diff options
Diffstat (limited to 'tests/unit/auth/test_admin_user_roles.py')
| -rw-r--r-- | tests/unit/auth/test_admin_user_roles.py | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/tests/unit/auth/test_admin_user_roles.py b/tests/unit/auth/test_admin_user_roles.py index c751e20..6c153b5 100644 --- a/tests/unit/auth/test_admin_user_roles.py +++ b/tests/unit/auth/test_admin_user_roles.py @@ -2,7 +2,7 @@ import pytest from gn_auth.auth.db import sqlite3 as db -from gn_auth.auth.authorisation.users.admin.models import grant_sysadmin_role +from gn_auth.auth.authorisation.roles.models import assign_user_role_by_name from tests.unit.auth import conftest from tests.unit.auth.fixtures.resource_fixtures import SYSTEM_RESOURCE @@ -19,10 +19,16 @@ _TARGET_USER = conftest.TEST_USERS[3] def _setup_admin_mock(conn, clients, mocker): - """Grant sysadmin role and mock the token for sys@admin.user.""" + """Grant resource-owner role on SYSTEM_RESOURCE and mock the token. + + resource-owner carries resource:user:assign-role, which is what the + endpoint checks. In production the caller would masquerade as the + resource owner; here we grant the role directly for test setup. + """ admin = conftest.TEST_USERS[4] with db.cursor(conn) as cursor: - grant_sysadmin_role(cursor, admin) + assign_user_role_by_name( + cursor, admin, SYSTEM_RESOURCE.resource_id, "resource-owner") mocker.patch( "gn_auth.auth.authorisation.users.views.require_oauth.acquire", conftest.get_tokeniser( |