forked from retoor/devplacepy
Update
This commit is contained in:
@@ -0,0 +1,110 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import io
|
||||
import requests
|
||||
from datetime import datetime, timezone
|
||||
from PIL import Image
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.attachments import store_attachment
|
||||
from devplacepy.db_client import get_table
|
||||
from devplacepy.utils import generate_uid, make_combined_slug
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
|
||||
|
||||
def _login(seeded_db, who):
|
||||
s = requests.Session()
|
||||
creds = seeded_db[who]
|
||||
s.post(
|
||||
f"{BASE_URL}/auth/login",
|
||||
data={"email": creds["email"], "password": creds["password"]},
|
||||
allow_redirects=True,
|
||||
)
|
||||
return s
|
||||
|
||||
|
||||
def _png():
|
||||
buf = io.BytesIO()
|
||||
Image.new("RGBA", (24, 24), (5, 5, 5, 255)).save(buf, format="PNG")
|
||||
return buf.getvalue()
|
||||
|
||||
|
||||
def _seed_published(receiver_username, giver_username):
|
||||
receiver = get_table("users").find_one(username=receiver_username)
|
||||
giver = get_table("users").find_one(username=giver_username)
|
||||
uid = generate_uid()
|
||||
slug = make_combined_slug("Admin revoke", uid)
|
||||
now = datetime.now(timezone.utc).isoformat()
|
||||
att512 = store_attachment(_png(), "award-512.png", receiver["uid"])
|
||||
att256 = store_attachment(_png(), "award-256.png", giver["uid"])
|
||||
att64 = store_attachment(_png(), "award-64.png", giver["uid"])
|
||||
get_table("awards").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"slug": slug,
|
||||
"description": "Admin revoke",
|
||||
"giver_uid": giver["uid"],
|
||||
"receiver_uid": receiver["uid"],
|
||||
"attachment_uid_512": att512["uid"],
|
||||
"attachment_uid_256": att256["uid"],
|
||||
"attachment_uid_64": att64["uid"],
|
||||
"generated_at": now,
|
||||
"created_at": now,
|
||||
"job_uid": "",
|
||||
"deleted_at": None,
|
||||
"deleted_by": None,
|
||||
}
|
||||
)
|
||||
get_table("users").update(
|
||||
{
|
||||
"uid": receiver["uid"],
|
||||
"award_count": 1,
|
||||
"last_award_at": now,
|
||||
"last_award_slug": slug,
|
||||
"last_award_uid": uid,
|
||||
},
|
||||
["uid"],
|
||||
)
|
||||
return uid, slug, att512["uid"]
|
||||
|
||||
|
||||
def test_member_cannot_revoke_award(seeded_db):
|
||||
uid, _, _ = _seed_published("bob_test", "alice_test")
|
||||
bob = _login(seeded_db, "bob")
|
||||
r = bob.post(f"{BASE_URL}/admin/awards/{uid}/revoke", allow_redirects=False)
|
||||
assert r.status_code in (302, 303)
|
||||
admin = _login(seeded_db, "alice")
|
||||
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
||||
|
||||
|
||||
def test_admin_revoke_soft_deletes_and_recomputes(seeded_db):
|
||||
uid, slug, att512 = _seed_published("bob_test", "alice_test")
|
||||
admin = _login(seeded_db, "alice")
|
||||
r = admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
||||
assert r.status_code == 200
|
||||
row = get_table("awards").find_one(uid=uid)
|
||||
assert row.get("deleted_at")
|
||||
assert get_table("attachments").find_one(uid=att512).get("deleted_at")
|
||||
bob = get_table("users").find_one(username="bob_test")
|
||||
assert bob.get("award_count") == 0
|
||||
assert requests.get(f"{BASE_URL}/awards/{slug}/64").status_code == 404
|
||||
|
||||
|
||||
def test_media_gallery_hides_revoked_attachment(seeded_db):
|
||||
uid, _, att512 = _seed_published("bob_test", "alice_test")
|
||||
admin = _login(seeded_db, "alice")
|
||||
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
||||
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=media", headers=JSON)
|
||||
assert r.status_code == 200
|
||||
media = r.json().get("media", [])
|
||||
assert all(item.get("uid") != att512 for item in media)
|
||||
|
||||
|
||||
def test_admin_revoke_audit_recorded(seeded_db):
|
||||
uid, _, _ = _seed_published("bob_test", "alice_test")
|
||||
admin = _login(seeded_db, "alice")
|
||||
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
||||
data = admin.get(
|
||||
