cloud-api/test/test_auth_su.py

"""
This module ensures super admin only endpoints do return a correctly formatted 401 when user is not a super admin
DELETE endpoints are not tested
"""

import pytest
from httpx import AsyncClient

pytestmark = [
	pytest.mark.auth,
	pytest.mark.super_admin,
]


@pytest.mark.anyio
async def test_get_user_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.get("/user?user_id=1")
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert resp.json()["detail"] == "Must be super admin"


@pytest.mark.anyio
async def test_patch_org_status_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.patch(
		"/org/status", json={"organisation_id": 1, "status": "submitted"}
	)
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert resp.json()["detail"] == "Must be super admin"


@pytest.mark.anyio
async def test_patch_org_root_user_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.patch(
		"/org/root_user", json={"organisation_id": 1, "user_id": 2}
	)
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert resp.json()["detail"] == "Must be super admin"


@pytest.mark.anyio
async def test_patch_service_key_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.patch("/service/key", json={"service_id": 1})
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert resp.json()["detail"] == "Must be super admin"


@pytest.mark.anyio
async def test_post_service_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.post("/service", json={"name": "New Test Service"})
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert resp.json()["detail"] == "Must be super admin"


@pytest.mark.anyio
async def test_post_perm_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.post(
		"/iam/permission",
		json={"service_id": 1, "resource": "test_resource", "action": "create"},
	)
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert resp.json()["detail"] == "Must be super admin"


@pytest.mark.anyio
async def test_post_org_user_auth_su(no_su_client: AsyncClient):
	resp = await no_su_client.post(
		"/org/user", json={"organisation_id": 1, "user_id": 2}
	)
	assert resp.status_code != 422
	assert resp.status_code == 403
	assert "Must be super admin" in resp.json()["detail"]