102 lines
3.7 KiB
Python
102 lines
3.7 KiB
Python
from __future__ import annotations
|
|
|
|
|
|
def test_first_registered_user_is_admin(client):
|
|
register = client.post(
|
|
'/api/auth/register',
|
|
json={'username': 'admin_seed', 'password': 'secret12', 'display_name': 'AdminSeed'},
|
|
)
|
|
data = register.get_json()
|
|
assert register.status_code == 200
|
|
assert data['ok'] is True
|
|
assert data['user']['role'] == 'admin'
|
|
|
|
|
|
def test_non_admin_cannot_access_admin_api(client):
|
|
client.post(
|
|
'/api/auth/register',
|
|
json={'username': 'root_user', 'password': 'secret12', 'display_name': 'Root'},
|
|
)
|
|
client.post('/api/auth/logout', json={})
|
|
client.post(
|
|
'/api/auth/register',
|
|
json={'username': 'normal_user', 'password': 'secret12', 'display_name': 'Normal'},
|
|
)
|
|
denied = client.get('/api/admin/users')
|
|
assert denied.status_code == 403
|
|
assert denied.get_json()['ok'] is False
|
|
|
|
|
|
def test_admin_page_access_control(client):
|
|
guest_page = client.get('/admin')
|
|
assert guest_page.status_code == 302
|
|
|
|
client.post(
|
|
'/api/auth/register',
|
|
json={'username': 'admin_page_owner', 'password': 'secret12', 'display_name': 'AdminPage'},
|
|
)
|
|
admin_page = client.get('/admin')
|
|
assert admin_page.status_code == 200
|
|
assert '后台管理' in admin_page.get_data(as_text=True)
|
|
|
|
|
|
def test_admin_can_manage_users_rooms_cards(client):
|
|
admin_username = 'boss_admin'
|
|
admin_password = 'secret12'
|
|
client.post(
|
|
'/api/auth/register',
|
|
json={'username': admin_username, 'password': admin_password, 'display_name': 'Boss'},
|
|
)
|
|
client.post('/api/auth/logout', json={})
|
|
|
|
player_username = 'guest_player'
|
|
player_password = 'secret12'
|
|
client.post(
|
|
'/api/auth/register',
|
|
json={'username': player_username, 'password': player_password, 'display_name': 'Guest'},
|
|
)
|
|
created_room = client.post('/api/rooms/create', json={}).get_json()
|
|
created_card = client.post(
|
|
'/api/cards',
|
|
json={'title': '后台删卡测试', 'summary': 'for admin', 'opening_text': 'open'},
|
|
).get_json()
|
|
room_id = created_room['room_id']
|
|
card_id = created_card['card']['card_id']
|
|
guest_user_id = created_card['card']['creator_user_id']
|
|
|
|
client.post('/api/auth/logout', json={})
|
|
login = client.post('/api/auth/login', json={'username': admin_username, 'password': admin_password})
|
|
assert login.status_code == 200
|
|
|
|
users_resp = client.get('/api/admin/users')
|
|
assert users_resp.status_code == 200
|
|
users_data = users_resp.get_json()
|
|
assert users_data['ok'] is True
|
|
assert any(row['user_id'] == guest_user_id for row in users_data['users'])
|
|
|
|
role_update = client.patch(f'/api/admin/users/{guest_user_id}/role', json={'role': 'moderator'})
|
|
assert role_update.status_code == 200
|
|
assert role_update.get_json()['user']['role'] == 'moderator'
|
|
|
|
rooms_resp = client.get('/api/admin/rooms')
|
|
assert rooms_resp.status_code == 200
|
|
rooms_data = rooms_resp.get_json()['rooms']
|
|
assert any(row['room_id'] == room_id for row in rooms_data)
|
|
|
|
delete_room = client.delete(f'/api/admin/rooms/{room_id}')
|
|
assert delete_room.status_code == 200
|
|
assert delete_room.get_json()['ok'] is True
|
|
|
|
cards_resp = client.get('/api/admin/cards')
|
|
assert cards_resp.status_code == 200
|
|
cards_data = cards_resp.get_json()['cards']
|
|
assert any(row['card_id'] == card_id for row in cards_data)
|
|
|
|
set_official = client.patch(f'/api/admin/cards/{card_id}', json={'is_official': True})
|
|
assert set_official.status_code == 200
|
|
assert set_official.get_json()['card']['is_official'] is True
|
|
|
|
delete_card = client.delete(f'/api/admin/cards/{card_id}')
|
|
assert delete_card.status_code == 200
|
|
assert delete_card.get_json()['ok'] is True
|