forked from 0xWheatyz/SPARC
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 96d5d27b17 |
+69
-33
@@ -114,8 +114,7 @@ class AnalyticsResponse(BaseModel):
|
||||
period_days: int
|
||||
|
||||
|
||||
# In-memory job storage (for demo; production would use Redis/DB)
|
||||
_jobs: dict[str, JobStatus] = {}
|
||||
# Job counter for generating unique IDs (the actual state is in PostgreSQL)
|
||||
_job_counter = 0
|
||||
|
||||
|
||||
@@ -148,9 +147,19 @@ _analyzer: CompanyAnalyzer | None = None
|
||||
|
||||
@asynccontextmanager
|
||||
async def lifespan(app: FastAPI):
|
||||
"""Initialize resources on startup."""
|
||||
"""Initialize resources on startup, clean up on shutdown."""
|
||||
global _analyzer
|
||||
_analyzer = CompanyAnalyzer()
|
||||
# Mark any jobs that were running/pending before the restart as failed
|
||||
from SPARC.database import DatabaseClient
|
||||
_db = DatabaseClient(config.database_url)
|
||||
_db.connect()
|
||||
_db.initialize_schema()
|
||||
stale = _db.mark_stale_jobs_failed()
|
||||
if stale:
|
||||
import logging
|
||||
logging.getLogger(__name__).warning("Marked %d stale jobs as failed on startup", stale)
|
||||
_db.close()
|
||||
yield
|
||||
# Cleanup if needed
|
||||
_analyzer = None
|
||||
@@ -422,20 +431,52 @@ async def analyze_companies_batch(
|
||||
return _convert_batch_result(result)
|
||||
|
||||
|
||||
def _get_job_db() -> "DatabaseClient":
|
||||
"""Get a DatabaseClient for job persistence."""
|
||||
from SPARC.database import DatabaseClient
|
||||
db = DatabaseClient(config.database_url)
|
||||
return db
|
||||
|
||||
|
||||
def _job_row_to_status(row: dict) -> JobStatus:
|
||||
"""Convert a database job row to a JobStatus model."""
|
||||
import json as _json
|
||||
result = None
|
||||
if row.get("result_json"):
|
||||
result_data = row["result_json"]
|
||||
if isinstance(result_data, str):
|
||||
result_data = _json.loads(result_data)
|
||||
result = BatchAnalysisResponse(**result_data)
|
||||
return JobStatus(
|
||||
job_id=row["job_id"],
|
||||
status=row["status"],
|
||||
progress=row["progress"],
|
||||
total_companies=row["total_companies"],
|
||||
completed_companies=row["completed_companies"],
|
||||
result=result,
|
||||
error=row.get("error"),
|
||||
)
|
||||
|
||||
|
||||
def _run_batch_job(job_id: str, companies: list[str], max_workers: int):
|
||||
"""Background task for batch analysis."""
|
||||
global _jobs, _analyzer
|
||||
import json as _json
|
||||
global _analyzer
|
||||
|
||||
db = _get_job_db()
|
||||
|
||||
if not _analyzer:
|
||||
_jobs[job_id].status = "failed"
|
||||
_jobs[job_id].error = "Analyzer not initialized"
|
||||
db.update_job(job_id, status="failed", error="Analyzer not initialized")
|
||||
return
|
||||
|
||||
_jobs[job_id].status = "running"
|
||||
db.update_job(job_id, status="running")
|
||||
|
||||
def progress_callback(company: str, completed: int, total: int):
|
||||
_jobs[job_id].completed_companies = completed
|
||||
_jobs[job_id].progress = int((completed / total) * 100)
|
||||
db.update_job(
|
||||
job_id,
|
||||
completed_companies=completed,
|
||||
progress=int((completed / total) * 100),
|
||||
)
|
||||
|
||||
try:
|
||||
result = _analyzer.analyze_companies(
|
||||
@@ -443,12 +484,15 @@ def _run_batch_job(job_id: str, companies: list[str], max_workers: int):
|
||||
max_workers=max_workers,
|
||||
progress_callback=progress_callback,
|
||||
)
|
||||
