157 lines
4.7 KiB
Python
157 lines
4.7 KiB
Python
def test_get_users_admin(client, admin_token):
|
|
"""测试管理员获取用户列表"""
|
|
response = client.get(
|
|
"/api/users",
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
assert response.status_code == 200
|
|
assert len(response.json()) >= 3
|
|
|
|
|
|
def test_get_users_non_admin(client, marketing_token):
|
|
"""测试非管理员获取用户列表（权限不足）"""
|
|
response = client.get(
|
|
"/api/users",
|
|
headers={"Authorization": f"Bearer {marketing_token}"}
|
|
)
|
|
assert response.status_code == 403
|
|
assert "Not enough permissions" in response.json()["detail"]
|
|
|
|
|
|
def test_create_user_admin(client, admin_token):
|
|
"""测试管理员创建用户"""
|
|
new_user = {
|
|
"username": "new_test_user",
|
|
"password": "new_password",
|
|
"department": "Test Department",
|
|
"role": "other"
|
|
}
|
|
response = client.post(
|
|
"/api/users",
|
|
json=new_user,
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["username"] == "new_test_user"
|
|
assert response.json()["department"] == "Test Department"
|
|
assert response.json()["role"] == "other"
|
|
|
|
|
|
def test_create_user_non_admin(client, marketing_token):
|
|
"""测试非管理员创建用户（权限不足）"""
|
|
new_user = {
|
|
"username": "new_test_user",
|
|
"password": "new_password",
|
|
"department": "Test Department",
|
|
"role": "other"
|
|
}
|
|
response = client.post(
|
|
"/api/users",
|
|
json=new_user,
|
|
headers={"Authorization": f"Bearer {marketing_token}"}
|
|
)
|
|
assert response.status_code == 403
|
|
assert "Not enough permissions" in response.json()["detail"]
|
|
|
|
|
|
def test_create_user_existing_username(client, admin_token):
|
|
"""测试创建用户 - 用户名已存在"""
|
|
new_user = {
|
|
"username": "test_admin",
|
|
"password": "new_password",
|
|
"department": "Test Department",
|
|
"role": "other"
|
|
}
|
|
response = client.post(
|
|
"/api/users",
|
|
json=new_user,
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
assert response.status_code == 400
|
|
assert "Username already registered" in response.json()["detail"]
|
|
|
|
|
|
def test_update_user_admin(client, admin_token):
|
|
"""测试管理员更新用户"""
|
|
# 先获取用户ID，选择一个非管理员用户
|
|
response = client.get(
|
|
"/api/users",
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
users = response.json()
|
|
|
|
# 找到一个非管理员用户
|
|
user_id = None
|
|
for user in users:
|
|
if user["role"] != "admin":
|
|
user_id = user["id"]
|
|
break
|
|
|
|
assert user_id is not None, "No non-admin user found for update"
|
|
|
|
# 更新用户
|
|
update_data = {
|
|
"password": "updated_password",
|
|
"department": "Updated Department",
|
|
"role": "other"
|
|
}
|
|
response = client.put(
|
|
f"/api/users/{user_id}",
|
|
json=update_data,
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["department"] == "Updated Department"
|
|
assert response.json()["role"] == "other"
|
|
|
|
|
|
def test_update_user_non_admin(client, marketing_token):
|
|
"""测试非管理员更新用户（权限不足）"""
|
|
# 先获取用户ID
|
|
response = client.get(
|
|
"/api/users",
|
|
headers={"Authorization": f"Bearer {marketing_token}"}
|
|
)
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_delete_user_admin(client, admin_token):
|
|
"""测试管理员删除用户"""
|
|
# 先创建一个新的测试用户
|
|
new_user = {
|
|
"username": "delete_test_user",
|
|
"password": "delete_password",
|
|
"department": "Test Department",
|
|
"role": "other"
|
|
}
|
|
create_response = client.post(
|
|
"/api/users",
|
|
json=new_user,
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
|
|
# 确保创建用户成功
|
|
assert create_response.status_code == 200
|
|
user_id = create_response.json()["id"]
|
|
|
|
# 删除用户
|
|
response = client.delete(
|
|
f"/api/users/{user_id}",
|
|
headers={"Authorization": f"Bearer {admin_token}"}
|
|
)
|
|
|
|
# 确保删除用户成功
|
|
assert response.status_code == 200
|
|
assert "User deleted successfully" in response.json()["message"]
|
|
|
|
|
|
def test_delete_user_non_admin(client, marketing_token):
|
|
"""测试非管理员删除用户（权限不足）"""
|
|
# 假设用户ID为1
|
|
response = client.delete(
|
|
"/api/users/1",
|
|
headers={"Authorization": f"Bearer {marketing_token}"}
|
|
)
|
|
assert response.status_code == 403
|
|
assert "Not enough permissions" in response.json()["detail"]
|