44 lines
1.6 KiB
Python
44 lines
1.6 KiB
Python
def test_admin_can_list_users(client, admin_headers):
|
|
response = client.get('/api/v1/users', headers=admin_headers)
|
|
assert response.status_code == 200
|
|
data = response.get_json()
|
|
assert isinstance(data, list)
|
|
|
|
def test_user_cannot_list_users(client, user_headers):
|
|
response = client.get('/api/v1/users', headers=user_headers)
|
|
assert response.status_code == 403
|
|
data = response.get_json()
|
|
assert 'Acesso negado' in data['error']
|
|
|
|
def test_user_cannot_create_user(client, user_headers):
|
|
response = client.post('/api/v1/users', headers=user_headers, json={
|
|
'nome': 'Hacker User',
|
|
'email': 'hacker@test.com',
|
|
'password': 'Password123!',
|
|
'role': 'user'
|
|
})
|
|
assert response.status_code == 403
|
|
|
|
def test_user_cannot_delete_user(client, user_headers, admin_user):
|
|
response = client.delete(f'/api/v1/users/{admin_user.id}', headers=user_headers)
|
|
assert response.status_code == 403
|
|
|
|
def test_user_cannot_expunge_database(client, user_headers):
|
|
response = client.delete('/api/v1/leads/bulk', headers=user_headers)
|
|
assert response.status_code == 403
|
|
|
|
def test_admin_can_create_and_delete_user(client, admin_headers):
|
|
# Criar usuario
|
|
create_res = client.post('/api/v1/users', headers=admin_headers, json={
|
|
'nome': 'Novo Operador',
|
|
'email': 'operador@test.com',
|
|
'password': 'OperadorPass123!',
|
|
'role': 'user'
|
|
})
|
|
assert create_res.status_code == 201
|
|
new_user_id = create_res.get_json()['id']
|
|
|
|
# Deletar usuario
|
|
delete_res = client.delete(f'/api/v1/users/{new_user_id}', headers=admin_headers)
|
|
assert delete_res.status_code == 200
|