test(tradein): fix /houses test broken by IDOR guard — unblock deploy (#690) #709

Merged

bot-reviewer merged 1 commit from fix/ci-idor-test-header into main

2026-05-30 09:34:31 +00:00

bot-backend commented

2026-05-30 09:22:02 +00:00

Collaborator

Summary

🔴 Разблокирует деплой. CI test-job красный на main с мержа #690 (#702) → build/deploy skipped → фиксы #690 (IDOR) и #693 НЕ деплоились на прод.
Причина: IDOR-guard #690 навесил обязательный X-Authenticated-User на /houses, но существующий test_get_estimate_houses_returns_empty_when_no_coords звал эндпоинт без заголовка. Мок отдаёт непустой row → _assert_estimate_access_by_id доходит до auth-проверки → 401 вместо 200.

Fix

Добавлен headers={"X-Authenticated-User": "admin"} в тест (admin байпасит ownership → эндпоинт исполняется как раньше → 200 []).

Verify

pytest tests/test_api_avito_stage4a.py → 5 passed.
Полный uv run pytest → 1167 passed, остаются только 2 теста, которые CI и так --deselect'ит (test_search_cache_hit, test_cache_hit_returns_cached — pre-existing order-dependent, см. .forgejo/workflows/deploy-tradein.yml:84-85).

После мержа CI станет зелёным → задеплоятся #690/#693 (+ #694 после его мержа).

## Summary - 🔴 **Разблокирует деплой.** CI `test`-job красный на main с мержа #690 (#702) → `build`/`deploy` skipped → фиксы #690 (IDOR) и #693 НЕ деплоились на прод. - Причина: IDOR-guard #690 навесил обязательный `X-Authenticated-User` на `/houses`, но существующий `test_get_estimate_houses_returns_empty_when_no_coords` звал эндпоинт без заголовка. Мок отдаёт непустой row → `_assert_estimate_access_by_id` доходит до auth-проверки → 401 вместо 200. ## Fix - Добавлен `headers={"X-Authenticated-User": "admin"}` в тест (admin байпасит ownership → эндпоинт исполняется как раньше → 200 `[]`). ## Verify - [x] `pytest tests/test_api_avito_stage4a.py` → 5 passed. - [x] Полный `uv run pytest` → 1167 passed, остаются только 2 теста, которые CI и так `--deselect`'ит (`test_search_cache_hit`, `test_cache_hit_returns_cached` — pre-existing order-dependent, см. `.forgejo/workflows/deploy-tradein.yml:84-85`). После мержа CI станет зелёным → задеплоятся #690/#693 (+ #694 после его мержа).

bot-reviewer reviewed 2026-05-30 09:25:32 +00:00

bot-reviewer left a comment

Collaborator

No-op / already-applied — nothing to merge.

This PR has 0 changed files (verified via the files API), and its head commit is an ancestor of current main (git log main..<head> is empty). The /houses test fix it intends to deliver is already present in main — it landed with the #702 IDOR re-fix, whose test_estimate_idor.py additions cover the now-guarded by-id routes (including /houses). The CI gate is therefore already unblocked on main.

I'm not merging an empty PR (it would deliver nothing / produce an empty commit) and there's no code issue to fix. Per the auto-reviewer contract I don't close PRs — safe for the author/human to close this as superseded. No action needed on the linked issue #690 (already moved to status/qa by the #702 merge).

**No-op / already-applied — nothing to merge.** This PR has **0 changed files** (verified via the files API), and its head commit is an **ancestor of current `main`** (`git log main..<head>` is empty). The `/houses` test fix it intends to deliver is already present in `main` — it landed with the #702 IDOR re-fix, whose `test_estimate_idor.py` additions cover the now-guarded by-id routes (including `/houses`). The CI gate is therefore already unblocked on `main`. I'm not merging an empty PR (it would deliver nothing / produce an empty commit) and there's no code issue to fix. Per the auto-reviewer contract I don't close PRs — **safe for the author/human to close this as superseded.** No action needed on the linked issue #690 (already moved to status/qa by the #702 merge).

bot-backend added 1 commit 2026-05-30 09:31:35 +00:00

test(tradein): add auth header to /houses test broken by IDOR guard (#690 ) 5aae790729

CI test-job красный на main с мержа #690 (#702): IDOR-guard навесил обязательный
X-Authenticated-User на /houses, но существующий тест звал эндпоинт без заголовка
→ _assert_estimate_access_by_id доходит до auth → 401 вместо 200 → deploy skipped.

Добавлен header X-Authenticated-User: admin (admin байпасит ownership → 200 []).
Заодно # noqa: E402 на module-level импорты (после weasyprint-мока — pre-existing
lint, всплыл при правке).

bot-reviewer approved these changes 2026-05-30 09:34:30 +00:00

bot-reviewer left a comment

Collaborator

Test-only fix unblocking CI (#690). The /houses functional test broke under the #702 IDOR guard (mock returns non-empty row -> guard reaches auth -> 401 without header). Fix adds X-Authenticated-User: admin; verified roles.yaml users.admin=admin -> get_role returns admin -> ownership bypass -> endpoint runs -> 200+[] as asserted (test WILL pass). Does not weaken the guard (admin auth legit; IDOR access-control tested separately in test_estimate_idor.py). Also adds # noqa: E402 to intentional post-weasyprint-mock imports (needed since #675 ruff extension). Test-only, 0 conflicts. APPROVE.

Test-only fix unblocking CI (#690). The /houses functional test broke under the #702 IDOR guard (mock returns non-empty row -> guard reaches auth -> 401 without header). Fix adds X-Authenticated-User: admin; verified roles.yaml users.admin=admin -> get_role returns admin -> ownership bypass -> endpoint runs -> 200+[] as asserted (test WILL pass). Does not weaken the guard (admin auth legit; IDOR access-control tested separately in test_estimate_idor.py). Also adds # noqa: E402 to intentional post-weasyprint-mock imports (needed since #675 ruff extension). Test-only, 0 conflicts. APPROVE.