M54: harden operations and demo resilience

2026-08-24 03:31:03 +02:00
parent b0706989db
commit 81e3fd63bd
101 changed files with 5641 additions and 828 deletions
@@ -23,3 +23,22 @@ def test_manager_can_create_and_update_user(ops_client):

 def test_employee_cannot_manage_users(employee_client):
    assert employee_client.get("/api/v1/users").status_code == 403
+    assert (
+        employee_client.post(
+            "/api/v1/users",
+            json={
+                "email": "unauthorised@example.test",
+                "display_name": "Unauthorised User",
+                "role": "rental_employee",
+                "password": "a-secure-demo-password",
+            },
+        ).status_code
+        == 403
+    )
+    assert (
+        employee_client.patch(
+            "/api/v1/users/USR-OPS",
+            json={"display_name": "Unauthorised Change"},
+        ).status_code
+        == 403
+    )