tests/api/admin/test_case_entities.py - master - tsps/core

tests/api/admin/test_case_entities.py
171 строка7 KB
Василий Петров
Разделение ролей - защита delete
24 мар 2026, 17:43
24 мар 2026, 17:438523537
import pytest
from tests.utils import clean_table
from app.models import CaseEntity
from fastapi.testclient import TestClient
from app.main import app

client = TestClient(app)


@pytest.fixture(autouse=True)
def clean_case_entities_table():
    """Очищает таблицу case_entity перед каждым тестом."""
    clean_table(CaseEntity)


def test_create_case_entity(auth_headers):
    response = client.post("/api/admin/case-entities", json={"number": "АБ-123/2025"}, headers=auth_headers)
    assert response.status_code == 201
    data = response.json()
    assert data["number"] == "АБ-123/2025"
    assert "id" in data


def test_create_case_entity_duplicate(auth_headers):
    # Первое создание
    client.post("/api/admin/case-entities", json={"number": "ВГ-456/2025"}, headers=auth_headers)
    # Повтор
    response = client.post("/api/admin/case-entities", json={"number": "ВГ-456/2025"}, headers=auth_headers)
    assert response.status_code == 409
    assert response.json()["detail"] == "Дело с таким номером уже существует"


def test_read_case_entities(auth_headers):
    client.post("/api/admin/case-entities", json={"number": "Дело 1"}, headers=auth_headers)
    client.post("/api/admin/case-entities", json={"number": "Дело 2"}, headers=auth_headers)
    response = client.get("/api/admin/case-entities", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 2
    numbers = {ce["number"] for ce in data["items"]}
    assert numbers == {"Дело 1", "Дело 2"}


def test_read_case_entities_filter_by_number(auth_headers):
    client.post("/api/admin/case-entities", json={"number": "Апелляция-123"}, headers=auth_headers)
    client.post("/api/admin/case-entities", json={"number": "Кассация-456"}, headers=auth_headers)
    client.post("/api/admin/case-entities", json={"number": "Ходатайство-789"}, headers=auth_headers)

    response = client.get("/api/admin/case-entities?number=апелляция", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 1
    assert data["items"][0]["number"] == "Апелляция-123"

    response = client.get("/api/admin/case-entities?number=АПЕЛЛЯЦИЯ", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 1

    response = client.get("/api/admin/case-entities?number=ход", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 1
    assert data["items"][0]["number"] == "Ходатайство-789"

    response = client.get("/api/admin/case-entities?number=нет_такого", headers=auth_headers)
    assert response.status_code == 200
    assert len(response.json()["items"]) == 0


def test_read_case_entities_pagination(auth_headers):
    # Создаём 5 дел
    for i in range(5):
        client.post("/api/admin/case-entities", json={"number": f"Дело-{i + 1}"}, headers=auth_headers)

    # Запрашиваем первые 2 (skip=0, limit=2)
    response = client.get("/api/admin/case-entities?skip=0&limit=2", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 2
    numbers = {ce["number"] for ce in data["items"]}
    assert numbers == {"Дело-1", "Дело-2"}

    # Запрашиваем следующие 2 (skip=2, limit=2)
    response = client.get("/api/admin/case-entities?skip=2&limit=2", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 2
    numbers = {ce["number"] for ce in data["items"]}
    assert numbers == {"Дело-3", "Дело-4"}

    # Запрашиваем с пропуском за пределы данных
    response = client.get("/api/admin/case-entities?skip=10&limit=2", headers=auth_headers)
    assert response.status_code == 200
    assert len(response.json()["items"]) == 0


def test_read_case_entity(auth_headers):
    create_resp = client.post("/api/admin/case-entities", json={"number": "ИС-999/2026"}, headers=auth_headers)
    case_id = create_resp.json()["id"]
    response = client.get(f"/api/admin/case-entities/{case_id}", headers=auth_headers)
    assert response.status_code == 200
    assert response.json()["number"] == "ИС-999/2026"


def test_read_case_entity_not_found(auth_headers):
    response = client.get("/api/admin/case-entities/999", headers=auth_headers)
    assert response.status_code == 404
    assert response.json()["detail"] == "Дело не найдено"


def test_update_case_entity(auth_headers):
    create_resp = client.post("/api/admin/case-entities", json={"number": "Старый номер"}, headers=auth_headers)
    case_id = create_resp.json()["id"]
    response = client.patch(
        f"/api/admin/case-entities/{case_id}",
        json={"number": "Новый номер"},
        headers=auth_headers
    )
    assert response.status_code == 200
    assert response.json()["number"] == "Новый номер"
    assert response.json()["id"] == case_id  # ID не меняется


def test_update_case_entity_duplicate(auth_headers):
    client.post("/api/admin/case-entities", json={"number": "Номер А"}, headers=auth_headers)
    create_resp = client.post("/api/admin/case-entities", json={"number": "Номер Б"}, headers=auth_headers)
    case_id = create_resp.json()["id"]
    response = client.patch(
        f"/api/admin/case-entities/{case_id}",
        json={"number": "Номер А"},
        headers=auth_headers
    )
    assert response.status_code == 409
    assert response.json()["detail"] == "Дело с таким номером уже существует"


def test_delete_case_entity(auth_headers):
    create_resp = client.post("/api/admin/case-entities", json={"number": "Удаляемое дело"}, headers=auth_headers)
    case_id = create_resp.json()["id"]
    response = client.delete(f"/api/admin/case-entities/{case_id}", headers=auth_headers)
    assert response.status_code == 204
    # Проверяем, что удалено
    get_resp = client.get(f"/api/admin/case-entities/{case_id}", headers=auth_headers)
    assert get_resp.status_code == 404


def test_delete_case_entity_auditor_forbidden(auth_headers, auditor_auth_headers):
    """Аудитор не может удалять дела — должен получить 403."""
    # Подготовка: создаём дело через API (как супер-админ)
    create_resp = client.post(
        "/api/admin/case-entities",
        json={"number": "Дело-для-аудита"},
        headers=auth_headers  # создаём супер-админом
    )
    case_id = create_resp.json()["id"]

    # Попытка удалить с ролью auditor
    response = client.delete(
        f"/api/admin/case-entities/{case_id}",
        headers=auditor_auth_headers
    )

    # Проверка ответа
    assert response.status_code == 403
    assert response.json()["detail"] == "Требуется роль супер-администратора"

    # Убеждаемся, что дело не удалено (можно прочитать супер-админом)
    get_resp = client.get(f"/api/admin/case-entities/{case_id}", headers=auth_headers)
    assert get_resp.status_code == 200
    assert get_resp.json()["number"] == "Дело-для-аудита"