kitos
0b60531677
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Manager could not see the Review Queue nav item, load the page, or call mark-reviewed (red_lead/blue_lead/admin only) — added to the route guard, sidebar visibility, badge query, and the backend endpoint's role check. Webhook Configuration was shown to red_lead/blue_lead in Settings even though the backend already restricted every webhook endpoint to admin only — the tab is now admin-only in the UI too, matching what was already enforced server-side.
26 lines
1.0 KiB
Python
26 lines
1.0 KiB
Python
"""Manager must have the same Review Queue access as red_lead/blue_lead —
|
|
mark_reviewed was previously red_lead/blue_lead (and admin) only."""
|
|
|
|
|
|
def test_manager_can_mark_technique_reviewed(client, db, api, auth_headers, manager_headers):
|
|
resp = api(
|
|
"post", "/api/v1/techniques", auth_headers,
|
|
json={"mitre_id": "T1059.400", "name": "Manager Review Access Technique"},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
|
|
resp = api("patch", "/api/v1/techniques/T1059.400/review", manager_headers)
|
|
assert resp.status_code == 200, resp.text
|
|
assert resp.json()["review_required"] is False
|
|
|
|
|
|
def test_red_tech_cannot_mark_technique_reviewed(client, db, api, auth_headers, red_tech_headers):
|
|
resp = api(
|
|
"post", "/api/v1/techniques", auth_headers,
|
|
json={"mitre_id": "T1059.401", "name": "Red Tech No Access Technique"},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
|
|
resp = api("patch", "/api/v1/techniques/T1059.401/review", red_tech_headers)
|
|
assert resp.status_code == 403
|