f"{BASE_URL}/admin/audit-log", headers=JSON, params={"event_key": "award.revoke"}
|
||||
).json()
|
||||
assert any(entry.get("target_uid") == uid for entry in data["entries"])
|
||||
@@ -0,0 +1,116 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import io
|
||||
import requests
|
||||
from datetime import datetime, timezone
|
||||
from PIL import Image
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.attachments import store_attachment
|
||||
from devplacepy.db_client import get_table
|
||||
from devplacepy.utils import generate_uid, make_combined_slug
|
||||
|
||||
|
||||
def _png():
|
||||
buf = io.BytesIO()
|
||||
Image.new("RGBA", (32, 32), (20, 40, 60, 255)).save(buf, format="PNG")
|
||||
return buf.getvalue()
|
||||
|
||||
|
||||
def _seed_published(receiver_uid, giver_uid, description="Published award"):
|
||||
uid = generate_uid()
|
||||
slug = make_combined_slug(description, uid)
|
||||
now = datetime.now(timezone.utc).isoformat()
|
||||
att = store_attachment(_png(), "award-256.png", receiver_uid)
|
||||
get_table("awards").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"slug": slug,
|
||||
"description": description,
|
||||
"giver_uid": giver_uid,
|
||||
"receiver_uid": receiver_uid,
|
||||
"attachment_uid_512": att["uid"],
|
||||
"attachment_uid_256": att["uid"],
|
||||
"attachment_uid_64": att["uid"],
|
||||
"generated_at": now,
|
||||
"created_at": now,
|
||||
"job_uid": "",
|
||||
"deleted_at": None,
|
||||
"deleted_by": None,
|
||||
}
|
||||
)
|
||||
return uid, slug, att["url"]
|
||||
|
||||
|
||||
def _user():
|
||||
uid = generate_uid()
|
||||
get_table("users").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"username": f"aw_{uid[:8]}",
|
||||
"email": f"{uid[:8]}@t.dev",
|
||||
"created_at": datetime.now(timezone.utc).isoformat(),
|
||||
}
|
||||
)
|
||||
return uid
|
||||
|
||||
|
||||
def test_published_award_redirects(app_server):
|
||||
giver = _user()
|
||||
receiver = _user()
|
||||
_, slug, url = _seed_published(receiver, giver)
|
||||
r = requests.get(f"{BASE_URL}/awards/{slug}/256", allow_redirects=False)
|
||||
assert r.status_code == 302
|
||||
assert r.headers["Location"] == url
|
||||
assert "immutable" in r.headers.get("Cache-Control", "")
|
||||
|
||||
|
||||
def test_pending_award_returns_404(app_server):
|
||||
uid = generate_uid()
|
||||
slug = make_combined_slug("pending", uid)
|
||||
now = datetime.now(timezone.utc).isoformat()
|
||||
get_table("awards").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"slug": slug,
|
||||
"description": "pending",
|
||||
"giver_uid": _user(),
|
||||
"receiver_uid": _user(),
|
||||
"attachment_uid_512": "",
|
||||
"attachment_uid_256": "",
|
||||
"attachment_uid_64": "",
|
||||
"generated_at": None,
|
||||
"created_at": now,
|
||||
"job_uid": "",
|
||||
"deleted_at": None,
|
||||
"deleted_by": None,
|
||||
}
|
||||
)
|
||||
assert requests.get(f"{BASE_URL}/awards/{slug}/256").status_code == 404
|
||||
|
||||
|
||||
def test_revoked_award_returns_404(app_server):
|
||||
giver = _user()
|
||||
receiver = _user()
|
||||
uid, slug, _ = _seed_published(receiver, giver, "revoked")
|
||||
get_table("awards").update(
|
||||
{"uid": uid, "deleted_at": datetime.now(timezone.utc).isoformat(), "deleted_by": giver},
|
||||
["uid"],
|
||||
)
|
||||
assert requests.get(f"{BASE_URL}/awards/{slug}/64").status_code == 404
|
||||
|
||||
|
||||
def test_lookup_by_bare_uid_works(app_server):
|
||||
giver = _user()
|
||||
receiver = _user()
|
||||
uid, slug, url = _seed_published(receiver, giver, "uid lookup")
|
||||
r = requests.get(f"{BASE_URL}/awards/{uid}/256", allow_redirects=False)
|
||||
assert r.status_code == 302
|
||||
assert r.headers["Location"] == url
|
||||
assert slug
|
||||
|
||||
|
||||
def test_invalid_size_returns_404(app_server):
|
||||
giver = _user()
|
||||
receiver = _user()
|
||||
_, slug, _ = _seed_published(receiver, giver)
|
||||
assert requests.get(f"{BASE_URL}/awards/{slug}/128").status_code == 404
|
||||
