tests/api/admin/test_judges.py - master - tsps/core

tests/api/admin/test_judges.py
309 строк12 KB
Василий Петров
Разделение ролей - защита delete
24 мар 2026, 17:43
24 мар 2026, 17:438523537
import pytest
from tests.utils import clean_table
from app.models import Judge, Court
from fastapi.testclient import TestClient
from app.main import app

client = TestClient(app)


@pytest.fixture(autouse=True)
def clean_judges_and_courts():
    """Очищает таблицы judge и court перед каждым тестом."""
    clean_table(Judge)
    clean_table(Court)


def test_create_judge(auth_headers):
    response = client.post(
        "/api/admin/judges",
        json={
            "last_name": "Иванов",
            "first_name": "Петр",
            "middle_name": "Сергеевич"
        },
        headers=auth_headers
    )
    assert response.status_code == 201
    data = response.json()
    assert data["last_name"] == "Иванов"
    assert data["first_name"] == "Петр"
    assert data["middle_name"] == "Сергеевич"
    assert data["current_court"] is None
    assert "id" in data


def test_create_judge_with_court(auth_headers):
    # Сначала создаём суд
    court_resp = client.post("/api/admin/courts", json={"name": "Мосгорсуд"}, headers=auth_headers)
    court_id = court_resp.json()["id"]

    # Создаём судью с привязкой к суду
    response = client.post(
        "/api/admin/judges",
        json={
            "last_name": "Сидоров",
            "first_name": "Андрей",
            "current_court_id": court_id
        },
        headers=auth_headers
    )
    assert response.status_code == 201
    data = response.json()
    assert data["last_name"] == "Сидоров"
    assert data["current_court"]["id"] == court_id
    assert data["current_court"]["name"] == "Мосгорсуд"


def test_create_judge_with_nonexistent_court(auth_headers):
    response = client.post(
        "/api/admin/judges",
        json={
            "last_name": "Петров",
            "first_name": "Николай",
            "current_court_id": 999
        },
        headers=auth_headers
    )
    assert response.status_code == 400
    assert response.json()["detail"] == "Указанный суд не существует"


def test_read_judges(auth_headers):
    # Создаём суд
    court_resp = client.post("/api/admin/courts", json={"name": "Верховный Суд"}, headers=auth_headers)
    court_id = court_resp.json()["id"]

    # Создаём двух судей
    client.post("/api/admin/judges", json={"last_name": "Иванов", "first_name": "Пётр"}, headers=auth_headers)
    client.post(
        "/api/admin/judges",
        json={"last_name": "Смирнов", "first_name": "Алексей", "current_court_id": court_id},
        headers=auth_headers
    )

    response = client.get("/api/admin/judges", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 2

    # Проверяем, что у второго судьи есть вложенный суд
    judges_by_last_name = {j["last_name"]: j for j in data["items"]}
    assert judges_by_last_name["Смирнов"]["current_court"]["name"] == "Верховный Суд"
    assert judges_by_last_name["Иванов"]["current_court"] is None


def test_read_judges_pagination(auth_headers):
    # Создаём 5 судей
    for i in range(5):
        client.post(
            "/api/admin/judges",
            json={"last_name": f"Фамилия{i+1}", "first_name": f"Имя{i+1}"},
            headers=auth_headers
        )
    
    # Запрашиваем первые 2 (skip=0, limit=2)
    response = client.get("/api/admin/judges?skip=0&limit=2", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 2
    last_names = {j["last_name"] for j in data["items"]}
    assert last_names == {"Фамилия1", "Фамилия2"}

    # Запрашиваем следующие 2 (skip=2, limit=2)
    response = client.get("/api/admin/judges?skip=2&limit=2", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 2
    last_names = {j["last_name"] for j in data["items"]}
    assert last_names == {"Фамилия3", "Фамилия4"}

    # Запрашиваем с пропуском за пределы данных
    response = client.get("/api/admin/judges?skip=10&limit=2", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 0

    # Проверяем total
    response = client.get("/api/admin/judges?skip=0&limit=100", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert data["total"] == 5
    assert data["skip"] == 0
    assert data["limit"] == 100


def test_read_judges_filter_by_last_name(auth_headers):
    client.post("/api/admin/judges", json={"last_name": "Иванов", "first_name": "Пётр"}, headers=auth_headers)
    client.post("/api/admin/judges", json={"last_name": "Сидоров", "first_name": "Андрей"}, headers=auth_headers)

    response = client.get("/api/admin/judges?last_name=ива", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 1
    assert data["items"][0]["last_name"] == "Иванов"


def test_read_judges_filter_by_court_id(auth_headers):
    court1 = client.post("/api/admin/courts", json={"name": "Суд 1"}, headers=auth_headers).json()["id"]
    court2 = client.post("/api/admin/courts", json={"name": "Суд 2"}, headers=auth_headers).json()["id"]

    client.post("/api/admin/judges", json={"last_name": "А", "first_name": "Б", "current_court_id": court1}, headers=auth_headers)
    client.post("/api/admin/judges", json={"last_name": "В", "first_name": "Г", "current_court_id": court2}, headers=auth_headers)
    client.post("/api/admin/judges", json={"last_name": "Д", "first_name": "Е"}, headers=auth_headers)  # без суда

