chore: reorganize test files into domain-specific subdirectories under tests/

Split the monolithic test directory into three tiers (unit, api, e2e) with a path-mirroring directory structure. Added corresponding Makefile targets (test-unit, test-api, test-e2e) and updated all documentation references (CLAUDE.md, README.md, testing-cicd.html, testing-framework.html, testing-make.html) to reflect the new layout and naming conventions.
2026-06-13 14:32:33 +00:00
parent 014c4c6bb3
commit 43f4011005
268 changed files with 20634 additions and 9206 deletions
@@ -0,0 +1,61 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+JSON_content_negotiation = {"Accept": "application/json"}
+_counter_content_negotiation = [0]
+def _session_content_negotiation(password="secret123"):
+    _counter_content_negotiation[0] += 1
+    name = f"cn{int(time.time() * 1000)}{_counter_content_negotiation[0]}"
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": password,
+            "confirm_password": password,
+        },
+        allow_redirects=True,
+    )
+    return s, name
+PUBLIC_PAGES = ["/feed", "/projects", "/gists", "/news", "/leaderboard", "/bugs"]
+
+
+def test_admin_pages_negotiate(seeded_db):
+    users = get_table("users")
+    # unauthenticated: JSON_content_negotiation -> 401, browser -> redirect to login
+    assert (
+        requests.get(
+            f"{BASE_URL}/admin/users", headers=JSON_content_negotiation, allow_redirects=False
+        ).status_code
+        == 401
+    )
+    assert (
+        requests.get(f"{BASE_URL}/admin/users", allow_redirects=False).status_code
+        == 303
+    )
+    # authenticated non-admin (a fresh member): JSON_content_negotiation -> 403
+    _, member = _session_content_negotiation()
+    member_key = users.find_one(username=member)["api_key"]
+    assert (
+        requests.get(
+            f"{BASE_URL}/admin/users",
+            headers={**JSON_content_negotiation, "X-API-KEY": member_key},
+            allow_redirects=False,
+        ).status_code
+        == 403
+    )
+    # admin: promote a user whose key has not been cached yet
+    admin = _session_content_negotiation()[1]
+    admin_row = users.find_one(username=admin)
+    users.update({"uid": admin_row["uid"], "role": "Admin"}, ["uid"])
+    r = requests.get(
+        f"{BASE_URL}/admin/users", headers={**JSON_content_negotiation, "X-API-KEY": admin_row["api_key"]}
+    )
+    assert r.status_code == 200
+    assert "users" in r.json()
+    first = r.json()["users"][0]
+    assert "password_hash" not in first and "api_key" not in first