NuklearRabbit
5fa4fe0811
Integration status badges across Dashboard/Automation now show honest plain-language labels instead of raw backend state strings (and fix a few states that had no matching CSS colour class at all). Audit trail gets a "view related events" action reusing the existing correlation_id filter. About page gains scope/architecture/security/testing sections and a guided-demo entry point. POST /api/v1/demo/reset now runs and records a server-side scenario-integrity check. Also fixes a second real race condition (caught by the return-review e2e test): the odometer scenario pre-fill now resolves before ReturnForm mounts instead of patching its value in after the fact.
68 lines
2.3 KiB
Python
68 lines
2.3 KiB
Python
def test_unauthenticated_dashboard_is_rejected(client):
|
|
response = client.get("/api/v1/dashboard")
|
|
assert response.status_code == 401
|
|
assert response.json()["error"]["code"] == "401"
|
|
|
|
|
|
def test_demo_login_grants_access(ops_client):
|
|
response = ops_client.get("/api/v1/dashboard")
|
|
assert response.status_code == 200
|
|
|
|
|
|
def test_rental_employee_cannot_reset_demo(employee_client):
|
|
response = employee_client.post("/api/v1/demo/reset")
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_operations_manager_can_reset_demo(ops_client):
|
|
response = ops_client.post("/api/v1/demo/reset")
|
|
assert response.status_code == 200
|
|
body = response.json()
|
|
assert body["counts"]["vehicles"] == 50
|
|
assert body["anchor_date"]
|
|
assert body["seeded_at"]
|
|
assert body["scenario_integrity"]["all_ready"] is True
|
|
assert body["scenario_integrity"]["not_ready"] == []
|
|
|
|
|
|
def test_reset_is_rejected_when_demo_allow_reset_is_disabled(ops_client, monkeypatch):
|
|
import app.api.routers.demo as demo_router
|
|
|
|
monkeypatch.setattr(demo_router.settings, "demo_allow_reset", False)
|
|
response = ops_client.post("/api/v1/demo/reset")
|
|
assert response.status_code == 403
|
|
|
|
# Restore real demo data: this test intentionally disabled reset, so a following test
|
|
# module must not inherit a database left mid-mutation by an earlier test.
|
|
monkeypatch.setattr(demo_router.settings, "demo_allow_reset", True)
|
|
assert ops_client.post("/api/v1/demo/reset").status_code == 200
|
|
|
|
|
|
def test_session_endpoint_requires_authentication(client):
|
|
response = client.get("/api/v1/demo/session")
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_session_endpoint_confirms_logged_in_user(ops_client):
|
|
response = ops_client.get("/api/v1/demo/session")
|
|
assert response.status_code == 200
|
|
body = response.json()
|
|
assert body["role"] == "operations_manager"
|
|
assert body["public_ref"] == "USR-OPS"
|
|
|
|
|
|
def test_logout_invalidates_session(ops_client):
|
|
confirmed = ops_client.get("/api/v1/demo/session")
|
|
assert confirmed.status_code == 200
|
|
|
|
logout = ops_client.post("/api/v1/demo/logout")
|
|
assert logout.status_code == 200
|
|
|
|
after = ops_client.get("/api/v1/demo/session")
|
|
assert after.status_code == 401
|
|
|
|
|
|
def test_logout_without_a_session_is_safe(client):
|
|
response = client.post("/api/v1/demo/logout")
|
|
assert response.status_code == 200
|