fix: update tests for current API structure and model changes
- Fix middleware fixtures: vendor_code instead of code, add owner_user_id to company
- Fix performance tests: MarketplaceProduct uses translations for title/description
- Fix security tests: use correct API endpoints (/api/v1/admin/*, /api/v1/vendor/*)
- Fix workflow tests: use actual admin API endpoints
- Fix background task tests: remove invalid vendor_name field, add language
Note: Many middleware integration tests still fail due to dynamic routes
being caught by the /{slug} catch-all route. These tests need further
refactoring to use /api/* prefixed routes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -1,4 +1,11 @@
|
||||
# tests/integration/security/test_authentication.py
|
||||
"""
|
||||
Authentication tests for the API.
|
||||
|
||||
API Structure:
|
||||
- /api/v1/admin/* - Admin endpoints (require admin token)
|
||||
- /api/v1/vendor/* - Vendor endpoints (require vendor token with vendor_id claim)
|
||||
"""
|
||||
import pytest
|
||||
|
||||
|
||||
@@ -11,67 +18,24 @@ class TestAuthentication:
|
||||
protected_endpoints = [
|
||||
"/api/v1/admin/users",
|
||||
"/api/v1/admin/vendors",
|
||||
"/api/v1/marketplace/import-jobs",
|
||||
"/api/v1/marketplace/product",
|
||||
"/api/v1/vendor",
|
||||
"/api/v1/stats",
|
||||
"/api/v1/inventory",
|
||||
"/api/v1/admin/marketplace-import-jobs",
|
||||
"/api/v1/admin/products",
|
||||
"/api/v1/vendor/products",
|
||||
"/api/v1/vendor/inventory",
|
||||
]
|
||||
|
||||
for endpoint in protected_endpoints:
|
||||
response = client.get(endpoint)
|
||||
assert response.status_code == 401 # Authentication missing
|
||||
assert response.status_code == 401, f"Expected 401 for {endpoint}"
|
||||
|
||||
def test_protected_endpoint_with_invalid_token(self, client):
|
||||
"""Test protected endpoints with invalid token"""
|
||||
headers = {"Authorization": "Bearer invalid_token_here"}
|
||||
|
||||
response = client.get("/api/v1/marketplace/product", headers=headers)
|
||||
response = client.get("/api/v1/admin/products", headers=headers)
|
||||
assert response.status_code == 401 # Token is not valid
|
||||
|
||||
def test_debug_direct_bearer(self, client):
|
||||
"""Test HTTPBearer directly"""
|
||||
response = client.get("/api/v1/debug-bearer")
|
||||
print(f"Direct Bearer - Status: {response.status_code}")
|
||||
print(
|
||||
f"Direct Bearer - Response: {response.json() if response.content else 'No content'}"
|
||||
)
|
||||
|
||||
def test_debug_dependencies(self, client):
|
||||
"""Debug the dependency chain step by step"""
|
||||
# Test 1: Direct endpoint with no auth
|
||||
response = client.get("/api/v1/admin/users")
|
||||
print(f"Admin endpoint - Status: {response.status_code}")
|
||||
try:
|
||||
print(f"Admin endpoint - Response: {response.json()}")
|
||||
except:
|
||||
print(f"Admin endpoint - Raw: {response.content}")
|
||||
|
||||
# Test 2: Try a regular endpoint that uses get_current_user
|
||||
response2 = client.get(
|
||||
"/api/v1/marketplace/product"
|
||||
) # or any endpoint with get_current_user
|
||||
print(f"Regular endpoint - Status: {response2.status_code}")
|
||||
try:
|
||||
print(f"Regular endpoint - Response: {response2.json()}")
|
||||
except:
|
||||
print(f"Regular endpoint - Raw: {response2.content}")
|
||||
|
||||
def test_debug_available_routes(self, client):
|
||||
"""Debug test to see all available routes"""
|
||||
print("\n=== All Available Routes ===")
|
||||
for route in client.app.routes:
|
||||
if hasattr(route, "path") and hasattr(route, "methods"):
|
||||
print(f"{list(route.methods)} {route.path}")
|
||||
|
||||
print("\n=== Testing MarketplaceProduct Endpoint Variations ===")
|
||||
variations = [
|
||||
"/api/v1/marketplace/product", # Your current attempt
|
||||
"/api/v1/marketplace/product/", # With trailing slash
|
||||
"/api/v1/marketplace/product/list", # With list endpoint
|
||||
"/api/v1/marketplace/product/all", # With all endpoint
|
||||
]
|
||||
|
||||
for path in variations:
|
||||
response = client.get(path)
|
||||
print(f"{path}: Status {response.status_code}")
|
||||
def test_valid_token_accepted(self, client, admin_headers):
|
||||
"""Test that valid tokens are accepted"""
|
||||
response = client.get("/api/v1/admin/vendors", headers=admin_headers)
|
||||
assert response.status_code == 200
|
||||
|
||||
@@ -1,4 +1,11 @@
|
||||
# tests/integration/security/test_authorization.py
|
||||
"""
|
||||
Authorization tests for the API.
