45 lines
1.5 KiB
Python
45 lines
1.5 KiB
Python
def test_manager_can_create_and_update_user(ops_client):
|
|
created = ops_client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"email": "planner@example.test",
|
|
"display_name": "Fleet Planner",
|
|
"role": "rental_employee",
|
|
"password": "a-secure-demo-password",
|
|
},
|
|
)
|
|
assert created.status_code == 201
|
|
public_ref = created.json()["public_ref"]
|
|
assert created.json()["active"] is True
|
|
updated = ops_client.patch(
|
|
f"/api/v1/users/{public_ref}",
|
|
json={"display_name": "Senior Fleet Planner", "active": False},
|
|
)
|
|
assert updated.status_code == 200
|
|
assert updated.json()["display_name"] == "Senior Fleet Planner"
|
|
assert updated.json()["active"] is False
|
|
assert any(user["public_ref"] == public_ref for user in ops_client.get("/api/v1/users").json())
|
|
|
|
|
|
def test_employee_cannot_manage_users(employee_client):
|
|
assert employee_client.get("/api/v1/users").status_code == 403
|
|
assert (
|
|
employee_client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"email": "unauthorised@example.test",
|
|
"display_name": "Unauthorised User",
|
|
"role": "rental_employee",
|
|
"password": "a-secure-demo-password",
|
|
},
|
|
).status_code
|
|
== 403
|
|
)
|
|
assert (
|
|
employee_client.patch(
|
|
"/api/v1/users/USR-OPS",
|
|
json={"display_name": "Unauthorised Change"},
|
|
).status_code
|
|
== 403
|
|
)
|