_jobs[job_id].status = "completed"
|
||||
_jobs[job_id].progress = 100
|
||||
_jobs[job_id].result = _convert_batch_result(result)
|
||||
batch_response = _convert_batch_result(result)
|
||||
db.update_job(
|
||||
job_id,
|
||||
status="completed",
|
||||
progress=100,
|
||||
result_json=_json.dumps(batch_response.model_dump(), default=str),
|
||||
)
|
||||
except Exception as e:
|
||||
_jobs[job_id].status = "failed"
|
||||
_jobs[job_id].error = str(e)
|
||||
db.update_job(job_id, status="failed", error=str(e))
|
||||
|
||||
|
||||
@app.post("/analyze/batch/async", response_model=JobStatus, tags=["Analysis"])
|
||||
@@ -473,19 +517,14 @@ async def analyze_companies_async(
|
||||
_job_counter += 1
|
||||
job_id = f"job_{_job_counter}_{datetime.now().strftime('%Y%m%d%H%M%S')}"
|
||||
|
||||
_jobs[job_id] = JobStatus(
|
||||
job_id=job_id,
|
||||
status="pending",
|
||||
progress=0,
|
||||
total_companies=len(request.companies),
|
||||
completed_companies=0,
|
||||
)
|
||||
db = _get_job_db()
|
||||
job_row = db.create_job(job_id=job_id, total_companies=len(request.companies))
|
||||
|
||||
background_tasks.add_task(
|
||||
_run_batch_job, job_id, request.companies, request.max_workers
|
||||
)
|
||||
|
||||
return _jobs[job_id]
|
||||
return _job_row_to_status(job_row)
|
||||
|
||||
|
||||
@app.get("/jobs/{job_id}", response_model=JobStatus, tags=["Jobs"])
|
||||
@@ -501,10 +540,13 @@ async def get_job_status(
|
||||
Returns:
|
||||
Current job status including progress and results when complete
|
||||
"""
|
||||
if job_id not in _jobs:
|
||||
db = _get_job_db()
|
||||
job_row = db.get_job(job_id)
|
||||
|
||||
if not job_row:
|
||||
raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
|
||||
|
||||
return _jobs[job_id]
|
||||
return _job_row_to_status(job_row)
|
||||
|
||||
|
||||
@app.get("/jobs", response_model=list[JobStatus], tags=["Jobs"])
|
||||
@@ -525,12 +567,6 @@ async def list_jobs(
|
||||
Returns:
|
||||
List of job statuses
|
||||
"""
|
||||
jobs = list(_jobs.values())
|
||||
|
||||
if status:
|
||||
jobs = [j for j in jobs if j.status == status]
|
||||
|
||||
# Return most recent first
|
||||
jobs.sort(key=lambda j: j.job_id, reverse=True)
|
||||
|
||||
return jobs[:limit]
|
||||
db = _get_job_db()
|
||||
job_rows = db.list_jobs(status=status, limit=limit)
|
||||
return [_job_row_to_status(row) for row in job_rows]
|
||||
|
||||
@@ -171,6 +171,26 @@ class DatabaseClient:
|
||||
ON serp_queries(query_hash)
|
||||
""")
|
||||
|
||||
# Create jobs table for persisting async batch job state
|
||||
cursor.execute("""
|
||||
CREATE TABLE IF NOT EXISTS jobs (
|
||||
job_id VARCHAR(128) PRIMARY KEY,
|
||||
status VARCHAR(20) NOT NULL DEFAULT 'pending',
|
||||
progress INTEGER NOT NULL DEFAULT 0,
|
||||
total_companies INTEGER NOT NULL DEFAULT 0,
|
||||
completed_companies INTEGER NOT NULL DEFAULT 0,
|
||||
result_json JSONB,
|
||||
error TEXT,
|
||||
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
|
||||
)
|
||||
""")
|
||||
|
||||
cursor.execute("""
|
||||
CREATE INDEX IF NOT EXISTS idx_jobs_status
|
||||
ON jobs(status)
|
||||
""")
|
||||
|
||||
self.conn.commit()
|
||||
|
||||
@staticmethod
|
||||
@@ -462,6 +482,131 @@ class DatabaseClient:
|
||||
)
|
||||
conn.commit()
|
||||
|
||||
# Job Persistence Methods
|
||||
|
||||
def create_job(
|
||||
self,
|
||||
job_id: str,
|
||||
total_companies: int,
|
||||
) -> Dict:
|
||||
"""Create a new job record.
