PROJECT-CONTORL/backend/tests/test_users.py

import pytest
from app.models.user import User
from app.models.department import Department


class TestUserEndpoints:
    """Test user management API endpoints."""

    def test_list_users_as_admin(self, client, admin_token):
        """Test listing users as admin."""
        response = client.get(
            "/api/users",
            headers={"Authorization": f"Bearer {admin_token}"},
        )
        assert response.status_code == 200
        data = response.json()
        assert isinstance(data, list)
        assert len(data) >= 1  # At least admin user exists

    def test_get_user_by_id(self, client, admin_token):
        """Test getting a specific user."""
        response = client.get(
            "/api/users/00000000-0000-0000-0000-000000000001",
            headers={"Authorization": f"Bearer {admin_token}"},
        )
        assert response.status_code == 200
        data = response.json()
        assert data["email"] == "ymirliu@panjit.com.tw"

    def test_get_nonexistent_user(self, client, admin_token):
        """Test getting a user that doesn't exist."""
        response = client.get(
            "/api/users/nonexistent-id",
            headers={"Authorization": f"Bearer {admin_token}"},
        )
        assert response.status_code == 404

    def test_update_user(self, client, admin_token, db):
        """Test updating a user."""
        # Create a test user
        test_user = User(
            id="test-user-001",
            email="test@example.com",
            name="Test User",
            is_active=True,
        )
        db.add(test_user)
        db.commit()

        response = client.patch(
            "/api/users/test-user-001",
            headers={"Authorization": f"Bearer {admin_token}"},
            json={"name": "Updated Name"},
        )
        assert response.status_code == 200
        data = response.json()
        assert data["name"] == "Updated Name"

    def test_cannot_modify_system_admin_as_non_admin(self, client, db, mock_redis):
        """Test that non-admin cannot modify system admin."""
        from app.core.security import create_access_token, create_token_payload

        # Create a non-admin user
        non_admin = User(
            id="non-admin-001",
            email="nonadmin@example.com",
            name="Non Admin",
            role_id="00000000-0000-0000-0000-000000000003",  # engineer role
            is_active=True,
            is_system_admin=False,
        )
        db.add(non_admin)
        db.commit()

        # Create token for non-admin
        token_data = create_token_payload(
            user_id="non-admin-001",
            email="nonadmin@example.com",
            role="engineer",
            department_id=None,
            is_system_admin=False,
        )
        token = create_access_token(token_data)
        mock_redis.setex("session:non-admin-001", 900, token)

        # Try to modify system admin - should fail with 403
        response = client.patch(
            "/api/users/00000000-0000-0000-0000-000000000001",
            headers={"Authorization": f"Bearer {token}"},
            json={"name": "Hacked Name"},
        )
        # Engineer role doesn't have users.write permission
        assert response.status_code == 403


class TestDepartmentIsolation:
    """Test department-based access control."""

    def test_department_isolation(self, client, db, mock_redis):
        """Test that users can only see users in their department."""
        from app.core.security import create_access_token, create_token_payload

        # Create departments
        dept_a = Department(id="dept-a", name="Department A")
        dept_b = Department(id="dept-b", name="Department B")
        db.add_all([dept_a, dept_b])

        # Create manager role
        from app.models.role import Role
        manager_role = Role(
            id="manager-role",
            name="manager",
            permissions={"users.read": True, "users.write": True},
        )
        db.add(manager_role)

        # Create users in different departments
        user_a = User(
            id="user-a",
            email="usera@example.com",
            name="User A",
            department_id="dept-a",
            role_id="manager-role",
            is_active=True,
        )
        user_b = User(
            id="user-b",
            email="userb@example.com",
            name="User B",
            department_id="dept-b",
            role_id="manager-role",
            is_active=True,
        )
        db.add_all([user_a, user_b])
        db.commit()

        # Create token for user A
        token_data = create_token_payload(
            user_id="user-a",
            email="usera@example.com",
            role="manager",
            department_id="dept-a",
            is_system_admin=False,
        )
        token = create_access_token(token_data)
        mock_redis.setex("session:user-a", 900, token)

        # User A should only see users in dept-a
        response = client.get(
            "/api/users",
            headers={"Authorization": f"Bearer {token}"},
        )
        assert response.status_code == 200
        data = response.json()

        # Should only contain user A (filtered by department)
        emails = [u["email"] for u in data]
        assert "usera@example.com" in emails
        assert "userb@example.com" not in emails