@@ -0,0 +1,190 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from datetime import datetime, timezone
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.db_client import get_table
|
||||
from devplacepy.utils import generate_uid, make_combined_slug
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
_counter = [0]
|
||||
|
||||
|
||||
def _signup():
|
||||
_counter[0] += 1
|
||||
name = f"award{int(time.time() * 1000)}{_counter[0]}"
|
||||
session = requests.Session()
|
||||
session.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
return session, name
|
||||
|
||||
|
||||
def _login(seeded_db, who):
|
||||
s = requests.Session()
|
||||
creds = seeded_db[who]
|
||||
s.post(
|
||||
f"{BASE_URL}/auth/login",
|
||||
data={"email": creds["email"], "password": creds["password"]},
|
||||
allow_redirects=True,
|
||||
)
|
||||
return s
|
||||
|
||||
|
||||
def _uid(username):
|
||||
return get_table("users").find_one(username=username)["uid"]
|
||||
|
||||
|
||||
def _audit_find(admin, event_key, target_uid):
|
||||
data = admin.get(
|
||||
f"{BASE_URL}/admin/audit-log", headers=JSON, params={"event_key": event_key}
|
||||
).json()
|
||||
for entry in data["entries"]:
|
||||
if entry.get("target_uid") == target_uid:
|
||||
return entry
|
||||
return None
|
||||
|
||||
|
||||
def test_give_award_json_shape(app_server):
|
||||
giver, _ = _signup()
|
||||
_, receiver_name = _signup()
|
||||
r = giver.post(
|
||||
f"{BASE_URL}/profile/{receiver_name}/award",
|
||||
headers=JSON,
|
||||
json={"description": "Great debugging"},
|
||||
)
|
||||
assert r.status_code == 200, r.text
|
||||
data = r.json()
|
||||
assert data["ok"] is True
|
||||
assert data["data"]["award_uid"]
|
||||
assert data["data"]["award_slug"]
|
||||
|
||||
|
||||
def test_guest_cannot_give_award(seeded_db):
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/profile/bob_test/award",
|
||||
headers=JSON,
|
||||
json={"description": "Nope"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert r.status_code in (302, 303, 401, 403)
|
||||
|
||||
|
||||
def test_self_award_rejected(seeded_db):
|
||||
bob = _login(seeded_db, "bob")
|
||||
r = bob.post(
|
||||
f"{BASE_URL}/profile/bob_test/award",
|
||||
headers=JSON,
|
||||
json={"description": "Self"},
|
||||
)
|
||||
assert r.status_code == 400
|
||||
|
||||
|
||||
def test_blocked_pair_rejects_award(seeded_db):
|
||||
alice = _login(seeded_db, "alice")
|
||||
bob = _login(seeded_db, "bob")
|
||||
alice.post(f"{BASE_URL}/block/bob_test", allow_redirects=False)
|
||||
try:
|
||||
r = alice.post(
|
||||
f"{BASE_URL}/profile/bob_test/award",
|
||||
headers=JSON,
|
||||
json={"description": "Blocked"},
|
||||
)
|
||||
assert r.status_code == 400
|
||||
r2 = bob.post(
|
||||
f"{BASE_URL}/profile/alice_test/award",
|
||||
headers=JSON,
|
||||
json={"description": "Reverse blocked"},
|
||||
)
|
||||
assert r2.status_code == 400
|
||||
finally:
|
||||
alice.post(f"{BASE_URL}/block/unblock/bob_test", allow_redirects=False)
|
||||
|
||||
|
||||
def test_giver_cooldown_rejects_second_award(app_server):
|
||||
giver, giver_name = _signup()
|
||||
_, target_a = _signup()
|
||||
_, target_b = _signup()
|
||||
first = giver.post(
|
||||
f"{BASE_URL}/profile/{target_a}/award",
|
||||
headers=JSON,
|
||||
json={"description": "First award"},
|
||||
)
|
||||
assert first.status_code == 200
|
||||
second = giver.post(
|
||||
f"{BASE_URL}/profile/{target_b}/award",
|
||||
headers=JSON,
|
||||
json={"description": "Second award"},
|
||||
)
|
||||
assert second.status_code == 400
|
||||
assert giver_name
|
||||
|
||||
|
||||
def test_receiver_cooldown_rejects_second_award(app_server):
|
||||
giver_a, _ = _signup()
|
||||
giver_b, _ = _signup()
|
||||
_, receiver = _signup()
|
||||
first = giver_a.post(
|
||||
f"{BASE_URL}/profile/{receiver}/award",
|
||||
headers=JSON,
|
||||
json={"description": "From giver a"},
|
||||
)
|
||||
assert first.status_code == 200
|
||||
second = giver_b.post(
|
||||
f"{BASE_URL}/profile/{receiver}/award",
|
||||
headers=JSON,
|
||||
json={"description": "From giver b"},
|
