mirror of
https://github.com/mealie-recipes/mealie.git
synced 2025-11-03 18:53:17 -05:00
6320ba7ec5
* Enhance security and safety around user update API - Prevent a regular user from promoting themself to admin - Prevent an admin from demoting themself - Refactor token fixture to admin + regular user tokens * Restrict user CRUD API to admins * Secure admin API routes * Refactor APIrouter into Admin/UserAPIRouter * Secure theme routes * Make 'all recipes' routes public * Secure favorite routes * Remove redundant checks * Fix public routes mistakenly flagged user routes * Make webhooks changeable only by admin * Allow users to create categories and tags * Address lint issues
29 lines
814 B
Python
29 lines
814 B
Python
import json
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
from tests.app_routes import AppRoutes
|
|
|
|
|
|
@pytest.fixture
|
|
def backup_data():
|
|
return {
|
|
"name": "test_backup_2021-Apr-27.zip",
|
|
"force": True,
|
|
"recipes": True,
|
|
"settings": False, # ! Broken
|
|
"themes": True,
|
|
"groups": True,
|
|
"users": True,
|
|
"pages": True,
|
|
}
|
|
|
|
|
|
def test_import(api_client: TestClient, api_routes: AppRoutes, backup_data, admin_token):
|
|
import_route = api_routes.backups_file_name_import("test_backup_2021-Apr-27.zip")
|
|
response = api_client.post(import_route, json=backup_data, headers=admin_token)
|
|
assert response.status_code == 200
|
|
for _, value in json.loads(response.content).items():
|
|
for v in value:
|
|
assert v["status"] is True
|