dolgolyov.alexei
fed6a3df1b
Backend: - Setting + GeneratedPdf models, Alembic migration with default settings seed - PDF generation service (WeasyPrint + Jinja2 with autoescape) - Health report HTML template with memory entries + document excerpts - Admin user management: list, create, update (role/max_chats/is_active) - Admin settings: self_registration_enabled, default_max_chats - Self-registration check wired into auth register endpoint - default_max_chats applied to new user registrations - AI tool: generate_pdf creates health compilation PDFs - PDF compile/list/download API endpoints - WeasyPrint system deps added to Dockerfile Frontend: - PDF reports page with generate + download - Admin users page with create/edit/activate/deactivate - Admin settings page with self-registration toggle + max chats - Extended sidebar with PDF reports + admin users/settings links - English + Russian translations for all new UI Review fixes applied: - Jinja2 autoescape enabled (XSS prevention in PDFs) - db.refresh after flush (created_at populated correctly) - storage_path removed from API response (no internal path leak) - Role field uses Literal["user", "admin"] validation - React hooks called before conditional returns (rules of hooks) - default_max_chats setting now applied during registration Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
33 lines
1.1 KiB
Python
33 lines
1.1 KiB
Python
import pytest
|
|
from httpx import AsyncClient
|
|
|
|
|
|
@pytest.fixture
|
|
async def user_headers(client: AsyncClient):
|
|
resp = await client.post("/api/v1/auth/register", json={
|
|
"email": "regularuser@example.com",
|
|
"username": "regularuser",
|
|
"password": "testpass123",
|
|
})
|
|
assert resp.status_code == 201
|
|
return {"Authorization": f"Bearer {resp.json()['access_token']}"}
|
|
|
|
|
|
async def test_non_admin_cannot_list_users(client: AsyncClient, user_headers: dict):
|
|
resp = await client.get("/api/v1/admin/users", headers=user_headers)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
async def test_non_admin_cannot_create_user(client: AsyncClient, user_headers: dict):
|
|
resp = await client.post("/api/v1/admin/users", json={
|
|
"email": "new@example.com",
|
|
"username": "newuser",
|
|
"password": "testpass123",
|
|
}, headers=user_headers)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
async def test_non_admin_cannot_get_settings(client: AsyncClient, user_headers: dict):
|
|
resp = await client.get("/api/v1/admin/settings", headers=user_headers)
|
|
assert resp.status_code == 403
|