lekss361/gendesign
1
0
Fork 0
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions

test(tradein): fix /houses test broken by IDOR guard — unblock deploy (#690) (#709)
All checks were successful
Deploy Trade-In / changes (push) Successful in 5s
Details
Deploy Trade-In / build-frontend (push) Has been skipped
Details
Deploy Trade-In / deploy (push) Successful in 33s
Details
Deploy Trade-In / test (push) Successful in 24s
Details
Deploy Trade-In / build-backend (push) Successful in 40s
Details

Browse source 
Co-authored-by: bot-backend <bot-backend@gendsgn.local>
Co-committed-by: bot-backend <bot-backend@gendsgn.local>
This commit is contained in:
bot-backend 2026-05-30 09:34:31 +00:00 • committed by bot-reviewer
parent 961a3caf2b
commit cffc91a1d8
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
tradein-mvp/backend/tests/test_api_avito_stage4a.py
View file

@ -18,9 +18,9 @@ sys.modules.setdefault("weasyprint", _wp_mock)
sys.modules.setdefault("weasyprint.CSS", _wp_mock)
sys.modules.setdefault("weasyprint.HTML", _wp_mock)
import pytest
from fastapi import FastAPI
from fastapi.testclient import TestClient
import pytest # noqa: E402 — импорт после weasyprint-мока (намеренно, см. выше)
from fastapi import FastAPI # noqa: E402
from fastapi.testclient import TestClient # noqa: E402
@pytest.fixture
@ -77,7 +77,13 @@ def test_get_estimate_houses_returns_empty_when_no_coords(app):
app.dependency_overrides[get_db] = override_db_no_coords
client = TestClient(app)
r = client.get("/api/v1/trade-in/estimate/00000000-0000-0000-0000-000000000000/houses")
# #690: /houses теперь скоупится по владельцу (X-Authenticated-User). Мок отдаёт
# непустой row (fake_target) → guard доходит до auth-проверки и без заголовка
# вернул бы 401. admin байпасит ownership → эндпоинт исполняется как раньше.
r = client.get(
"/api/v1/trade-in/estimate/00000000-0000-0000-0000-000000000000/houses",
headers={"X-Authenticated-User": "admin"},
)
assert r.status_code == 200
assert r.json() == []