mirror of
https://github.com/mealie-recipes/mealie.git
synced 2025-10-30 17:53:31 -04:00
6320ba7ec5
* Enhance security and safety around user update API - Prevent a regular user from promoting themself to admin - Prevent an admin from demoting themself - Refactor token fixture to admin + regular user tokens * Restrict user CRUD API to admins * Secure admin API routes * Refactor APIrouter into Admin/UserAPIRouter * Secure theme routes * Make 'all recipes' routes public * Secure favorite routes * Remove redundant checks * Fix public routes mistakenly flagged user routes * Make webhooks changeable only by admin * Allow users to create categories and tags * Address lint issues
59 lines
1.7 KiB
Python
59 lines
1.7 KiB
Python
import json
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
from tests.app_routes import AppRoutes
|
|
|
|
|
|
@pytest.fixture
|
|
def group_data():
|
|
return {"name": "Test Group"}
|
|
|
|
|
|
def test_create_group(api_client: TestClient, api_routes: AppRoutes, admin_token):
|
|
response = api_client.post(api_routes.groups, json={"name": "Test Group"}, headers=admin_token)
|
|
|
|
assert response.status_code == 201
|
|
|
|
|
|
def test_get_self_group(api_client: TestClient, api_routes: AppRoutes, admin_token):
|
|
response = api_client.get(api_routes.groups, headers=admin_token)
|
|
|
|
assert response.status_code == 200
|
|
assert len(json.loads(response.text)) >= 2
|
|
|
|
|
|
def test_update_group(api_client: TestClient, api_routes: AppRoutes, admin_token):
|
|
new_data = {
|
|
"name": "New Group Name",
|
|
"id": 2,
|
|
"categories": [],
|
|
"webhookUrls": [],
|
|
"webhookTime": "00:00",
|
|
"webhookEnable": False,
|
|
"users": [],
|
|
"mealplans": [],
|
|
"shoppingLists": [],
|
|
}
|
|
# Test Update
|
|
response = api_client.put(api_routes.groups_id(2), json=new_data, headers=admin_token)
|
|
assert response.status_code == 200
|
|
|
|
# Validate Changes
|
|
response = api_client.get(api_routes.groups, headers=admin_token)
|
|
all_groups = json.loads(response.text)
|
|
id_2 = filter(lambda x: x["id"] == 2, all_groups)
|
|
assert next(id_2) == new_data
|
|
|
|
|
|
def test_home_group_not_deletable(api_client: TestClient, api_routes: AppRoutes, admin_token):
|
|
response = api_client.delete(api_routes.groups_id(1), headers=admin_token)
|
|
|
|
assert response.status_code == 400
|
|
|
|
|
|
def test_delete_group(api_client: TestClient, api_routes: AppRoutes, admin_token):
|
|
response = api_client.delete(api_routes.groups_id(2), headers=admin_token)
|
|
|
|
assert response.status_code == 200
|