From cffc91a1d887e96480d7ae44932e613d78460825 Mon Sep 17 00:00:00 2001 From: bot-backend Date: Sat, 30 May 2026 09:34:31 +0000 Subject: [PATCH] =?UTF-8?q?test(tradein):=20fix=20/houses=20test=20broken?= =?UTF-8?q?=20by=20IDOR=20guard=20=E2=80=94=20unblock=20deploy=20(#690)=20?= =?UTF-8?q?(#709)=20Co-authored-by:=20bot-backend=20=20Co-committed-by:=20bot-backend=20?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../backend/tests/test_api_avito_stage4a.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/tradein-mvp/backend/tests/test_api_avito_stage4a.py b/tradein-mvp/backend/tests/test_api_avito_stage4a.py index fd034286..b4424a8d 100644 --- a/tradein-mvp/backend/tests/test_api_avito_stage4a.py +++ b/tradein-mvp/backend/tests/test_api_avito_stage4a.py @@ -18,9 +18,9 @@ sys.modules.setdefault("weasyprint", _wp_mock) sys.modules.setdefault("weasyprint.CSS", _wp_mock) sys.modules.setdefault("weasyprint.HTML", _wp_mock) -import pytest -from fastapi import FastAPI -from fastapi.testclient import TestClient +import pytest # noqa: E402 — импорт после weasyprint-мока (намеренно, см. выше) +from fastapi import FastAPI # noqa: E402 +from fastapi.testclient import TestClient # noqa: E402 @pytest.fixture @@ -77,7 +77,13 @@ def test_get_estimate_houses_returns_empty_when_no_coords(app): app.dependency_overrides[get_db] = override_db_no_coords client = TestClient(app) - r = client.get("/api/v1/trade-in/estimate/00000000-0000-0000-0000-000000000000/houses") + # #690: /houses теперь скоупится по владельцу (X-Authenticated-User). Мок отдаёт + # непустой row (fake_target) → guard доходит до auth-проверки и без заголовка + # вернул бы 401. admin байпасит ownership → эндпоинт исполняется как раньше. + r = client.get( + "/api/v1/trade-in/estimate/00000000-0000-0000-0000-000000000000/houses", + headers={"X-Authenticated-User": "admin"}, + ) assert r.status_code == 200 assert r.json() == []