Spaces:
Sleeping
Sleeping
File size: 7,896 Bytes
4c94294 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 | import pytest
from fastapi.testclient import TestClient
from main import app
from unittest.mock import patch, MagicMock
from sqlmodel import Session, select
import json
client = TestClient(app)
def test_user_data_isolation():
"""Test that users can only access their own data"""
# Mock user 1
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_1"
# Create a task for user 1
response = client.post(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user1"},
json={
"title": "User 1 Task",
"description": "This belongs to user 1",
"priority": "medium"
}
)
assert response.status_code == 200
user1_task = response.json()["data"]
assert user1_task["user_id"] == "user_1"
task_id = user1_task["id"]
# Now mock user 2 and try to access/modify user 1's task
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_2"
# Try to get user 1's task as user 2 (should return 404 or some indication that user 2 can't see it)
response = client.get(
f"/api/tasks/{task_id}",
headers={"Authorization": "Bearer valid_token_for_user2"}
)
# This depends on the implementation - it might return 404 or 403
# The key is that user 2 should not be able to access user 1's task
assert response.status_code in [404, 403] # Should not be able to access another user's task
# Try to update user 1's task as user 2
response = client.put(
f"/api/tasks/{task_id}",
headers={"Authorization": "Bearer valid_token_for_user2"},
json={
"title": "User 2 trying to update user 1's task"
}
)
assert response.status_code in [404, 403] # Should not be able to modify another user's task
# Try to delete user 1's task as user 2
response = client.delete(
f"/api/tasks/{task_id}",
headers={"Authorization": "Bearer valid_token_for_user2"}
)
assert response.status_code in [404, 403] # Should not be able to delete another user's task
# Try to toggle completion of user 1's task as user 2
response = client.patch(
f"/api/tasks/{task_id}/complete",
headers={"Authorization": "Bearer valid_token_for_user2"}
)
assert response.status_code in [404, 403] # Should not be able to modify another user's task
def test_user_can_access_own_data():
"""Test that users can access their own data"""
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_3"
# Create a task for user 3
response = client.post(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user3"},
json={
"title": "User 3 Task",
"description": "This belongs to user 3",
"priority": "high"
}
)
assert response.status_code == 200
user3_task = response.json()["data"]
assert user3_task["user_id"] == "user_3"
task_id = user3_task["id"]
# User 3 should be able to get their own task
response = client.get(
f"/api/tasks/{task_id}",
headers={"Authorization": "Bearer valid_token_for_user3"}
)
assert response.status_code == 200
returned_task = response.json()["data"]
assert returned_task["id"] == task_id
assert returned_task["user_id"] == "user_3"
# User 3 should be able to update their own task
response = client.put(
f"/api/tasks/{task_id}",
headers={"Authorization": "Bearer valid_token_for_user3"},
json={
"title": "User 3 Updated Task",
"priority": "low"
}
)
assert response.status_code == 200
updated_task = response.json()["data"]
assert updated_task["title"] == "User 3 Updated Task"
assert updated_task["priority"] == "low"
# User 3 should be able to delete their own task
response = client.delete(
f"/api/tasks/{task_id}",
headers={"Authorization": "Bearer valid_token_for_user3"}
)
assert response.status_code == 200 # Should be able to delete their own task
def test_user_sees_only_own_tasks():
"""Test that when getting all tasks, users only see their own"""
# Create tasks for different users in a realistic scenario
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_a"
# Create multiple tasks for user A
response = client.post(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user_a"},
json={"title": "User A Task 1", "priority": "medium"}
)
assert response.status_code == 200
task_a1_id = response.json()["data"]["id"]
response = client.post(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user_a"},
json={"title": "User A Task 2", "priority": "high"}
)
assert response.status_code == 200
task_a2_id = response.json()["data"]["id"]
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_b"
# Create multiple tasks for user B
response = client.post(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user_b"},
json={"title": "User B Task 1", "priority": "low"}
)
assert response.status_code == 200
task_b1_id = response.json()["data"]["id"]
response = client.post(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user_b"},
json={"title": "User B Task 2", "priority": "high"}
)
assert response.status_code == 200
task_b2_id = response.json()["data"]["id"]
# Now test that each user only sees their own tasks
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_a"
response = client.get(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user_a"}
)
assert response.status_code == 200
user_a_tasks = response.json()["data"]
# Check that user A only sees their own tasks
user_a_task_ids = [task["id"] for task in user_a_tasks]
assert task_a1_id in user_a_task_ids
assert task_a2_id in user_a_task_ids
assert task_b1_id not in user_a_task_ids # User A should not see User B's tasks
assert task_b2_id not in user_a_task_ids # User A should not see User B's tasks
with patch("auth.jwt.get_current_user_id") as mock_get_user:
mock_get_user.return_value = "user_b"
response = client.get(
"/api/tasks",
headers={"Authorization": "Bearer valid_token_for_user_b"}
)
assert response.status_code == 200
user_b_tasks = response.json()["data"]
# Check that user B only sees their own tasks
user_b_task_ids = [task["id"] for task in user_b_tasks]
assert task_b1_id in user_b_task_ids
assert task_b2_id in user_b_task_ids
assert task_a1_id not in user_b_task_ids # User B should not see User A's tasks
assert task_a2_id not in user_b_task_ids # User B should not see User A's tasks |