"""A manager (and only a manager) can delete a standalone test from the queue, but only while it hasn't started yet (draft) and isn't linked to any campaign — a test already in progress, or one that's part of a campaign's plan, must go through the normal workflow instead. """ import pytest @pytest.fixture def technique(api, auth_headers): resp = api( "post", "/api/v1/techniques", auth_headers, json={"mitre_id": "T1059.600", "name": "Command Line Delete Test"}, ) assert resp.status_code == 201, resp.text return resp.json()["id"] @pytest.fixture def draft_test(api, red_lead_headers, technique): resp = api( "post", "/api/v1/tests", red_lead_headers, json={"technique_id": technique, "name": "Standalone draft test"}, ) assert resp.status_code == 201, resp.text return resp.json()["id"] def test_manager_can_delete_draft_standalone_test(api, manager_headers, draft_test): resp = api("delete", f"/api/v1/tests/{draft_test}", manager_headers) assert resp.status_code == 204, resp.text reloaded = api("get", f"/api/v1/tests/{draft_test}", manager_headers) assert reloaded.status_code == 404 def test_red_lead_cannot_delete_test(api, red_lead_headers, draft_test): resp = api("delete", f"/api/v1/tests/{draft_test}", red_lead_headers) assert resp.status_code == 403 def test_admin_cannot_delete_test(api, auth_headers, draft_test): resp = api("delete", f"/api/v1/tests/{draft_test}", auth_headers) assert resp.status_code == 403 def test_manager_cannot_delete_started_test(api, manager_headers, red_tech_headers, draft_test): started = api("post", f"/api/v1/tests/{draft_test}/start-execution", red_tech_headers) assert started.status_code == 200, started.text resp = api("delete", f"/api/v1/tests/{draft_test}", manager_headers) assert resp.status_code == 400 def test_manager_cannot_delete_test_linked_to_a_campaign( api, db, manager_headers, red_lead_headers, draft_test, ): campaign = api( "post", "/api/v1/campaigns", red_lead_headers, json={"name": "Holds the test"}, ) assert campaign.status_code == 201, campaign.text campaign_id = campaign.json()["id"] add = api( "post", f"/api/v1/campaigns/{campaign_id}/tests", red_lead_headers, json={"test_id": draft_test}, ) assert add.status_code in (200, 201), add.text resp = api("delete", f"/api/v1/tests/{draft_test}", manager_headers) assert resp.status_code == 400