mirror of
https://github.com/mealie-recipes/mealie.git
synced 2025-10-31 02:03:35 -04:00
6320ba7ec5
* Enhance security and safety around user update API - Prevent a regular user from promoting themself to admin - Prevent an admin from demoting themself - Refactor token fixture to admin + regular user tokens * Restrict user CRUD API to admins * Secure admin API routes * Refactor APIrouter into Admin/UserAPIRouter * Secure theme routes * Make 'all recipes' routes public * Secure favorite routes * Remove redundant checks * Fix public routes mistakenly flagged user routes * Make webhooks changeable only by admin * Allow users to create categories and tags * Address lint issues
32 lines
960 B
Python
32 lines
960 B
Python
import json
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
from mealie.schema.settings import SiteSettings
|
|
from tests.app_routes import AppRoutes
|
|
|
|
|
|
@pytest.fixture(scope="function")
|
|
def default_settings():
|
|
return SiteSettings().dict(by_alias=True)
|
|
|
|
|
|
def test_default_settings(api_client: TestClient, api_routes: AppRoutes, default_settings):
|
|
response = api_client.get(api_routes.site_settings)
|
|
|
|
assert response.status_code == 200
|
|
|
|
assert json.loads(response.content) == default_settings
|
|
|
|
|
|
def test_update_settings(api_client: TestClient, api_routes: AppRoutes, default_settings, admin_token):
|
|
default_settings["language"] = "fr"
|
|
default_settings["showRecent"] = False
|
|
|
|
response = api_client.put(api_routes.site_settings, json=default_settings, headers=admin_token)
|
|
|
|
assert response.status_code == 200
|
|
|
|
response = api_client.get(api_routes.site_settings)
|
|
assert json.loads(response.content) == default_settings
|