feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins

- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin - Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API) - Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()` - Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs - Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics
2026-06-17 14:08:28 +00:00
parent 6b5347103b
commit 0a554ebc32
71 changed files with 1868 additions and 527 deletions
@@ -0,0 +1,166 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _settings(app_server):
+    for key, value in {
+        "rate_limit_per_minute": "1000000",
+        "rate_limit_window_seconds": "60",
+        "registration_open": "1",
+        "maintenance_mode": "0",
+        "session_max_age_days": "7",
+        "session_remember_days": "30",
+    }.items():
+        set_setting(key, value)
+    yield
+
+
+def _db_user(name):
+    refresh_snapshot()
+    return get_table("users").find_one(username=name)
+
+
+def _unique(prefix="sen"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _signup():
+    name = _unique("senmem")
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return name
+
+
+def _key_session(name):
+    s = requests.Session()
+    s.headers.update({"X-API-KEY": _db_user(name)["api_key"]})
+    return s
+
+
+def _alice():
+    return _key_session("alice_test")
+
+
+def _promote(actor, uid):
+    actor.post(
+        f"{BASE_URL}/admin/users/{uid}/role",
+        headers=JSON,
+        data={"role": "admin"},
+        allow_redirects=False,
+    )
+
+
+def _audit(session, **params):
+    r = session.get(f"{BASE_URL}/admin/audit-log", headers=JSON, params=params)
+    assert r.status_code == 200, r.text[:300]
+    return r.json()["entries"]
+
+
+def _denied(session, event_key, target_uid):
+    for e in _audit(session, event_key=event_key, result="denied"):
+        if e.get("target_uid") == target_uid:
+            return e
+    return None
+
+
+def _junior_admin(seeded_db):
+    alice = _alice()
+    name = _signup()
+    uid = _db_user(name)["uid"]
+    _promote(alice, uid)
+    assert _db_user(name)["role"] == "Admin"
+    return _key_session(name), name, uid
+
+
+def test_junior_admin_cannot_change_senior_admin_role(seeded_db):
+    junior, _, _ = _junior_admin(seeded_db)
+    alice_uid = _db_user("alice_test")["uid"]
+    junior.post(
+        f"{BASE_URL}/admin/users/{alice_uid}/role",
+        headers=JSON,
+        data={"role": "member"},
+        allow_redirects=False,
+    )
+    assert _denied(_alice(), "admin.user.role.change", alice_uid) is not None
+    assert _db_user("alice_test")["role"] == "Admin"
+
+
+def test_junior_admin_cannot_disable_senior_admin(seeded_db):
+    junior, _, _ = _junior_admin(seeded_db)
+    alice_uid = _db_user("alice_test")["uid"]
+    junior.post(
+        f"{BASE_URL}/admin/users/{alice_uid}/toggle",
+        headers=JSON,
+        allow_redirects=False,
+    )
+    assert _denied(_alice(), "admin.user.active.disable", alice_uid) is not None
+    assert _db_user("alice_test").get("is_active", True)
+
+
+def test_junior_admin_cannot_reset_senior_admin_password(seeded_db):
+    junior, _, _ = _junior_admin(seeded_db)
+    alice_uid = _db_user("alice_test")["uid"]
+    before = _db_user("alice_test")["password_hash"]
+    junior.post(
+        f"{BASE_URL}/admin/users/{alice_uid}/password",
+        headers=JSON,
+        data={"password": "hijacked999"},
+        allow_redirects=False,
+    )
+    assert _denied(_alice(), "admin.user.password.reset", alice_uid) is not None
+    assert _db_user("alice_test")["password_hash"] == before
+
+
+def test_junior_admin_cannot_reset_senior_admin_quota(seeded_db):
+    junior, _, _ = _junior_admin(seeded_db)
+    alice_uid = _db_user("alice_test")["uid"]
+    junior.post(
+        f"{BASE_URL}/admin/users/{alice_uid}/reset-ai-quota",
+        headers=JSON,
+        allow_redirects=False,
+    )
+    assert _denied(_alice(), "admin.user.ai_quota.reset", alice_uid) is not None
+
+
+def test_senior_admin_can_disable_junior_admin(seeded_db):
+    _junior, _, junior_uid = _junior_admin(seeded_db)
+    alice = _alice()
+    alice.post(
+        f"{BASE_URL}/admin/users/{junior_uid}/toggle",
+        headers=JSON,
+        allow_redirects=False,
+    )
+    refresh_snapshot()
+    assert not get_table("users").find_one(uid=junior_uid).get("is_active", True)
+
+
+def test_junior_admin_can_manage_member(seeded_db):
+    junior, _, _ = _junior_admin(seeded_db)
+    member = _signup()
+    member_uid = _db_user(member)["uid"]
+    junior.post(
+        f"{BASE_URL}/admin/users/{member_uid}/toggle",
+        headers=JSON,
+        allow_redirects=False,
+    )
+    refresh_snapshot()
+    assert not get_table("users").find_one(uid=member_uid).get("is_active", True)