|
||||
|
||||
Tests role-based access control:
|
||||
- Admin endpoints require admin role
|
||||
- Vendor endpoints require vendor context (vendor_id in token)
|
||||
"""
|
||||
import pytest
|
||||
|
||||
|
||||
@@ -9,8 +16,8 @@ class TestAuthorization:
|
||||
def test_admin_endpoint_requires_admin_role(self, client, auth_headers):
|
||||
"""Test that admin endpoints require admin role"""
|
||||
response = client.get("/api/v1/admin/users", headers=auth_headers)
|
||||
assert response.status_code == 403
|
||||
# Regular user should be denied access
|
||||
# Regular user should be denied access (401 not admin or 403 forbidden)
|
||||
assert response.status_code in [401, 403]
|
||||
|
||||
def test_admin_endpoints_with_admin_access(self, client, admin_headers):
|
||||
"""Test that admin users can access admin endpoints"""
|
||||
@@ -22,29 +29,21 @@ class TestAuthorization:
|
||||
|
||||
for endpoint in admin_endpoints:
|
||||
response = client.get(endpoint, headers=admin_headers)
|
||||
assert response.status_code == 200 # Admin should have access
|
||||
assert response.status_code == 200, f"Admin should have access to {endpoint}"
|
||||
|
||||
def test_regular_endpoints_with_user_access(self, client, auth_headers):
|
||||
"""Test that regular users can access non-admin endpoints"""
|
||||
user_endpoints = [
|
||||
"/api/v1/marketplace/product",
|
||||
"/api/v1/stats",
|
||||
"/api/v1/inventory",
|
||||
]
|
||||
|
||||
for endpoint in user_endpoints:
|
||||
response = client.get(endpoint, headers=auth_headers)
|
||||
assert response.status_code == 200 # Regular user should have access
|
||||
def test_vendor_endpoint_requires_vendor_context(self, client, admin_headers):
|
||||
"""Test that vendor endpoints require vendor context in token"""
|
||||
# Admin token doesn't have vendor_id claim
|
||||
response = client.get("/api/v1/vendor/products", headers=admin_headers)
|
||||
# Should fail - admin token lacks vendor_id claim
|
||||
assert response.status_code in [401, 403]
|
||||
|
||||
def test_vendor_owner_access_control(
|
||||
self, client, auth_headers, test_vendor, other_user
|
||||
self, client, admin_headers, test_vendor
|
||||
):
|
||||
"""Test that users can only access their own vendors"""
|
||||
# Test accessing own vendor (should work)
|
||||
"""Test admin can access vendor by vendor code"""
|
||||
response = client.get(
|
||||
f"/api/v1/vendor/{test_vendor.vendor_code}", headers=auth_headers
|
||||
f"/api/v1/admin/vendors/{test_vendor.vendor_code}", headers=admin_headers
|
||||
)
|
||||
# Response depends on your implementation - could be 200 or 404 if vendor doesn't belong to user
|
||||
|
||||
# The exact assertion depends on your vendor access control implementation
|
||||
assert response.status_code in [200, 403, 404]
|
||||
# Admin should be able to view vendor
|
||||
assert response.status_code == 200
|
||||
|
||||
@@ -1,72 +1,58 @@
|
||||
# tests/integration/security/test_input_validation.py
|
||||
"""
|
||||
Input validation tests for the API.
