File size: 2,202 Bytes
c794b6b | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 | """Phase 2 — Priority 7: ISSUE-182 interim RBAC mitigation."""
import os
import sys
os.environ.setdefault("CEPHEUS_CLOUD", "1")
os.environ["CEPHEUS_AUTH_DEV_MODE"] = "1"
os.environ.setdefault("CEPHEUS_API_KEY", "test-key")
BACKEND_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
if BACKEND_DIR not in sys.path:
sys.path.insert(0, BACKEND_DIR)
import pytest
from fastapi.testclient import TestClient
import auth_service
import main
API_HEADERS = {"X-API-Key": "test-key"}
def _staff_token(client):
r = client.post("/auth/login", json={"username": "staff", "password": "staff"})
assert r.status_code == 200
return r.json()["access_token"]
def _admin_token(client):
r = client.post("/auth/login", json={"username": "admin", "password": "admin"})
assert r.status_code == 200
return r.json()["access_token"]
@pytest.fixture(autouse=True)
def _enable_dev_auth(monkeypatch):
monkeypatch.setenv("CEPHEUS_AUTH_DEV_MODE", "1")
monkeypatch.setenv(
"CEPHEUS_DEV_AUTH_USERS",
'[{"username":"admin","password":"admin","role":"admin"},'
'{"username":"staff","password":"staff","role":"staff"}]',
)
@pytest.fixture
def client():
return TestClient(main.app)
def test_operator_api_key_cannot_delete_signage(client, monkeypatch):
monkeypatch.setitem(main.signage_placements, "s1", {"lat": 1, "lng": 2})
r = client.delete("/site/signage-placements/s1", headers=API_HEADERS)
assert r.status_code == 403
def test_admin_jwt_can_clear_gossip(client):
token = _admin_token(client)
r = client.post("/gossip/clear", headers={"Authorization": f"Bearer {token}"})
assert r.status_code == 200
def test_staff_jwt_cannot_clear_gossip(client):
token = _staff_token(client)
r = client.post("/gossip/clear", headers={"Authorization": f"Bearer {token}"})
assert r.status_code == 403
def test_staff_jwt_cannot_register_face(client):
token = _staff_token(client)
r = client.post(
"/register_face",
headers={"Authorization": f"Bearer {token}"},
data={"name": "Test"},
files={"file": ("x.jpg", b"fake", "image/jpeg")},
)
assert r.status_code == 403
|