|
||||
|
||||
Args:
|
||||
job_id: Unique job identifier
|
||||
total_companies: Number of companies in the batch
|
||||
|
||||
Returns:
|
||||
Job dict
|
||||
"""
|
||||
with self.get_conn() as conn:
|
||||
with conn.cursor(cursor_factory=RealDictCursor) as cursor:
|
||||
cursor.execute(
|
||||
"""
|
||||
INSERT INTO jobs (job_id, status, progress, total_companies, completed_companies)
|
||||
VALUES (%s, 'pending', 0, %s, 0)
|
||||
RETURNING *
|
||||
""",
|
||||
(job_id, total_companies),
|
||||
)
|
||||
job = cursor.fetchone()
|
||||
conn.commit()
|
||||
return dict(job)
|
||||
|
||||
def update_job(
|
||||
self,
|
||||
job_id: str,
|
||||
status: Optional[str] = None,
|
||||
progress: Optional[int] = None,
|
||||
completed_companies: Optional[int] = None,
|
||||
result_json: Optional[str] = None,
|
||||
error: Optional[str] = None,
|
||||
) -> Optional[Dict]:
|
||||
"""Update a job's state.
|
||||
|
||||
Only non-None fields are updated.
|
||||
"""
|
||||
updates = []
|
||||
params = []
|
||||
if status is not None:
|
||||
updates.append("status = %s")
|
||||
params.append(status)
|
||||
if progress is not None:
|
||||
updates.append("progress = %s")
|
||||
params.append(progress)
|
||||
if completed_companies is not None:
|
||||
updates.append("completed_companies = %s")
|
||||
params.append(completed_companies)
|
||||
if result_json is not None:
|
||||
updates.append("result_json = %s")
|
||||
params.append(result_json)
|
||||
if error is not None:
|
||||
updates.append("error = %s")
|
||||
params.append(error)
|
||||
|
||||
if not updates:
|
||||
return self.get_job(job_id)
|
||||
|
||||
updates.append("updated_at = CURRENT_TIMESTAMP")
|
||||
params.append(job_id)
|
||||
|
||||
with self.get_conn() as conn:
|
||||
with conn.cursor(cursor_factory=RealDictCursor) as cursor:
|
||||
cursor.execute(
|
||||
f"UPDATE jobs SET {', '.join(updates)} WHERE job_id = %s RETURNING *",
|
||||
params,
|
||||
)
|
||||
job = cursor.fetchone()
|
||||
conn.commit()
|
||||
return dict(job) if job else None
|
||||
|
||||
def get_job(self, job_id: str) -> Optional[Dict]:
|
||||
"""Get a job by ID."""
|
||||
with self.get_conn() as conn:
|
||||
with conn.cursor(cursor_factory=RealDictCursor) as cursor:
|
||||
cursor.execute("SELECT * FROM jobs WHERE job_id = %s", (job_id,))
|
||||
job = cursor.fetchone()
|
||||
return dict(job) if job else None
|
||||
|
||||
def list_jobs(
|
||||
self,
|
||||
status: Optional[str] = None,
|
||||
limit: int = 10,
|
||||
) -> List[Dict]:
|
||||
"""List jobs, optionally filtered by status."""
|
||||
query = "SELECT * FROM jobs"
|
||||
params: list = []
|
||||
if status:
|
||||
query += " WHERE status = %s"
|
||||
params.append(status)
|
||||
query += " ORDER BY created_at DESC LIMIT %s"
|
||||
params.append(limit)
|
||||
|
||||
with self.get_conn() as conn:
|
||||
with conn.cursor(cursor_factory=RealDictCursor) as cursor:
|
||||
cursor.execute(query, params)
|
||||
return [dict(row) for row in cursor.fetchall()]
|
||||
|
||||
def mark_stale_jobs_failed(self) -> int:
|
||||
"""Mark any jobs in 'running' or 'pending' state as 'failed'.
|
||||
|
||||
Called at startup to clean up jobs that were interrupted by a restart.
|
||||
|
||||
Returns:
|
||||
Number of jobs marked as failed.
