure_admin(_fake_request("bearer"), None)
|
|
assert exc.value.status_code == 403
|