"""Delete-path tests, including the mass-delete confirmation guard.""" from __future__ import annotations class TestDeleteOne: def test_deletes_the_row(self, client, session_headers, log_factory): row = log_factory(count=1)[0] response = client.delete(f"/api/logs/{row.id}", headers=session_headers) assert response.status_code == 200 assert response.json()["deleted"] == 1 assert client.get(f"/api/logs/{row.id}", headers=session_headers).status_code == 404 def test_missing_row_is_404(self, client, session_headers): assert client.delete("/api/logs/999999", headers=session_headers).status_code == 404 class TestMassDelete: def test_requires_explicit_confirmation(self, client, session_headers, log_factory): """A bare DELETE used to truncate the whole table.""" log_factory(count=3) response = client.delete("/api/logs", headers=session_headers) assert response.status_code == 400 assert client.get("/api/logs", headers=session_headers).json()["total"] == 3 def test_confirm_false_is_also_rejected(self, client, session_headers, log_factory): log_factory(count=2) assert client.delete("/api/logs?confirm=false", headers=session_headers).status_code == 400 def test_confirmed_delete_removes_everything(self, client, session_headers, log_factory): log_factory(count=4) response = client.delete("/api/logs?confirm=true", headers=session_headers) assert response.status_code == 200 assert response.json()["deleted"] == 4 assert client.get("/api/logs", headers=session_headers).json()["total"] == 0 def test_clears_only_the_calling_session(self, client, session_headers, log_factory): """Deleting is scoped, so one visitor cannot wipe another's history.""" log_factory(count=2) log_factory(count=3, session_id="someone-else-session-01") response = client.delete("/api/logs?confirm=true", headers=session_headers) assert response.json()["deleted"] == 2 others = client.get("/api/logs", headers={"X-Session-Id": "someone-else-session-01"}).json() assert others["total"] == 3