|
||||
"""
|
||||
with self.get_conn() as conn:
|
||||
with conn.cursor() as cursor:
|
||||
cursor.execute(
|
||||
"""
|
||||
UPDATE jobs SET status = 'failed', error = 'Interrupted by server restart',
|
||||
updated_at = CURRENT_TIMESTAMP
|
||||
WHERE status IN ('running', 'pending')
|
||||
"""
|
||||
)
|
||||
count = cursor.rowcount
|
||||
conn.commit()
|
||||
return count
|
||||
|
||||
# User Authentication Methods
|
||||
|
||||
@staticmethod
|
||||
|
||||
@@ -40,6 +40,9 @@ def main():
|
||||
print("\nTables created:")
|
||||
print(" - llm_messages: Stores all LLM prompts and responses")
|
||||
print(" - users: Stores user accounts")
|
||||
print(" - jobs: Stores async batch job state")
|
||||
print(" - patents: Patent PDF cache")
|
||||
print(" - serp_queries: SERP query result cache")
|
||||
print("\nIndexes created:")
|
||||
print(" - idx_messages_timestamp: For time-based queries")
|
||||
print(" - idx_messages_company: For company-specific queries")
|
||||
|
||||
+1
-1
@@ -5,7 +5,7 @@ from datetime import datetime
|
||||
from unittest.mock import Mock, patch
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
from SPARC.api import app, _analyzer, _jobs
|
||||
from SPARC.api import app
|
||||
from SPARC.types import CompanyAnalysisResult, BatchAnalysisResult
|
||||
|
||||
|
||||
|
||||
@@ -1,302 +0,0 @@
|
||||
"""Tests for JWT authentication flow: register, login, protected routes, refresh, admin access."""
|
||||
|
||||
from datetime import datetime, timezone
|
||||
from unittest.mock import MagicMock, patch
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
from SPARC.api import app
|
||||
from SPARC.auth import create_access_token, create_refresh_token
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def client():
|
||||
"""Create test client."""
|
||||
return TestClient(app)
|
||||
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def mock_db(monkeypatch):
|
||||
"""Mock the database client used by auth endpoints.
|
||||
|
||||
Returns a MagicMock with all DB methods pre-configured.
|
||||
"""
|
||||
db = MagicMock()
|
||||
|
||||
# Default: no users exist
|
||||
db.get_user_count.return_value = 0
|
||||
db.get_user_by_id.return_value = None
|
||||
db.get_user_by_email.return_value = None
|
||||
db.authenticate_user.return_value = None
|
||||
db.create_user.return_value = None
|
||||
db.get_all_users.return_value = []
|
||||
db.update_user_role.return_value = None
|
||||
db.delete_user.return_value = False
|
||||
|
||||
with patch("SPARC.api.get_db_client", return_value=db), \
|
||||
patch("SPARC.auth.get_db_client", return_value=db):
|
||||
yield db
|
||||
|
||||
|
||||
def _make_admin_user():
|
||||
return {
|
||||
"id": 1,
|
||||
"email": "admin@test.com",
|
||||
"role": "admin",
|
||||
"created_at": datetime(2025, 1, 1, tzinfo=timezone.utc),
|
||||
}
|
||||
|
||||
|
||||
def _make_regular_user():
|
||||
return {
|
||||
"id": 2,
|
||||
"email": "user@test.com",
|
||||
"role": "user",
|
||||
"created_at": datetime(2025, 1, 1, tzinfo=timezone.utc),
|
||||
}
|
||||
|
||||
|
||||
def _auth_header(user_dict):
|
||||
"""Create an Authorization header with a valid access token for the given user."""
|
||||
token = create_access_token(user_dict["id"], user_dict["email"], user_dict["role"])
|
||||
return {"Authorization": f"Bearer {token}"}
|
||||
|
||||
|
||||
class TestRegister:
|
||||
"""POST /auth/register"""
|
||||
|
||||
def test_register_first_user_becomes_admin(self, client, mock_db):
|
||||
"""First registered user should get admin role."""
