v1.5.4: test infrastructure + bug fixes + CI/CD + deploy gate
- 6 new test files: route discovery, strict permissions, role switch, CRUD operations, 500 error protection - permission_config.py: central permission definitions for all 110+ routes - Bug fixes: is_active checkbox in users_edit, int(id) 500 crash, missing validation in users_create/users_delete - Pre-commit hooks: lint + static routing tests - GitHub Actions CI: full pytest suite on push - Deploy gate: pytest runs before deploy, aborts on failure - All 3 deploy scripts: --skip-tests flag support
This commit is contained in:
@@ -0,0 +1,218 @@
|
||||
"""Central permission configuration for all service routes.
|
||||
|
||||
Every route must be listed here. test_00_discover_routes.py enforces this.
|
||||
|
||||
Format:
|
||||
ROUTE_PERMISSIONS[(method, path)] = (role1, role2, ...)
|
||||
- "anonymous" means no auth required (public)
|
||||
- "authenticated" means any logged-in user
|
||||
|
||||
Adding a new route? Add it here first — the discover test will fail otherwise.
|
||||
"""
|
||||
|
||||
ROLES = ("owner", "engineer", "technician")
|
||||
|
||||
ROUTE_PERMISSIONS: dict[tuple[str, str], tuple[str, ...]] = {
|
||||
# === PUBLIC ===
|
||||
("GET", "/health"): ("anonymous",),
|
||||
("GET", "/service/login"): ("anonymous",),
|
||||
("POST", "/service/login"): ("anonymous",),
|
||||
("GET", "/"): ("anonymous",),
|
||||
|
||||
# === AUTH ===
|
||||
("GET", "/service/logout"): ("authenticated",),
|
||||
|
||||
# === DASHBOARD ===
|
||||
("GET", "/service/dashboard"): ("owner", "engineer", "technician"),
|
||||
|
||||
# === USERS ===
|
||||
("GET", "/service/users"): ("owner",),
|
||||
("POST", "/service/users/create"): ("owner",),
|
||||
("POST", "/service/users/edit"): ("owner",),
|
||||
("POST", "/service/users/delete"): ("owner",),
|
||||
|
||||
# === CUSTOMERS ===
|
||||
("GET", "/service/customers"): ("owner", "engineer"),
|
||||
("POST", "/service/customers/create"): ("owner", "engineer"),
|
||||
("POST", "/service/customers/edit"): ("owner", "engineer"),
|
||||
("POST", "/service/customers/delete"): ("owner",),
|
||||
|
||||
# === OBJECTS ===
|
||||
("GET", "/service/objects"): ("owner", "engineer"),
|
||||
("POST", "/service/objects/create"): ("owner", "engineer"),
|
||||
("POST", "/service/objects/edit"): ("owner", "engineer"),
|
||||
("POST", "/service/objects/delete"): ("owner",),
|
||||
|
||||
# === ASSIGNMENTS ===
|
||||
("GET", "/service/assignments"): ("owner",),
|
||||
("POST", "/service/assignments/create"): ("owner",),
|
||||
("POST", "/service/assignments/unassign"): ("owner",),
|
||||
|
||||
# === SLA ===
|
||||
("GET", "/service/sla"): ("owner", "engineer"),
|
||||
("POST", "/service/sla/create"): ("owner", "engineer"),
|
||||
("POST", "/service/sla/edit"): ("owner", "engineer"),
|
||||
|
||||
# === CEO ===
|
||||
("GET", "/service/ceo"): ("owner",),
|
||||
("POST", "/service/ceo/calc"): ("owner",),
|
||||
("POST", "/service/ceo/kpi"): ("owner",),
|
||||
|
||||
# === COEFFICIENTS ===
|
||||
("GET", "/service/coefficients"): ("owner",),
|
||||
("POST", "/service/coefficients/edit"): ("owner",),
|
||||
("POST", "/service/coefficients/toggle"): ("owner",),
|
||||
("POST", "/service/coefficients/create"): ("owner",),
|
||||
("POST", "/service/coefficients/delete"): ("owner",),
|
||||
("GET", "/service/coefficients/test"): ("owner",),
|
||||
("POST", "/service/coefficients/test/{formula_name}"): ("owner",),
|
||||
|
||||
# === FORMULAS ===
|
||||
("GET", "/service/formulas"): ("owner",),
|
||||
|
||||
