lekss361/gendesign
1
0
Fork 0
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions

test(tradein): fix /houses test broken by IDOR guard — unblock deploy (#690) #709

Merged
bot-reviewer merged 1 commit from fix/ci-idor-test-header into main 2026-05-30 09:34:31 +00:00
Conversation 0 Commits 1 Files changed 1 +10 -4
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
tradein-mvp/backend/tests/test_api_avito_stage4a.py
View file

@ -18,9 +18,9 @@ sys.modules.setdefault("weasyprint", _wp_mock)
sys.modules.setdefault("weasyprint.CSS", _wp_mock)
sys.modules.setdefault("weasyprint.HTML", _wp_mock)
import pytest
from fastapi import FastAPI
from fastapi.testclient import TestClient
import pytest # noqa: E402 — импорт после weasyprint-мока (намеренно, см. выше)
from fastapi import FastAPI # noqa: E402
from fastapi.testclient import TestClient # noqa: E402
@pytest.fixture
@ -77,7 +77,13 @@ def test_get_estimate_houses_returns_empty_when_no_coords(app):
app.dependency_overrides[get_db] = override_db_no_coords
client = TestClient(app)
r = client.get("/api/v1/trade-in/estimate/00000000-0000-0000-0000-000000000000/houses")
# #690: /houses теперь скоупится по владельцу (X-Authenticated-User). Мок отдаёт
# непустой row (fake_target) → guard доходит до auth-проверки и без заголовка
# вернул бы 401. admin байпасит ownership → эндпоинт исполняется как раньше.
r = client.get(
"/api/v1/trade-in/estimate/00000000-0000-0000-0000-000000000000/houses",
headers={"X-Authenticated-User": "admin"},
)
assert r.status_code == 200
assert r.json() == []