tests/test_admin_security.py

from __future__ import annotations

from fastapi.testclient import TestClient

from backend.app.core.config import settings
from backend.app.main import app


def test_admin_mutation_endpoints_are_disabled_by_default(monkeypatch) -> None:
    if "enable_admin_mutations" in type(settings).model_fields:
        monkeypatch.setattr(settings, "enable_admin_mutations", False)

    client = TestClient(app)
    endpoints = [
        ("/admin/embeddings/reindex", {}),
        ("/admin/embeddings/strategy-cache/invalidate", {}),
        ("/admin/dlq/replay", {}),
        ("/api/pipeline/ingest", {"event": "gold.ingest", "records": []}),
        ("/api/pipeline/dispatch", {}),
        ("/api/pipeline/seed", {}),
        ("/api/graph/ingest", {"records": []}),
    ]

    for path, body in endpoints:
        response = client.post(path, json=body)
        assert response.status_code == 403, path
        assert "disabled" in response.json()["detail"].lower()


def test_admin_status_endpoint_remains_readable_when_mutations_disabled(monkeypatch) -> None:
    if "enable_admin_mutations" in type(settings).model_fields:
        monkeypatch.setattr(settings, "enable_admin_mutations", False)

    response = TestClient(app).get("/admin/embeddings/status")

    assert response.status_code == 200