|
||||
mock_db.get_user_count.return_value = 0
|
||||
mock_db.create_user.return_value = {
|
||||
"id": 1,
|
||||
"email": "admin@test.com",
|
||||
"role": "admin",
|
||||
"created_at": datetime(2025, 1, 1, tzinfo=timezone.utc),
|
||||
}
|
||||
|
||||
response = client.post(
|
||||
"/auth/register",
|
||||
json={"email": "admin@test.com", "password": "securepass123"},
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["email"] == "admin@test.com"
|
||||
assert data["role"] == "admin"
|
||||
mock_db.create_user.assert_called_once_with(
|
||||
email="admin@test.com", password="securepass123", role="admin"
|
||||
)
|
||||
|
||||
def test_register_subsequent_user_gets_user_role(self, client, mock_db):
|
||||
"""Non-first user should get regular user role."""
|
||||
mock_db.get_user_count.return_value = 1
|
||||
mock_db.create_user.return_value = _make_regular_user()
|
||||
|
||||
response = client.post(
|
||||
"/auth/register",
|
||||
json={"email": "user@test.com", "password": "securepass123"},
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["role"] == "user"
|
||||
|
||||
def test_register_duplicate_email_returns_400(self, client, mock_db):
|
||||
"""Registering with an existing email should return 400."""
|
||||
mock_db.get_user_count.return_value = 1
|
||||
mock_db.create_user.return_value = None # indicates duplicate
|
||||
|
||||
response = client.post(
|
||||
"/auth/register",
|
||||
json={"email": "existing@test.com", "password": "securepass123"},
|
||||
)
|
||||
|
||||
assert response.status_code == 400
|
||||
assert "already registered" in response.json()["detail"].lower()
|
||||
|
||||
|
||||
class TestLogin:
|
||||
"""POST /auth/login"""
|
||||
|
||||
def test_login_valid_credentials_returns_tokens(self, client, mock_db):
|
||||
"""Valid credentials should return access and refresh tokens."""
|
||||
user = _make_regular_user()
|
||||
mock_db.authenticate_user.return_value = user
|
||||
|
||||
response = client.post(
|
||||
"/auth/login",
|
||||
json={"email": "user@test.com", "password": "correctpassword"},
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert "access_token" in data
|
||||
assert "refresh_token" in data
|
||||
assert data["token_type"] == "bearer"
|
||||
|
||||
def test_login_invalid_credentials_returns_401(self, client, mock_db):
|
||||
"""Invalid credentials should return 401."""
|
||||
mock_db.authenticate_user.return_value = None
|
||||
|
||||
response = client.post(
|
||||
"/auth/login",
|
||||
json={"email": "user@test.com", "password": "wrongpassword"},
|
||||
)
|
||||
|
||||
assert response.status_code == 401
|
||||
assert "invalid" in response.json()["detail"].lower()
|
||||
|
||||
|
||||
class TestGetMe:
|
||||
"""GET /auth/me"""
|
||||
|
||||
def test_valid_access_token_returns_user(self, client, mock_db):
|
||||
"""A valid access token should return the user's data."""
|
||||
user = _make_regular_user()
|
||||
mock_db.get_user_by_id.return_value = user
|
||||
|
||||
response = client.get("/auth/me", headers=_auth_header(user))
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["email"] == "user@test.com"
|
||||
assert data["id"] == 2
|
||||
|
||||
def test_missing_token_returns_401(self, client):
|
||||
"""No token should return 401 (403 from HTTPBearer)."""
|
||||
response = client.get("/auth/me")
|
||||
assert response.status_code in (401, 403)
|
||||
|
||||
def test_expired_token_returns_401(self, client, mock_db):
|
||||
"""An expired token should return 401."""
|
||||
# Create a token that has already expired
|
||||
from datetime import timedelta
|
||||
|
||||
import jwt as pyjwt
|
||||
from SPARC.auth import JWT_ALGORITHM, JWT_SECRET
|
||||
|
||||
payload = {
|
||||
"sub": "1",
|
||||
"email": "user@test.com",
|
||||
"role": "user",
|
||||
"exp": datetime.now(timezone.utc) - timedelta(hours=1),
|
||||
"type": "access",
|
||||
}
|
||||
expired_token = pyjwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
|
||||
|
||||
response = client.get(
|
||||
"/auth/me", headers={"Authorization": f"Bearer {expired_token}"}
|
||||
)
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_refresh_token_as_access_returns_401(self, client, mock_db):
|
||||
"""Using a refresh token as an access token should return 401."""
