64 lines
2.6 KiB
Python
64 lines
2.6 KiB
Python
|
"""HTTP-ссылки на занятие не дают курсанту чужую карточку или чек-лист."""
|
||
|
|
|
||
|
|
from types import SimpleNamespace
|
||
|
|
from uuid import uuid4
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
from fastapi import HTTPException, Request
|
||
|
|
|
||
|
|
from app.api.auth import Principal
|
||
|
|
from app.api.http import sessions
|
||
|
|
from app.domain.events import Exercise
|
||
|
|
from app.domain.roles import Role
|
||
|
|
|
||
|
|
|
||
|
|
def request() -> Request:
|
||
|
|
return Request({"type": "http", "method": "GET", "path": "/", "headers": []})
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.asyncio
|
||
|
|
async def test_trainee_cannot_read_foreign_session(monkeypatch):
|
||
|
|
who = Principal(login="trainee", full_name="Курсант", role=Role.TRAINEE, trainee_id=uuid4())
|
||
|
|
monkeypatch.setattr(sessions, "require", lambda _: who)
|
||
|
|
|
||
|
|
async def row(_db, _session_id):
|
||
|
|
return SimpleNamespace(trainee_id=uuid4())
|
||
|
|
|
||
|
|
monkeypatch.setattr(sessions.repo, "get_session", row)
|
||
|
|
with pytest.raises(HTTPException) as error:
|
||
|
|
await sessions.read(uuid4(), request(), db=object())
|
||
|
|
assert error.value.status_code == 403
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.asyncio
|
||
|
|
async def test_trainee_cannot_read_foreign_checklist(monkeypatch):
|
||
|
|
who = Principal(login="trainee", full_name="Курсант", role=Role.TRAINEE, trainee_id=uuid4())
|
||
|
|
monkeypatch.setattr(sessions, "require", lambda _: who)
|
||
|
|
monkeypatch.setattr(sessions.hub, "get", lambda _: SimpleNamespace(trainee_id=uuid4(), ended=True))
|
||
|
|
with pytest.raises(HTTPException) as error:
|
||
|
|
await sessions.checklist(uuid4(), request())
|
||
|
|
assert error.value.status_code == 403
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.asyncio
|
||
|
|
async def test_trainee_cannot_bypass_self_assessment_via_report(monkeypatch):
|
||
|
|
trainee_id = uuid4()
|
||
|
|
who = Principal(login="trainee", full_name="Курсант", role=Role.TRAINEE, trainee_id=trainee_id)
|
||
|
|
monkeypatch.setattr(sessions, "require", lambda _: who)
|
||
|
|
state = SimpleNamespace(
|
||
|
|
trainee_id=trainee_id, exercise=Exercise.CALL, self_assessed=False,
|
||
|
|
score={"score_auto": 100},
|
||
|
|
)
|
||
|
|
monkeypatch.setattr(sessions, "_live", lambda _: (state, object()))
|
||
|
|
with pytest.raises(HTTPException) as error:
|
||
|
|
await sessions.report(uuid4(), request())
|
||
|
|
assert error.value.status_code == 409
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.asyncio
|
||
|
|
async def test_trainee_without_profile_cannot_list_everyones_sessions(monkeypatch):
|
||
|
|
who = Principal(login="unlinked", full_name="Курсант", role=Role.TRAINEE, trainee_id=None)
|
||
|
|
monkeypatch.setattr(sessions, "require", lambda _: who)
|
||
|
|
with pytest.raises(HTTPException) as error:
|
||
|
|
await sessions.listing(request(), db=object())
|
||
|
|
assert error.value.status_code == 403
|