devplacepy/tests/api/admin/trash/purge.py

# retoor <retoor@molodetz.nl>

import time
import requests
from tests.conftest import BASE_URL

JSON_trash = {"Accept": "application/json"}
_counter_trash = [0]


def _unique_trash(prefix="tr"):
    _counter_trash[0] += 1
    return f"{prefix}{int(time.time() * 1000)}{_counter_trash[0]}"


def _member_trash():
    name = _unique_trash("trpmem")
    s = requests.Session()
    s.post(
        f"{BASE_URL}/auth/signup",
        data={
            "username": name,
            "email": f"{name}@t.dev",
            "password": "secret123",
            "confirm_password": "secret123",
            "birth_date": "1990-01-01",
            "accept_terms": "1",
        },
        allow_redirects=True,
    )
    return s, name


def _admin_trash(seeded_db):
    s = requests.Session()
    creds = seeded_db["alice"]
    s.post(
        f"{BASE_URL}/auth/login",
        data={"email": creds["email"], "password": creds["password"]},
        allow_redirects=True,
    )
    return s


def _create_post_trash(session):
    return session.post(
        f"{BASE_URL}/posts/create",
        headers=JSON_trash,
        data={"title": _unique_trash("trpp"), "content": "purge post body text", "topic": "devlog"},
    ).json()["data"]


def _soft_delete_post_trash(session, slug):
    session.post(f"{BASE_URL}/posts/delete/{slug}", headers=JSON_trash, allow_redirects=False)


def _audit_find(admin, event_key, target_uid):
    data = admin.get(
        f"{BASE_URL}/admin/audit-log", headers=JSON_trash, params={"event_key": event_key}
    ).json()
    for entry in data["entries"]:
        if entry.get("target_uid") == target_uid:
            return entry
    return None


def test_purge_requires_admin(seeded_db):
    member, _ = _member_trash()
    r = member.post(
        f"{BASE_URL}/admin/trash/posts/anything/purge", allow_redirects=False
    )
    assert r.status_code in (302, 303)


def test_purge_unknown_table_404(seeded_db):
    admin = _admin_trash(seeded_db)
    r = admin.post(
        f"{BASE_URL}/admin/trash/bogus/anything/purge",
        headers=JSON_trash,
        allow_redirects=False,
    )
    assert r.status_code == 404


def test_purge_hard_deletes_and_records_audit(seeded_db):
    member, _ = _member_trash()
    post = _create_post_trash(member)
    _soft_delete_post_trash(member, post["slug"])
    admin = _admin_trash(seeded_db)

    r = admin.post(
        f"{BASE_URL}/admin/trash/posts/{post['uid']}/purge",
        headers=JSON_trash,
        allow_redirects=False,
    )
    assert r.status_code == 200, r.text[:300]

    # gone from trash and not restorable (row hard-deleted)
    trash = admin.get(
        f"{BASE_URL}/admin/trash", headers=JSON_trash, params={"table": "posts"}
    ).json()
    assert all(item["uid"] != post["uid"] for item in trash["items"])

    entry = _audit_find(admin, "admin.trash.purge", post["uid"])
    assert entry is not None
    assert entry["result"] == "success"