cloud-api/test/test_auth_approval.py

"""
This test module checks relevant endpoints to ensure only approved orgs get access or, for pre-approval endpoints, that they are not blocked.
Endpoints not checked here are endpoints that do not require an org check.
Delete endpoints are currently skipped because the testing system cannot use bodies in deletes.
"""

import pytest
from httpx import AsyncClient

pytestmark = [
	pytest.mark.auth,
	pytest.mark.preapproval,
]


@pytest.mark.anyio
async def test_get_org_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/org?org_id=3")
	assert resp.status_code != 422
	assert resp.status_code == 200


@pytest.mark.anyio
async def test_patch_org_questionnaire_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.patch(
		"/org/questionnaire",
		json={
			"organisation_id": 3,
			"intake_questionnaire": {
				"question_one": "new answer one",
				"question_two": None,
				"question_three": None,
			},
			"partial": True,
		},
	)
	assert resp.status_code != 422
	assert resp.status_code == 200


@pytest.mark.anyio
async def test_get_org_users_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/org/users?org_id=3")
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_get_org_groups_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/org/groups?org_id=3")
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_get_org_contact_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/org/contact?org_id=3&contact_type=billing")
	assert resp.status_code != 422
	assert resp.status_code == 200


@pytest.mark.anyio
async def test_patch_org_contact_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.patch(
		"/org/contact",
		json={
			"organisation_id": 3,
			"contact_type": "billing",
			"email": "user@example.com",
		},
	)
	assert resp.status_code != 422
	assert resp.status_code == 200


@pytest.mark.anyio
async def test_get_service_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/service?org_id=3")
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_get_iam_group_permissions_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/iam/group/permissions?org_id=3&group_id=1")
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_get_iam_group_users_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/iam/group/users?org_id=3&group_id=1")
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_post_iam_group_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.post(
		"/iam/group", json={"name": "New Group", "organisation_id": 3}
	)
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_put_iam_group_permission_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.put(
		"/iam/group/permission",
		json={"permission_id": 1, "group_id": 2, "organisation_id": 3},
	)
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_put_iam_group_user_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.put(
		"/iam/group/user", json={"user_id": 2, "group_id": 1, "organisation_id": 3}
	)
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_get_iam_permissions_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.get("/iam/permissions?org_id=3")
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_post_iam_permissions_search_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.post(
		"/iam/permissions/search", json={"organisation_id": 3, "action": "read"}
	)
	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_delete_org_user_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.delete("/org/user?org_id=3&user_id=1")

	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_delete_preapproval_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.delete("/org/self?org_id=3")

	assert resp.status_code != 422
	assert resp.status_code == 204


@pytest.mark.anyio
async def test_post_user_invitation_auth_approval(no_su_client: AsyncClient):
	body = {"user_email": "admin@test.com", "organisation_id": 3}
	resp = await no_su_client.post("/user/invitation", json=body)

	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_delete_group_permissions_auth_approval(no_su_client: AsyncClient):
	resp = await no_su_client.delete(
		"/iam/group/permission?org_id=3&group_id=1&perm_id=1"
	)

	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_delete_group_users_success(no_su_client: AsyncClient):
	resp = await no_su_client.delete("/iam/group/user?org_id=3&group_id=1&user_id=1")

	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]


@pytest.mark.anyio
async def test_put_group_user_invitation_success(no_su_client: AsyncClient):
	body = {"user_email": "admin@test.com", "organisation_id": 3, "group_id": 1}
	resp = await no_su_client.put("/iam/group/user/invitation", json=body)

	assert resp.status_code != 422
	assert "has not been approved." in resp.json()["detail"]