kitos
4dea19cae9
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Admins now create users with a name + email (no password) and role; a Send Email action (per-user, also reusable for resets) issues a one-time token and POSTs it to an admin-configurable webhook URL — intended for a Power Automate flow that delivers the actual email. The old admin-sets-the-password flow is kept server-side (LegacyUserCreateWithPassword) but no longer wired into the UI. Every user-facing surface (top bar, sidebar, user management, audit log, assignee pickers, dispute notifications) now shows full_name instead of username, falling back to username when unset. Also fixes long attack_procedure/expected_detection/suggested_text text overflowing its container in the template review panels and Red/Blue team fields (missing break-words on whitespace-pre-wrap blocks).
97 lines
3.0 KiB
Python
97 lines
3.0 KiB
Python
"""API-level validation tests for user creation (SEC-004, SEC-007).
|
|
|
|
Users are created with a name + email — no password (see
|
|
password_setup_service for the emailed set-password link flow) and no
|
|
admin-supplied username (username is auto-derived from email).
|
|
"""
|
|
|
|
|
|
def test_create_user_missing_full_name_rejected(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"full_name": "",
|
|
"email": "new@test.com",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 422
|
|
|
|
|
|
def test_create_user_invalid_email_rejected(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"full_name": "New User",
|
|
"email": "not-an-email",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 422
|
|
|
|
|
|
def test_create_user_valid_request_accepted(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"full_name": "Valid User",
|
|
"email": "valid@test.com",
|
|
"role": "viewer",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 201, response.text
|
|
body = response.json()
|
|
assert body["full_name"] == "Valid User"
|
|
assert body["username"] == "valid@test.com"
|
|
assert body["must_change_password"] is True
|
|
|
|
|
|
def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
|
|
"""Regression: 'manager' is a real, actively-used role (dispute mediation,
|
|
operator assignment) but was missing from the creation whitelist."""
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"full_name": "New Manager",
|
|
"email": "newmanager@test.com",
|
|
"role": "manager",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 201, response.text
|
|
assert response.json()["role"] == "manager"
|
|
|
|
|
|
def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
|
|
response = client.post(
|
|
"/api/v1/users",
|
|
json={
|
|
"full_name": "Bad Role User",
|
|
"email": "badrole@test.com",
|
|
"role": "superuser",
|
|
},
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert response.status_code == 400
|
|
assert "Invalid role" in response.text
|
|
|
|
|
|
def test_create_user_duplicate_email_rejected(client, admin_user, admin_token):
|
|
payload = {
|
|
"full_name": "Dup User",
|
|
"email": "dup@test.com",
|
|
"role": "viewer",
|
|
}
|
|
first = client.post(
|
|
"/api/v1/users", json=payload, headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert first.status_code == 201, first.text
|
|
|
|
second = client.post(
|
|
"/api/v1/users", json=payload, headers={"Authorization": f"Bearer {admin_token}"},
|
|
)
|
|
assert second.status_code == 409
|