feat: implementacao inicial do sistema LeadRadar

backend/tests/test_rbac.py

@@ -0,0 +1,43 @@
+def test_admin_can_list_users(client, admin_headers):
+    response = client.get('/api/v1/users', headers=admin_headers)
+    assert response.status_code == 200
+    data = response.get_json()
+    assert isinstance(data, list)
+
+def test_user_cannot_list_users(client, user_headers):
+    response = client.get('/api/v1/users', headers=user_headers)
+    assert response.status_code == 403
+    data = response.get_json()
+    assert 'Acesso negado' in data['error']
+
+def test_user_cannot_create_user(client, user_headers):
+    response = client.post('/api/v1/users', headers=user_headers, json={
+        'nome': 'Hacker User',
+        'email': 'hacker@test.com',
+        'password': 'Password123!',
+        'role': 'user'
+    })
+    assert response.status_code == 403
+
+def test_user_cannot_delete_user(client, user_headers, admin_user):
+    response = client.delete(f'/api/v1/users/{admin_user.id}', headers=user_headers)
+    assert response.status_code == 403
+
+def test_user_cannot_expunge_database(client, user_headers):
+    response = client.delete('/api/v1/leads/bulk', headers=user_headers)
+    assert response.status_code == 403
+
+def test_admin_can_create_and_delete_user(client, admin_headers):
+    # Criar usuario
+    create_res = client.post('/api/v1/users', headers=admin_headers, json={
+        'nome': 'Novo Operador',
+        'email': 'operador@test.com',
+        'password': 'OperadorPass123!',
+        'role': 'user'
+    })
+    assert create_res.status_code == 201
+    new_user_id = create_res.get_json()['id']
+
+    # Deletar usuario
+    delete_res = client.delete(f'/api/v1/users/{new_user_id}', headers=admin_headers)
+    assert delete_res.status_code == 200