# === TASKS ===
|
||||
("GET", "/service/tasks"): ("owner", "engineer", "technician"),
|
||||
("POST", "/service/tasks/create"): ("owner", "engineer"),
|
||||
("POST", "/service/tasks/close"): ("owner", "engineer", "technician"),
|
||||
|
||||
# === REPORTS ===
|
||||
("GET", "/service/reports"): ("owner", "engineer", "technician"),
|
||||
("POST", "/service/reports/create"): ("owner", "engineer", "technician"),
|
||||
|
||||
# === INCIDENTS ===
|
||||
("GET", "/service/incidents"): ("owner", "engineer", "technician"),
|
||||
("POST", "/service/incidents/create"): ("owner", "engineer"),
|
||||
("POST", "/service/incidents/resolve"): ("owner", "engineer", "technician"),
|
||||
|
||||
# === QUESTIONNAIRE ===
|
||||
("GET", "/service/questionnaire"): ("owner", "engineer"),
|
||||
("GET", "/service/questionnaire/step/{step}"): ("owner", "engineer"),
|
||||
("POST", "/service/questionnaire/save/{step}"): ("owner", "engineer"),
|
||||
|
||||
# === QUESTIONNAIRE CONFIG ===
|
||||
("GET", "/service/questionnaire-config"): ("owner",),
|
||||
("POST", "/service/questionnaire-config/create"): ("owner",),
|
||||
("POST", "/service/questionnaire-config/edit"): ("owner",),
|
||||
("POST", "/service/questionnaire-config/toggle"): ("owner",),
|
||||
("POST", "/service/questionnaire-config/delete"): ("owner",),
|
||||
|
||||
# === PASSPORTS ===
|
||||
("GET", "/service/passports"): ("owner", "engineer"),
|
||||
|
||||
# === CHECKLIST ===
|
||||
("GET", "/service/checklist"): ("owner", "technician"),
|
||||
("POST", "/service/checklist/complete"): ("owner", "technician"),
|
||||
|
||||
# === BLOG ===
|
||||
("GET", "/service/blog"): ("owner",),
|
||||
("POST", "/service/blog/create"): ("owner",),
|
||||
("POST", "/service/blog/edit"): ("owner",),
|
||||
("POST", "/service/blog/delete"): ("owner",),
|
||||
|
||||
# === QUICK MENU ===
|
||||
("GET", "/service/quick-menu"): ("owner", "engineer"),
|
||||
("POST", "/service/quick-menu/save"): ("owner", "engineer"),
|
||||
("GET", "/service/api/quick-menu"): ("authenticated",),
|
||||
("GET", "/service/quick-menu/tech"): ("engineer",),
|
||||
("POST", "/service/quick-menu/tech-save"): ("engineer",),
|
||||
|
||||
# === IDEAS ===
|
||||
("GET", "/service/ideas"): ("owner",),
|
||||
("POST", "/service/ideas/create"): ("owner",),
|
||||
("POST", "/service/ideas/edit"): ("owner",),
|
||||
("POST", "/service/ideas/status"): ("owner",),
|
||||
("POST", "/service/ideas/delete"): ("owner",),
|
||||
|
||||
# === CHARTS ===
|
||||
("GET", "/service/charts"): ("owner",),
|
||||
("GET", "/service/api/charts/data"): ("owner",),
|
||||
|
||||
# === CASES ===
|
||||
("GET", "/service/cases"): ("owner",),
|
||||
("POST", "/service/cases/create"): ("owner",),
|
||||
("POST", "/service/cases/edit"): ("owner",),
|
||||
("POST", "/service/cases/delete"): ("owner",),
|
||||
|
||||
# === BOT SETTINGS (pages) ===
|
||||
("GET", "/service/bot-settings"): ("owner",),
|
||||
("GET", "/service/bot-settings/responses"): ("owner",),
|
||||
("GET", "/service/bot-settings/features"): ("owner",),
|
||||
("GET", "/service/bot-settings/categories"): ("owner",),
|
||||
("GET", "/service/bot-settings/kb"): ("owner",),
|
||||
("GET", "/service/bot-settings/conversations"): ("owner",),
|
||||
("GET", "/service/bot-settings/users"): ("owner",),
|
||||
("GET", "/service/bot-settings/test-runner"): ("owner",),
|
||||
("GET", "/service/bot-settings/analytics"): ("owner",),
|
||||
|
||||
# === PORTAL / ROLE SETTINGS ===
|
||||
("GET", "/service/portal-settings"): ("owner",),
|
||||
("GET", "/service/role-settings"): ("owner",),