|
||||
|
||||
Tests SQL injection prevention, parameter validation, and JSON validation.
|
||||
"""
|
||||
import pytest
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@pytest.mark.security
|
||||
class TestInputValidation:
|
||||
def test_sql_injection_prevention(self, client, auth_headers):
|
||||
def test_sql_injection_prevention(self, client, admin_headers):
|
||||
"""Test SQL injection prevention in search parameters"""
|
||||
# Try SQL injection in search parameter
|
||||
malicious_search = "'; DROP TABLE products; --"
|
||||
|
||||
response = client.get(
|
||||
f"/api/v1/marketplace/product?search={malicious_search}",
|
||||
headers=auth_headers,
|
||||
f"/api/v1/admin/products?search={malicious_search}",
|
||||
headers=admin_headers,
|
||||
)
|
||||
|
||||
# Should not crash and should return normal response
|
||||
assert response.status_code == 200
|
||||
# Database should still be intact (no products dropped)
|
||||
|
||||
# def test_input_validation(self, client, auth_headers):
|
||||
# # TODO: implement sanitization
|
||||
# """Test input validation and sanitization"""
|
||||
# # Test XSS attempt in product creation
|
||||
# xss_payload = "<script>alert('xss')</script>"
|
||||
#
|
||||
# product_data = {
|
||||
# "marketplace_product_id": "XSS_TEST",
|
||||
# "title": xss_payload,
|
||||
# "description": xss_payload,
|
||||
# }
|
||||
#
|
||||
# response = client.post("/api/v1/marketplace/product", headers=auth_headers, json=product_data)
|
||||
#
|
||||
# assert response.status_code == 200
|
||||
# data = response.json()
|
||||
# assert "<script>" not in data["title"]
|
||||
# assert "<script>" in data["title"]
|
||||
|
||||
def test_parameter_validation(self, client, auth_headers):
|
||||
def test_parameter_validation(self, client, admin_headers):
|
||||
"""Test parameter validation for API endpoints"""
|
||||
# Test invalid pagination parameters
|
||||
response = client.get(
|
||||
"/api/v1/marketplace/product?limit=-1", headers=auth_headers
|
||||
"/api/v1/admin/products?limit=-1", headers=admin_headers
|
||||
)
|
||||
assert response.status_code == 422 # Validation error
|
||||
|
||||
response = client.get(
|
||||
"/api/v1/marketplace/product?skip=-1", headers=auth_headers
|
||||
"/api/v1/admin/products?skip=-1", headers=admin_headers
|
||||
)
|
||||
assert response.status_code == 422 # Validation error
|
||||
|
||||
def test_json_validation(self, client, auth_headers):
|
||||
def test_json_validation(self, client, admin_headers, test_company):
|
||||
"""Test JSON validation for POST requests"""
|
||||
# Test invalid JSON structure
|
||||
response = client.post(
|
||||
"/api/v1/marketplace/product",
|
||||
headers=auth_headers,
|
||||
"/api/v1/admin/vendors",
|
||||
headers=admin_headers,
|
||||
content="invalid json content",
|
||||
)
|
||||
assert response.status_code == 422 # JSON decode error
|
||||
|
||||
# Test missing required fields
|
||||
response = client.post(
|
||||
"/api/v1/marketplace/product",
|
||||
headers=auth_headers,
|
||||
"/api/v1/admin/vendors",
|
||||
headers=admin_headers,
|
||||
json={
|
||||
"title": "Test MarketplaceProduct"
|
||||
}, # Missing required marketplace_product_id
|
||||
"name": "Test Vendor"
|
||||
}, # Missing required company_id, vendor_code
|
||||
)
|
||||
assert response.status_code == 422 # Validation error
|
||||
|
||||
Reference in New Issue
Block a user