test: cover auth deps edge cases for 90% coverage threshold

Author: yan

backend/tests/api/routes/test_authorization.py

@@ -3,11 +3,15 @@
 
 import pytest
 from fastapi.testclient import TestClient
+from sqlmodel import Session
 
+from app import crud
 from app.core.config import settings
+from app.models import UserCreate, UserUpdate
 from tests.utils.user import (
     user_authentication_headers,
 )
+from tests.utils.utils import random_email, random_lower_string
 
 
 def test_manager_can_list_users(
@@ -105,6 +109,61 @@ def test_metrics_admin_and_manager_allowed_member_denied(
     assert member_response.status_code == 403
 
 
+def test_invalid_access_token(client: TestClient) -> None:
+    headers = {"Authorization": "Bearer invalid-token"}
+    response = client.get(f"{settings.API_V1_STR}/users/me", headers=headers)
+    assert response.status_code == 403
+    assert response.json()["detail"] == "Could not validate credentials"
+
+
+def test_inactive_user_cannot_access(client: TestClient, db: Session) -> None:
+    email = random_email()
+    password = random_lower_string()
+    user_in = UserCreate(email=email, password=password, is_active=True)
+    user = crud.create_user(session=db, user_create=user_in)
+    headers = user_authentication_headers(client=client, email=email, password=password)
+
+    user_in_update = UserUpdate(is_active=False)
+    crud.update_user(session=db, db_user=user, user_in=user_in_update)
+
+    response = client.get(f"{settings.API_V1_STR}/users/me", headers=headers)
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Inactive user"
+
+
+def test_token_for_deleted_user_returns_not_found(
+    client: TestClient, db: Session
+) -> None:
+    email = random_email()
+    password = random_lower_string()
+    user_in = UserCreate(email=email, password=password)
+    user = crud.create_user(session=db, user_create=user_in)
+    headers = user_authentication_headers(client=client, email=email, password=password)
+    db.delete(user)
+    db.commit()
+
+    response = client.get(f"{settings.API_V1_STR}/users/me", headers=headers)
+    assert response.status_code == 404
+    assert response.json()["detail"] == "User not found"
+
+
+def test_non_admin_cannot_access_superuser_utils_endpoint(
+    client: TestClient,
+    member_token_headers: dict[str, str],
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    with caplog.at_level(logging.WARNING, logger="app.api.deps"):
+        response = client.post(
+            f"{settings.API_V1_STR}/utils/test-email/?email_to=member@example.com",
+            headers=member_token_headers,
+        )
+
+    assert response.status_code == 403
+    assert response.json()["detail"] == "The user doesn't have enough privileges"
+    assert "Access denied" in caplog.text
+    assert "admin" in caplog.text.lower()
+
+
 def test_member_cannot_update_other_users(
     client: TestClient,
     member_token_headers: dict[str, str],