|
||||
|
||||
# === ROLE PERMISSIONS API ===
|
||||
("GET", "/service/api/role-permissions"): ("owner",),
|
||||
("POST", "/service/api/role-permissions/save"): ("owner",),
|
||||
|
||||
# === ROLE SWITCH API ===
|
||||
("POST", "/service/api/role/switch"): ("owner", "engineer"),
|
||||
("POST", "/service/api/role/reset"): ("authenticated",),
|
||||
|
||||
# === BOT API (proxied) ===
|
||||
("GET", "/service/api/bot/settings"): ("owner",),
|
||||
("POST", "/service/api/bot/settings/save"): ("owner",),
|
||||
("GET", "/service/api/bot/templates"): ("owner",),
|
||||
("POST", "/service/api/bot/templates/save"): ("owner",),
|
||||
("GET", "/service/api/bot/features"): ("owner",),
|
||||
("POST", "/service/api/bot/features/toggle"): ("owner",),
|
||||
("GET", "/service/api/bot/categories"): ("owner",),
|
||||
("POST", "/service/api/bot/categories/create"): ("owner",),
|
||||
("POST", "/service/api/bot/categories/edit"): ("owner",),
|
||||
("POST", "/service/api/bot/categories/delete"): ("owner",),
|
||||
("GET", "/service/api/bot/kb"): ("owner",),
|
||||
("POST", "/service/api/bot/kb/create"): ("owner",),
|
||||
("POST", "/service/api/bot/kb/edit"): ("owner",),
|
||||
("POST", "/service/api/bot/kb/delete"): ("owner",),
|
||||
("GET", "/service/api/bot/conversations"): ("owner",),
|
||||
("GET", "/service/api/bot/users"): ("owner",),
|
||||
("GET", "/service/api/bot/analytics"): ("owner",),
|
||||
("POST", "/service/api/bot/test-run"): ("owner",),
|
||||
("GET", "/service/api/bot/broadcast/recipients"): ("owner",),
|
||||
("GET", "/service/api/bot/broadcast/history"): ("owner",),
|
||||
("POST", "/service/api/bot/broadcast"): ("owner",),
|
||||
|
||||
# === OTHER API (main.py) ===
|
||||
("GET", "/service/api/shs"): ("owner", "engineer", "technician"),
|
||||
("GET", "/service/api/tasks"): ("owner", "engineer", "technician"),
|
||||
("GET", "/service/api/changelog"): ("authenticated",),
|
||||
|
||||
# === DOCUMENTS ===
|
||||
("GET", "/service/documents/"): ("owner", "engineer", "technician"),
|
||||
("GET", "/service/documents/admin/permissions"): ("owner",),
|
||||
("POST", "/service/documents/admin/permissions"): ("owner",),
|
||||
("POST", "/service/documents/admin/create"): ("owner",),
|
||||
("GET", "/service/documents/tech-access"): ("engineer",),
|
||||
("POST", "/service/documents/tech-access"): ("engineer",),
|
||||
("GET", "/service/documents/{slug}"): ("owner", "engineer", "technician"),
|
||||
("GET", "/service/documents/{slug}/edit"): ("owner", "engineer"),
|
||||
("POST", "/service/documents/{slug}/edit"): ("owner", "engineer"),
|
||||
("GET", "/service/documents/{slug}/download"): ("owner",),
|
||||
}
|
||||
|
||||
# Routes with path parameters — skipped in strict permission test
|
||||
# but still verified to exist in discover test.
|
||||
DYNAMIC_ROUTES: set[tuple[str, str]] = {
|
||||
("POST", "/service/coefficients/test/{formula_name}"),
|
||||
("GET", "/service/questionnaire/step/{step}"),
|
||||
("POST", "/service/questionnaire/save/{step}"),
|
||||
("GET", "/service/documents/{slug}"),
|
||||
("GET", "/service/documents/{slug}/edit"),
|
||||
("POST", "/service/documents/{slug}/edit"),
|
||||
("GET", "/service/documents/{slug}/download"),
|
||||
}
|
||||
|
||||
# Routes excluded from discover test (internal framework routes)
|
||||
EXCLUDED_ROUTES: set[tuple[str, str]] = {
|
||||
("GET", "/docs"),
|
||||
("GET", "/docs/oauth2-redirect"),
|
||||
("GET", "/openapi.json"),
|
||||
("GET", "/redoc"),
|
||||
}
|
||||
Reference in New Issue
Block a user