||||
)
|
||||
assert second.status_code == 400
|
||||
|
||||
|
||||
def test_muted_receiver_still_accepts_award(app_server):
|
||||
giver, giver_name = _signup()
|
||||
receiver_session, receiver_name = _signup()
|
||||
receiver_session.post(f"{BASE_URL}/mute/{giver_name}", allow_redirects=False)
|
||||
try:
|
||||
r = giver.post(
|
||||
f"{BASE_URL}/profile/{receiver_name}/award",
|
||||
headers=JSON,
|
||||
json={"description": "Muted ok"},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
finally:
|
||||
receiver_session.post(f"{BASE_URL}/mute/unmute/{giver_name}", allow_redirects=False)
|
||||
|
||||
|
||||
def test_valid_post_creates_pending_row_and_job(app_server):
|
||||
giver, _ = _signup()
|
||||
_, receiver_name = _signup()
|
||||
r = giver.post(
|
||||
f"{BASE_URL}/profile/{receiver_name}/award",
|
||||
headers=JSON,
|
||||
json={"description": "Fresh pending"},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
award_uid = r.json()["data"]["award_uid"]
|
||||
row = get_table("awards").find_one(uid=award_uid)
|
||||
assert row.get("generated_at") is None
|
||||
job = get_table("jobs").find_one(uid=row.get("job_uid"))
|
||||
assert job and job.get("kind") == "award"
|
||||
|
||||
|
||||
def test_award_give_audit_recorded(app_server):
|
||||
giver, _ = _signup()
|
||||
_, receiver_name = _signup()
|
||||
r = giver.post(
|
||||
f"{BASE_URL}/profile/{receiver_name}/award",
|
||||
headers=JSON,
|
||||
json={"description": "Audit me"},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
entry = _audit_find(giver, "award.give", _uid(receiver_name))
|
||||
assert entry is not None
|
||||
@@ -0,0 +1,93 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import io
|
||||
import requests
|
||||
from datetime import datetime, timezone
|
||||
from PIL import Image
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.attachments import store_attachment
|
||||
from devplacepy.db_client import get_table
|
||||
from devplacepy.utils import generate_uid, make_combined_slug
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
|
||||
|
||||
def _png():
|
||||
buf = io.BytesIO()
|
||||
Image.new("RGBA", (16, 16), (90, 10, 10, 255)).save(buf, format="PNG")
|
||||
return buf.getvalue()
|
||||
|
||||
|
||||
def _seed_published(receiver_username, giver_username, description):
|
||||
receiver = get_table("users").find_one(username=receiver_username)
|
||||
giver = get_table("users").find_one(username=giver_username)
|
||||
uid = generate_uid()
|
||||
slug = make_combined_slug(description, uid)
|
||||
now = datetime.now(timezone.utc).isoformat()
|
||||
att = store_attachment(_png(), "award-256.png", receiver["uid"])
|
||||
get_table("awards").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"slug": slug,
|
||||
"description": description,
|
||||
"giver_uid": giver["uid"],
|
||||
"receiver_uid": receiver["uid"],
|
||||
"attachment_uid_512": att["uid"],
|
||||
"attachment_uid_256": att["uid"],
|
||||
"attachment_uid_64": att["uid"],
|
||||
"generated_at": now,
|
||||
"created_at": now,
|
||||
"job_uid": "",
|
||||
"deleted_at": None,
|
||||
"deleted_by": None,
|
||||
}
|
||||
)
|
||||
get_table("users").update(
|
||||
{
|
||||
"uid": receiver["uid"],
|
||||
"award_count": 1,
|
||||
"last_award_at": now,
|
||||
"last_award_slug": slug,
|
||||
"last_award_uid": uid,
|
||||
},
|
||||
["uid"],
|
||||
)
|
||||
return slug
|
||||
|
||||
|
||||
def test_awards_tab_html_contains_grid_and_slug(seeded_db):
|
||||
slug = _seed_published("bob_test", "alice_test", "Tab award")
|
||||
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=awards")
|
||||
assert r.status_code == 200
|
||||
assert "awards-grid" in r.text
|
||||
assert slug in r.text
|
||||
|
||||
|
||||
def test_guest_can_read_awards_tab(seeded_db):
|
||||
_seed_published("bob_test", "alice_test", "Guest read")
|
||||
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=awards")
|
||||
assert r.status_code == 200
|
||||
assert "Give Award" not in r.text
|
||||
|
||||
|
||||
def test_awards_tab_json_includes_list(seeded_db):
