kitos
a46aa157f3
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Admin can no longer be picked as a red_tech/blue_tech assignee — it administers the site, it doesn't operate tests. Applied to the eligible-assignee list on both the picker UI and the assign endpoint's validation, and dropped from the GET /users/operators pool. push_assignee_update() now falls back to a fresh Jira account-id lookup when the assignee hasn't logged in yet (so jira_account_id is still empty), instead of silently no-op'ing — assignment now syncs to Jira immediately regardless of whether the assignee has ever logged into Aegis before.
55 lines
2.1 KiB
Python
55 lines
2.1 KiB
Python
"""Tests for GET /users/operators — lead/manager-reachable operator picker list."""
|
|
|
|
|
|
def test_red_lead_can_list_operators(client, red_lead_headers, red_tech_user, blue_tech_user, red_lead_user):
|
|
resp = client.get("/api/v1/users/operators", headers=red_lead_headers)
|
|
assert resp.status_code == 200, resp.text
|
|
usernames = {u["username"] for u in resp.json()}
|
|
assert "redtech" in usernames
|
|
assert "bluetech" in usernames
|
|
assert "redlead" in usernames
|
|
|
|
|
|
def test_operators_list_excludes_viewers(client, red_lead_headers, db):
|
|
from app.auth import hash_password
|
|
from app.models.user import User
|
|
|
|
viewer = User(
|
|
username="viewer_ops", email="viewer_ops@test.com",
|
|
hashed_password=hash_password("x"), role="viewer", is_active=True,
|
|
must_change_password=False,
|
|
)
|
|
db.add(viewer)
|
|
db.commit()
|
|
|
|
resp = client.get("/api/v1/users/operators", headers=red_lead_headers)
|
|
assert resp.status_code == 200
|
|
usernames = {u["username"] for u in resp.json()}
|
|
assert "viewer_ops" not in usernames
|
|
|
|
|
|
def test_red_tech_cannot_list_operators(client, red_tech_headers):
|
|
resp = client.get("/api/v1/users/operators", headers=red_tech_headers)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_admin_cannot_list_operators(client, auth_headers):
|
|
"""Admin administers the site — coordinating operators is a lead/manager call."""
|
|
resp = client.get("/api/v1/users/operators", headers=auth_headers)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_manager_can_list_operators(client, manager_headers, red_tech_user):
|
|
resp = client.get("/api/v1/users/operators", headers=manager_headers)
|
|
assert resp.status_code == 200, resp.text
|
|
usernames = {u["username"] for u in resp.json()}
|
|
assert "redtech" in usernames
|
|
|
|
|
|
def test_operators_list_excludes_admin(client, manager_headers, admin_user):
|
|
"""Admin can't be assigned as an operator, so it shouldn't appear in the picker."""
|
|
resp = client.get("/api/v1/users/operators", headers=manager_headers)
|
|
assert resp.status_code == 200
|
|
usernames = {u["username"] for u in resp.json()}
|
|
assert admin_user.username not in usernames
|