Fix test failures and workload/websocket behavior

backend/tests/test_workload.py

@@ -195,6 +195,19 @@ class TestWorkloadService:
         assert summary.load_level == LoadLevel.NORMAL
         assert summary.task_count == 0
 
+    def test_calculate_user_workload_zero_capacity(self, db):
+        """User with zero capacity should return unavailable load level."""
+        data = self.setup_test_data(db)
+        data["engineer"].capacity = 0
+        db.commit()
+
+        week_start = date(2024, 1, 1)
+        summary = calculate_user_workload(db, data["engineer"], week_start)
+
+        assert summary.capacity_hours == Decimal("0")
+        assert summary.load_percentage is None
+        assert summary.load_level == LoadLevel.UNAVAILABLE
+
     def test_calculate_user_workload_with_tasks(self, db):
         """User with tasks should have correct allocated hours."""
         data = self.setup_test_data(db)
@@ -445,6 +458,7 @@ class TestWorkloadAccessControl:
     def setup_test_data(self, db, mock_redis):
         """Set up test data with two departments."""
         from app.core.security import create_access_token, create_token_payload
+        from app.services.workload_service import get_current_week_start
 
         # Create departments
         dept_rd = Department(id="dept-rd", name="R&D")
@@ -478,6 +492,38 @@ class TestWorkloadAccessControl:
         )
         db.add(engineer_ops)
 
+        # Create space and project for workload task
+        space = Space(
+            id="space-wl-acl-001",
+            name="Workload ACL Space",
+            owner_id="00000000-0000-0000-0000-000000000001",
+            is_active=True,
+        )
+        db.add(space)
+
+        project = Project(
+            id="project-wl-acl-001",
+            space_id=space.id,
+            title="Workload ACL Project",
+            owner_id="00000000-0000-0000-0000-000000000001",
+            department_id=dept_rd.id,
+            security_level="department",
+        )
+        db.add(project)
+
+        # Create a task for the R&D engineer so they appear in heatmap
+        week_start = get_current_week_start()
+        due_date = datetime.combine(week_start, datetime.min.time()) + timedelta(days=2)
+        task = Task(
+            id="task-wl-acl-001",
+            project_id=project.id,
+            title="Workload ACL Task",
+            assignee_id=engineer_rd.id,
+            due_date=due_date,
+            created_by="00000000-0000-0000-0000-000000000001",
+        )
+        db.add(task)
+
         db.commit()
 
         # Create token for R&D engineer
@@ -514,6 +560,18 @@ class TestWorkloadAccessControl:
         assert len(result["users"]) == 1
         assert result["users"][0]["user_id"] == "user-rd-001"
 
+    def test_regular_user_cannot_filter_other_user_ids(self, client, db, mock_redis):
+        """Regular user should not filter workload for other users."""
+        data = self.setup_test_data(db, mock_redis)
+        user_ids = f"{data['engineer_rd'].id},{data['engineer_ops'].id}"
+
+        response = client.get(
+            f"/api/workload/heatmap?user_ids={user_ids}",
+            headers={"Authorization": f"Bearer {data['rd_token']}"},
+        )
+
+        assert response.status_code == 403
+
     def test_regular_user_cannot_access_other_department(self, client, db, mock_redis):
         """Regular user should not access other department's workload."""
         data = self.setup_test_data(db, mock_redis)