PTah
56c469ddbd
Add sac_users table, JWT roles, settings/users API guarded for admin, Users page in UI, and sac_manage_user.py CLI. Co-authored-by: Cursor <cursoragent@cursor.com>
65 lines
2.0 KiB
Python
65 lines
2.0 KiB
Python
"""Multi-user UI auth and RBAC."""
|
|
|
|
from app.models.user import USER_ROLE_MONITOR
|
|
|
|
|
|
def test_login_success(client):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "test-admin", "password": "test-admin-password"},
|
|
)
|
|
assert response.status_code == 200
|
|
body = response.json()
|
|
assert body["username"] == "test-admin"
|
|
assert body["role"] == "admin"
|
|
assert body["access_token"]
|
|
|
|
|
|
def test_login_monitor(client):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "test-monitor", "password": "test-monitor-password"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["role"] == USER_ROLE_MONITOR
|
|
|
|
|
|
def test_login_invalid_password(client):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"username": "test-admin", "password": "wrong"},
|
|
)
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_auth_me(client, jwt_headers):
|
|
response = client.get("/api/v1/auth/me", headers=jwt_headers)
|
|
assert response.status_code == 200
|
|
assert response.json() == {"username": "test-admin", "role": "admin"}
|
|
|
|
|
|
def test_settings_forbidden_for_monitor(client, jwt_monitor_headers):
|
|
response = client.get("/api/v1/settings/notifications", headers=jwt_monitor_headers)
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_events_allowed_for_monitor(client, jwt_monitor_headers):
|
|
response = client.get("/api/v1/events", headers=jwt_monitor_headers)
|
|
assert response.status_code == 200
|
|
|
|
|
|
def test_admin_create_monitor_user(client, jwt_headers):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
headers=jwt_headers,
|
|
json={"username": "new-monitor", "password": "longpassword1", "role": "monitor"},
|
|
)
|
|
assert response.status_code == 201
|
|
assert response.json()["username"] == "new-monitor"
|
|
assert response.json()["role"] == "monitor"
|
|
|
|
|
|
def test_monitor_cannot_list_users(client, jwt_monitor_headers):
|
|
response = client.get("/api/v1/users", headers=jwt_monitor_headers)
|
|
assert response.status_code == 403
|