v1.5.4: test infrastructure + bug fixes + CI/CD + deploy gate

- 6 new test files: route discovery, strict permissions, role switch, CRUD operations, 500 error protection - permission_config.py: central permission definitions for all 110+ routes - Bug fixes: is_active checkbox in users_edit, int(id) 500 crash, missing validation in users_create/users_delete - Pre-commit hooks: lint + static routing tests - GitHub Actions CI: full pytest suite on push - Deploy gate: pytest runs before deploy, aborts on failure - All 3 deploy scripts: --skip-tests flag support
2026-05-22 20:45:27 +03:00
parent 64991f0228
commit bd048ea23d
18 changed files with 1989 additions and 10 deletions
@@ -0,0 +1,92 @@
+"""Detect 500 Internal Server Errors — test POST routes with edge-case inputs.
+
+These tests send malformed or empty data to ensure routes handle errors
+gracefully (redirect or 400/422) instead of crashing with 500.
+"""
+
+import pytest
+
+
+MALFORMED_POST_CASES = [
+    # USERS
+    ("POST", "/service/users/create", {}),
+    ("POST", "/service/users/create", {"login": "no_password"}),
+    ("POST", "/service/users/create", {"password": "no_login"}),
+    ("POST", "/service/users/edit", {}),
+    ("POST", "/service/users/edit", {"id": ""}),
+    ("POST", "/service/users/edit", {"id": "not_a_number"}),
+    ("POST", "/service/users/delete", {}),
+    ("POST", "/service/users/delete", {"id": ""}),
+
+    # CUSTOMERS
+    ("POST", "/service/customers/create", {}),
+    ("POST", "/service/customers/create", {"name": "no_inn"}),
+    ("POST", "/service/customers/create", {"inn": "bad_inn"}),
+    ("POST", "/service/customers/edit", {}),
+    ("POST", "/service/customers/delete", {}),
+
+    # OBJECTS
+    ("POST", "/service/objects/create", {}),
+    ("POST", "/service/objects/edit", {}),
+    ("POST", "/service/objects/delete", {}),
+
+    # ASSIGNMENTS
+    ("POST", "/service/assignments/create", {}),
+    ("POST", "/service/assignments/unassign", {}),
+
+    # SLA
+    ("POST", "/service/sla/create", {}),
+    ("POST", "/service/sla/edit", {}),
+
+    # CEO
+    ("POST", "/service/ceo/calc", {}),
+    ("POST", "/service/ceo/kpi", {}),
+
+    # COEFFICIENTS
+    ("POST", "/service/coefficients/edit", {}),
+    ("POST", "/service/coefficients/toggle", {}),
+    ("POST", "/service/coefficients/create", {}),
+    ("POST", "/service/coefficients/delete", {}),
+
+    # TASKS
+    ("POST", "/service/tasks/create", {}),
+    ("POST", "/service/tasks/close", {}),
+
+    # REPORTS
+    ("POST", "/service/reports/create", {}),
+
+    # INCIDENTS
+    ("POST", "/service/incidents/create", {}),
+    ("POST", "/service/incidents/resolve", {}),
+
+    # BLOG
+    ("POST", "/service/blog/create", {}),
+    ("POST", "/service/blog/edit", {}),
+    ("POST", "/service/blog/delete", {}),
+
+    # IDEAS
+    ("POST", "/service/ideas/create", {}),
+    ("POST", "/service/ideas/edit", {}),
+    ("POST", "/service/ideas/status", {}),
+    ("POST", "/service/ideas/delete", {}),
+
+    # CASES
+    ("POST", "/service/cases/create", {}),
+    ("POST", "/service/cases/edit", {}),
+    ("POST", "/service/cases/delete", {}),
+
+    # QUESTIONNAIRE CONFIG
+    ("POST", "/service/questionnaire-config/create", {}),
+    ("POST", "/service/questionnaire-config/edit", {}),
+    ("POST", "/service/questionnaire-config/toggle", {}),
+    ("POST", "/service/questionnaire-config/delete", {}),
+]
+
+
+@pytest.mark.parametrize("method,path,data", MALFORMED_POST_CASES)
+def test_no_500_on_malformed_input(owner_client, method, path, data):
+    """Malformed input should NOT cause a 500."""
+    resp = owner_client.request(method, path, data=data)
+    assert resp.status_code != 500, (
+        f"{method} {path} with {data}: got 500 Internal Server Error"
+    )