|
||||
slug = _seed_published("bob_test", "alice_test", "JSON tab")
|
||||
r = requests.get(
|
||||
f"{BASE_URL}/profile/bob_test?tab=awards",
|
||||
headers=JSON,
|
||||
)
|
||||
assert r.status_code == 200
|
||||
data = r.json()
|
||||
assert data["awards_count"] >= 1
|
||||
assert any(item.get("slug") == slug for item in data.get("awards", []))
|
||||
|
||||
|
||||
def test_awards_tab_absent_when_count_zero(seeded_db):
|
||||
bob = get_table("users").find_one(username="bob_test")
|
||||
get_table("users").update(
|
||||
{"uid": bob["uid"], "award_count": 0, "last_award_uid": None, "last_award_slug": None},
|
||||
["uid"],
|
||||
)
|
||||
r = requests.get(f"{BASE_URL}/profile/bob_test")
|
||||
assert r.status_code == 200
|
||||
assert "tab=awards" not in r.text
|
||||
@@ -0,0 +1,109 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import pytest
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.database import get_table, refresh_snapshot, set_setting
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
_counter = [0]
|
||||
|
||||
|
||||
@pytest.fixture(scope="module", autouse=True)
|
||||
def _settings(app_server):
|
||||
set_setting("rate_limit_per_minute", "1000000")
|
||||
set_setting("registration_open", "1")
|
||||
set_setting("devii_interactions_default", "1")
|
||||
yield
|
||||
|
||||
|
||||
def _member():
|
||||
_counter[0] += 1
|
||||
name = f"ixp{int(time.time() * 1000)}{_counter[0]}"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
refresh_snapshot()
|
||||
user = get_table("users").find_one(username=name)
|
||||
return name, user["uid"], user["api_key"]
|
||||
|
||||
|
||||
def _admin_key(seeded_db):
|
||||
refresh_snapshot()
|
||||
return get_table("users").find_one(username="alice_test")["api_key"]
|
||||
|
||||
|
||||
def test_owner_disables_interactions(app_server):
|
||||
name, uid, key = _member()
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/profile/{name}/interactions",
|
||||
headers={"X-API-KEY": key, **JSON},
|
||||
data={"enabled": "false"},
|
||||
)
|
||||
assert r.status_code == 200, r.text[:200]
|
||||
body = r.json()["data"]
|
||||
assert body["enabled"] is False
|
||||
assert body["source"] == "user"
|
||||
refresh_snapshot()
|
||||
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
|
||||
|
||||
|
||||
def test_owner_resets_to_default(app_server):
|
||||
name, uid, key = _member()
|
||||
requests.post(
|
||||
f"{BASE_URL}/profile/{name}/interactions",
|
||||
headers={"X-API-KEY": key, **JSON},
|
||||
data={"enabled": "false"},
|
||||
)
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/profile/{name}/interactions",
|
||||
headers={"X-API-KEY": key, **JSON},
|
||||
data={"reset": "true"},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
body = r.json()["data"]
|
||||
assert body["source"] == "default"
|
||||
refresh_snapshot()
|
||||
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == -1
|
||||
|
||||
|
||||
def test_admin_sets_for_other_user(seeded_db):
|
||||
name, uid, key = _member()
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/profile/{name}/interactions",
|
||||
headers={"X-API-KEY": _admin_key(seeded_db), **JSON},
|
||||
data={"enabled": "false"},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
refresh_snapshot()
|
||||
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
|
||||
|
||||
|
||||
def test_non_owner_forbidden(app_server):
|
||||
name, uid, key = _member()
|
||||
_, _, other_key = _member()
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/profile/{name}/interactions",
|
||||
headers={"X-API-KEY": other_key, **JSON},
|
||||
data={"enabled": "false"},
|
||||
)
|
||||
assert r.status_code == 403
|
||||
|
||||
|
||||
def test_guest_rejected(app_server):
|
||||
name, uid, key = _member()
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/profile/{name}/interactions",
|
||||
headers=JSON,
|
||||
data={"enabled": "false"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert r.status_code in (401, 303)
|
||||
Reference in New Issue
Block a user