kitos
09553f5c42
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
'manager' has been a fully-functional role throughout the app — notifications, operator assignment, dispute mediation — but was missing from both the user creation/update whitelist and the SSO auto-provisioning role list, so a manager account could never actually be created.
92 lines
2.8 KiB
Python
92 lines
2.8 KiB
Python
"""API-level validation tests for user creation (SEC-004, SEC-007)."""
|
|
|
|
|
|
def test_create_user_weak_password_rejected(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"username": "newuser",
|
|
"password": "123",
|
|
"email": "new@test.com",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 422
|
|
assert "password" in response.text.lower()
|
|
|
|
|
|
def test_create_user_reserved_username(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"username": "system",
|
|
"password": "SecurePass123!@#",
|
|
"email": "sys@test.com",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 422
|
|
|
|
|
|
def test_create_user_invalid_username_chars(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"username": "../admin",
|
|
"password": "SecurePass123!@#",
|
|
"email": "bad@test.com",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 422
|
|
|
|
|
|
def test_create_user_valid_password_accepted(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"username": "validuser99",
|
|
"password": "ValidPass123!@#",
|
|
"email": "valid@test.com",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 201
|
|
assert response.json()["username"] == "validuser99"
|
|
|
|
|
|
def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
|
|
"""Regression: 'manager' is a real, actively-used role (dispute mediation,
|
|
operator assignment) but was missing from the creation whitelist."""
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"username": "newmanager",
|
|
"password": "ValidPass123!@#",
|
|
"email": "newmanager@test.com",
|
|
"role": "manager",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 201, response.text
|
|
assert response.json()["role"] == "manager"
|
|
|
|
|
|
def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"username": "badroleuser",
|
|
"password": "ValidPass123!@#",
|
|
"email": "badrole@test.com",
|
|
"role": "superuser",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 400
|
|
assert "Invalid role" in response.text
|