|
||||
user = _make_regular_user()
|
||||
refresh_token = create_refresh_token(user["id"], user["email"], user["role"])
|
||||
|
||||
response = client.get(
|
||||
"/auth/me", headers={"Authorization": f"Bearer {refresh_token}"}
|
||||
)
|
||||
assert response.status_code == 401
|
||||
|
||||
|
||||
class TestRefreshToken:
|
||||
"""POST /auth/refresh"""
|
||||
|
||||
def test_valid_refresh_token_returns_new_tokens(self, client, mock_db):
|
||||
"""A valid refresh token should issue new access and refresh tokens."""
|
||||
user = _make_regular_user()
|
||||
mock_db.get_user_by_id.return_value = user
|
||||
refresh = create_refresh_token(user["id"], user["email"], user["role"])
|
||||
|
||||
response = client.post(
|
||||
"/auth/refresh", json={"refresh_token": refresh}
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert "access_token" in data
|
||||
assert "refresh_token" in data
|
||||
|
||||
def test_invalid_refresh_token_returns_401(self, client, mock_db):
|
||||
"""An invalid refresh token should return 401."""
|
||||
response = client.post(
|
||||
"/auth/refresh", json={"refresh_token": "invalid-token-string"}
|
||||
)
|
||||
assert response.status_code == 401
|
||||
|
||||
def test_access_token_as_refresh_returns_401(self, client, mock_db):
|
||||
"""Using an access token as a refresh token should return 401."""
|
||||
user = _make_regular_user()
|
||||
access = create_access_token(user["id"], user["email"], user["role"])
|
||||
|
||||
response = client.post(
|
||||
"/auth/refresh", json={"refresh_token": access}
|
||||
)
|
||||
assert response.status_code == 401
|
||||
|
||||
|
||||
class TestAdminUsers:
|
||||
"""GET /admin/users and PATCH /admin/users/{id}/role"""
|
||||
|
||||
def test_admin_can_list_users(self, client, mock_db):
|
||||
"""Admin token should allow listing users."""
|
||||
admin = _make_admin_user()
|
||||
mock_db.get_user_by_id.return_value = admin
|
||||
mock_db.get_all_users.return_value = [admin, _make_regular_user()]
|
||||
|
||||
response = client.get("/admin/users", headers=_auth_header(admin))
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert len(data) == 2
|
||||
|
||||
def test_regular_user_cannot_list_users(self, client, mock_db):
|
||||
"""Regular user token should be rejected with 403."""
|
||||
user = _make_regular_user()
|
||||
mock_db.get_user_by_id.return_value = user
|
||||
|
||||
response = client.get("/admin/users", headers=_auth_header(user))
|
||||
|
||||
assert response.status_code == 403
|
||||
|
||||
def test_no_token_cannot_list_users(self, client):
|
||||
"""No token should be rejected."""
|
||||
response = client.get("/admin/users")
|
||||
assert response.status_code in (401, 403)
|
||||
|
||||
def test_admin_can_change_user_role(self, client, mock_db):
|
||||
"""Admin should be able to change another user's role."""
|
||||
admin = _make_admin_user()
|
||||
mock_db.get_user_by_id.return_value = admin
|
||||
mock_db.update_user_role.return_value = {
|
||||
"id": 2,
|
||||
"email": "user@test.com",
|
||||
"role": "admin",
|
||||
"created_at": datetime(2025, 1, 1, tzinfo=timezone.utc),
|
||||
}
|
||||
|
||||
response = client.patch(
|
||||
"/admin/users/2/role",
|
||||
json={"role": "admin"},
|
||||
headers=_auth_header(admin),
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
assert response.json()["role"] == "admin"
|
||||
|
||||
def test_admin_cannot_change_own_role(self, client, mock_db):
|
||||
"""Admin should not be able to change their own role."""
|
||||
admin = _make_admin_user()
|
||||
mock_db.get_user_by_id.return_value = admin
|
||||
|
||||
response = client.patch(
|
||||
"/admin/users/1/role",
|
||||
json={"role": "user"},
|
||||
headers=_auth_header(admin),
|
||||
)
|
||||
|
||||
assert response.status_code == 400
|
||||
assert "own role" in response.json()["detail"].lower()
|
||||
Reference in New Issue
Block a user