    # Фильтр по court1
    response = client.get(f"/api/admin/judges?court_id={court1}", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) == 1
    assert data["items"][0]["last_name"] == "А"

    # Фильтр по суду без привязки
    response = client.get("/api/admin/judges?court_id=", headers=auth_headers)  # или просто не передавать


def test_read_judge(auth_headers):
    court_id = client.post("/api/admin/courts", json={"name": "Тестовый суд"}, headers=auth_headers).json()["id"]
    create_resp = client.post(
        "/api/admin/judges",
        json={"last_name": "Кузнецов", "first_name": "Дмитрий", "current_court_id": court_id},
        headers=auth_headers
    )
    judge_id = create_resp.json()["id"]

    response = client.get(f"/api/admin/judges/{judge_id}", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert data["last_name"] == "Кузнецов"
    assert data["current_court"]["id"] == court_id


def test_read_judge_not_found(auth_headers):
    response = client.get("/api/admin/judges/999", headers=auth_headers)
    assert response.status_code == 404
    assert response.json()["detail"] == "Судья не найден"


def test_update_judge(auth_headers):
    court1 = client.post("/api/admin/courts", json={"name": "Суд A"}, headers=auth_headers).json()["id"]
    court2 = client.post("/api/admin/courts", json={"name": "Суд B"}, headers=auth_headers).json()["id"]

    create_resp = client.post(
        "/api/admin/judges",
        json={"last_name": "Старый", "first_name": "Имя", "current_court_id": court1},
        headers=auth_headers
    )
    judge_id = create_resp.json()["id"]

    response = client.patch(
        f"/api/admin/judges/{judge_id}",
        json={
            "last_name": "Новый",
            "middle_name": "Отчество",
            "current_court_id": court2
        },
        headers=auth_headers
    )
    assert response.status_code == 200
    data = response.json()
    assert data["last_name"] == "Новый"
    assert data["first_name"] == "Имя"  # не изменилось
    assert data["middle_name"] == "Отчество"
    assert data["current_court"]["id"] == court2


def test_update_judge_to_nonexistent_court(auth_headers):
    create_resp = client.post("/api/admin/judges", json={"last_name": "Тест", "first_name": "Судья"}, headers=auth_headers)
    judge_id = create_resp.json()["id"]

    response = client.patch(
        f"/api/admin/judges/{judge_id}",
        json={"current_court_id": 999},
        headers=auth_headers
    )
    assert response.status_code == 400
    assert response.json()["detail"] == "Указанный суд не существует"


def test_delete_judge(auth_headers):
    create_resp = client.post("/api/admin/judges", json={"last_name": "Удаляемый", "first_name": "Судья"}, headers=auth_headers)
    judge_id = create_resp.json()["id"]

    delete_resp = client.delete(f"/api/admin/judges/{judge_id}", headers=auth_headers)
    assert delete_resp.status_code == 204

    get_resp = client.get(f"/api/admin/judges/{judge_id}", headers=auth_headers)
    assert get_resp.status_code == 404


def test_delete_judge_auditor_forbidden(auth_headers, auditor_auth_headers):
    """Аудитор не может удалять судей — должен получить 403."""
    # Подготовка: создаём судью через API (как супер-админ)
    create_resp = client.post(
        "/api/admin/judges",
        json={"last_name": "Судья-для-аудита", "first_name": "Тест"},
        headers=auth_headers
    )
    judge_id = create_resp.json()["id"]

    # Попытка удалить с ролью auditor
    response = client.delete(
        f"/api/admin/judges/{judge_id}",
        headers=auditor_auth_headers
    )

    # Проверка ответа
    assert response.status_code == 403
    assert response.json()["detail"] == "Требуется роль супер-администратора"

    # Убеждаемся, что судья не удалён
    get_resp = client.get(f"/api/admin/judges/{judge_id}", headers=auth_headers)
    assert get_resp.status_code == 200
    assert get_resp.json()["last_name"] == "Судья-для-аудита"


def test_create_judge_with_auto_load_enabled(auth_headers):
    response = client.post(
        "/api/admin/judges",
        json={
            "last_name": "Автозагрузчик",
            "first_name": "Тест",
            "auto_load_enabled": True
        },
        headers=auth_headers
    )
    assert response.status_code == 201
    data = response.json()
    assert data["auto_load_enabled"] is True


def test_update_judge_auto_load_flag(auth_headers):
    # Создаём судью с флагом False (по умолчанию)
    create_resp = client.post(
        "/api/admin/judges",
        json={"last_name": "Флаг", "first_name": "Тест"},
        headers=auth_headers
    )
    judge_id = create_resp.json()["id"]
    assert create_resp.json()["auto_load_enabled"] is False

    # Включаем флаг
    response = client.patch(
        f"/api/admin/judges/{judge_id}",
        json={"auto_load_enabled": True},
        headers=auth_headers
    )
    assert response.status_code == 200
    data = response.json()
    assert data["auto_load_enabled"] is True
    assert data["last_name"] == "Флаг"  # остальное не изменилось

    # Выключаем флаг обратно
    response = client.patch(
        f"/api/admin/judges/{judge_id}",
        json={"auto_load_enabled": False},
        headers=auth_headers
    )
    assert response.status_code == 200
    assert response.json()["auto_load_enabled"] is False