kitos
2afb886cd9
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Adds GET /users/operators (leads+admin) and wires a lead-only assign
control into the test detail header, calling the existing but
previously unreachable POST /tests/{id}/assign endpoint. Manual
assignment now also pushes the Jira ticket assignee immediately
instead of waiting for the operator to start execution.
Also adds test.platform as a kebab-case label on Jira ticket creation.
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
"""Tests for GET /users/operators — lead/admin-reachable operator picker list."""
|
|
|
|
|
|
def test_red_lead_can_list_operators(client, red_lead_headers, red_tech_user, blue_tech_user, red_lead_user):
|
|
resp = client.get("/api/v1/users/operators", headers=red_lead_headers)
|
|
assert resp.status_code == 200, resp.text
|
|
usernames = {u["username"] for u in resp.json()}
|
|
assert "redtech" in usernames
|
|
assert "bluetech" in usernames
|
|
assert "redlead" in usernames
|
|
|
|
|
|
def test_operators_list_excludes_viewers(client, red_lead_headers, db):
|
|
from app.auth import hash_password
|
|
from app.models.user import User
|
|
|
|
viewer = User(
|
|
username="viewer_ops", email="viewer_ops@test.com",
|
|
hashed_password=hash_password("x"), role="viewer", is_active=True,
|
|
must_change_password=False,
|
|
)
|
|
db.add(viewer)
|
|
db.commit()
|
|
|
|
resp = client.get("/api/v1/users/operators", headers=red_lead_headers)
|
|
assert resp.status_code == 200
|
|
usernames = {u["username"] for u in resp.json()}
|
|
assert "viewer_ops" not in usernames
|
|
|
|
|
|
def test_red_tech_cannot_list_operators(client, red_tech_headers):
|
|
resp = client.get("/api/v1/users/operators", headers=red_tech_headers)
|
|
assert resp.status_code == 403
|