test: baseline test suite — 86 tests covering auth, CRUD, settings, chat, terraform, reports, terminal

backend/tests/test_settings.py

@@ -0,0 +1,168 @@
+"""Tests for settings, prompts, audit log, and config endpoints."""
+import pytest
+
+
+@pytest.mark.anyio
+async def test_get_setting(client, admin_headers):
+    r = await client.get("/api/settings/auth_mode", headers=admin_headers)
+    assert r.status_code == 200
+    body = r.json()
+    assert "key" in body
+    assert "value" in body
+
+
+@pytest.mark.anyio
+async def test_put_setting(client, admin_headers):
+    r = await client.put(
+        "/api/settings/test_key",
+        json={"value": "test_value"},
+        headers=admin_headers,
+    )
+    assert r.status_code == 200
+
+
+@pytest.mark.anyio
+async def test_put_setting_non_admin(client, user_headers):
+    r = await client.put(
+        "/api/settings/test_key",
+        json={"value": "hack"},
+        headers=user_headers,
+    )
+    assert r.status_code == 403
+
+
+@pytest.mark.anyio
+async def test_sensitive_setting_blocked(client, user_headers):
+    r = await client.get("/api/settings/oidc_client_secret", headers=user_headers)
+    assert r.status_code == 403
+
+
+@pytest.mark.anyio
+async def test_sensitive_setting_admin(client, admin_headers):
+    r = await client.get("/api/settings/oidc_client_secret", headers=admin_headers)
+    assert r.status_code == 200
+
+
+@pytest.mark.anyio
+async def test_timezone_options(client, admin_headers):
+    r = await client.get("/api/settings/timezone/options", headers=admin_headers)
+    assert r.status_code == 200
+    body = r.json()
+    assert "timezones" in body
+    assert isinstance(body["timezones"], list)
+
+
+@pytest.mark.anyio
+async def test_get_system_prompts(client, admin_headers):
+    r = await client.get("/api/prompts/chat", headers=admin_headers)
+    assert r.status_code == 200
+    assert isinstance(r.json(), list)
+
+
+@pytest.mark.anyio
+async def test_create_system_prompt(client, admin_headers):
+    r = await client.post(
+        "/api/prompts",
+        json={
+            "agent": "chat",
+            "name": "test",
+            "content": "You are a test",
+            "is_active": False,
+        },
+        headers=admin_headers,
+    )
+    assert r.status_code == 200
+
+
+@pytest.mark.anyio
+async def test_update_system_prompt(client, admin_headers):
+    # Create a prompt first
+    r = await client.post(
+        "/api/prompts",
+        json={
+            "agent": "chat",
+            "name": "to_update",
+            "content": "original",
+            "is_active": False,
+        },
+        headers=admin_headers,
+    )
+    assert r.status_code == 200
+    pid = r.json().get("id")
+    assert pid is not None
+
+    r2 = await client.put(
+        f"/api/prompts/{pid}",
+        json={"content": "updated"},
+        headers=admin_headers,
+    )
+    assert r2.status_code == 200
+
+
+@pytest.mark.anyio
+async def test_delete_system_prompt(client, admin_headers):
+    # Create a prompt to delete
+    r = await client.post(
+        "/api/prompts",
+        json={
+            "agent": "chat",
+            "name": "to_delete",
+            "content": "temp",
+            "is_active": False,
+        },
+        headers=admin_headers,
+    )
+    assert r.status_code == 200
+    pid = r.json().get("id")
+    assert pid is not None
+
+    r2 = await client.delete(f"/api/prompts/{pid}", headers=admin_headers)
+    assert r2.status_code == 200
+
+
+@pytest.mark.anyio
+async def test_create_prompt_non_admin(client, user_headers):
+    r = await client.post(
+        "/api/prompts",
+        json={
+            "agent": "chat",
+            "name": "hacked",
+            "content": "nope",
+            "is_active": False,
+        },
+        headers=user_headers,
+    )
+    assert r.status_code == 403
+
+
+@pytest.mark.anyio
+async def test_audit_log(client, admin_headers):
+    r = await client.get("/api/audit-log", headers=admin_headers)
+    assert r.status_code == 200
+    assert isinstance(r.json(), list)
+
+
+@pytest.mark.anyio
+async def test_audit_log_user_sees_own(client, user_headers):
+    r = await client.get("/api/audit-log", headers=user_headers)
+    assert r.status_code == 200
+
+
+@pytest.mark.anyio
+async def test_config_logs(client, admin_headers):
+    r = await client.get("/api/config-logs", headers=admin_headers)
+    assert r.status_code == 200
+    assert isinstance(r.json(), list)
+
+
+@pytest.mark.anyio
+async def test_config_export(client, admin_headers):
+    r = await client.get("/api/config/export", headers=admin_headers)
+    assert r.status_code == 200
+    assert isinstance(r.json(), dict)
+
+
+@pytest.mark.anyio
+async def test_config_export_non_admin(client, user_headers):
+    r = await client.get("/api/config/export", headers=user_headers)
+    assert r.status_code == 403