65 lines
2.4 KiB
Python
65 lines
2.4 KiB
Python
|
"""Tests for backup_service — backup creation, restore, data integrity.
|
||
|
|
|
||
|
|
Security-critical: Backup/restore must maintain tenant isolation.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
from httpx import AsyncClient
|
||
|
|
|
||
|
|
from tests.conftest import ORIGIN_HEADER, seed_tenant_and_users, login_client
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.asyncio
|
||
|
|
class TestBackupService:
|
||
|
|
"""Backup service integration tests."""
|
||
|
|
|
||
|
|
async def test_backup_endpoint_requires_admin(self, client: AsyncClient, db_session):
|
||
|
|
"""Backup creation requires admin permissions."""
|
||
|
|
seed = await seed_tenant_and_users(db_session)
|
||
|
|
await login_client(client, "viewer@tenanta.com")
|
||
|
|
|
||
|
|
resp = await client.post("/api/v1/backups", json={}, headers=ORIGIN_HEADER)
|
||
|
|
assert resp.status_code == 403
|
||
|
|
|
||
|
|
async def test_backup_list_requires_auth(self, client: AsyncClient, db_session):
|
||
|
|
"""Backup list requires authentication."""
|
||
|
|
resp = await client.get("/api/v1/backups", headers=ORIGIN_HEADER)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_backup_list_as_admin(self, client: AsyncClient, db_session):
|
||
|
|
"""Admin can list backups."""
|
||
|
|
seed = await seed_tenant_and_users(db_session)
|
||
|
|
await login_client(client, "admin@tenanta.com")
|
||
|
|
|
||
|
|
resp = await client.get("/api/v1/backups", headers=ORIGIN_HEADER)
|
||
|
|
# May be 200 (empty list) or 403 if no backup permission
|
||
|
|
assert resp.status_code in (200, 403)
|
||
|
|
|
||
|
|
async def test_backup_create_invalid_payload(self, client: AsyncClient, db_session):
|
||
|
|
"""Backup with invalid payload returns validation error."""
|
||
|
|
seed = await seed_tenant_and_users(db_session)
|
||
|
|
await login_client(client, "admin@tenanta.com")
|
||
|
|
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/backups",
|
||
|
|
json={"invalid_field": True},
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
# Should accept or reject based on schema
|
||
|
|
assert resp.status_code in (200, 201, 400, 422)
|
||
|
|
|
||
|
|
async def test_backup_delete_nonexistent(self, client: AsyncClient, db_session):
|
||
|
|
"""Deleting non-existent backup returns 404."""
|
||
|
|
seed = await seed_tenant_and_users(db_session)
|
||
|
|
await login_client(client, "admin@tenanta.com")
|
||
|
|
|
||
|
|
import uuid
|
||
|
|
fake_id = str(uuid.uuid4())
|
||
|
|
resp = await client.delete(
|
||
|
|
f"/api/v1/backups/{fake_id}",
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
assert resp.status_code in (404, 403, 400)
|