This commit is contained in:
2025-09-21 13:00:10 +02:00
parent a26f8086f8
commit c2a1056db7
56 changed files with 339 additions and 104 deletions

View File

@@ -36,11 +36,15 @@ class TestAuthorization:
response = client.get(endpoint, headers=auth_headers)
assert response.status_code == 200 # Regular user should have access
def test_shop_owner_access_control(self, client, auth_headers, test_shop, other_user):
def test_shop_owner_access_control(
self, client, auth_headers, test_shop, other_user
):
"""Test that users can only access their own shops"""
# Test accessing own shop (should work)
response = client.get(f"/api/v1/shop/{test_shop.shop_code}", headers=auth_headers)
response = client.get(
f"/api/v1/shop/{test_shop.shop_code}", headers=auth_headers
)
# Response depends on your implementation - could be 200 or 404 if shop doesn't belong to user
# The exact assertion depends on your shop access control implementation
assert response.status_code in [200, 403, 404]