774 lines
28 KiB
Python
774 lines
28 KiB
Python
|
"""
|
|||
|
|
Extended tests for admin-facing members and booking endpoints.
|
|||
|
|
|
|||
|
|
Covers endpoints not exercised in test_members.py:
|
|||
|
|
- GET /settings/features – fetch global member feature flags
|
|||
|
|
- PUT /settings/features – update global member feature flags
|
|||
|
|
- GET /admin/members/{member_id} – fetch a single member record
|
|||
|
|
- GET /admin/members/{member_id}/walks – admin view of a member's walks
|
|||
|
|
- GET /admin/members/{member_id}/bookings – admin view of a member's bookings
|
|||
|
|
- GET /admin/bookings – list all bookings across members
|
|||
|
|
- POST /admin/bookings – create a booking on behalf of a member
|
|||
|
|
- PUT /admin/bookings/{booking_id} – update booking status / notes
|
|||
|
|
- GET /admin/messages – message history with read status
|
|||
|
|
- GET /admin/notifications – actionable admin notification feed
|
|||
|
|
- GET /admin/notifications/settings – fetch notification config
|
|||
|
|
- PUT /admin/notifications/settings – update notification config
|
|||
|
|
- POST /admin/notifications/run – manually trigger notification run
|
|||
|
|
"""
|
|||
|
|
import pytest
|
|||
|
|
from datetime import datetime, timezone
|
|||
|
|
from httpx import AsyncClient
|
|||
|
|
from sqlalchemy import select
|
|||
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|||
|
|
|
|||
|
|
from app.models.audit import AuditLog
|
|||
|
|
from app.models.contact_lead import ContactLead
|
|||
|
|
from app.models.member import Member, Walk, Booking, AdminMessage
|
|||
|
|
from app.models.settings import SiteSettings
|
|||
|
|
from app.auth.password import hash_password
|
|||
|
|
|
|||
|
|
pytestmark = [pytest.mark.asyncio, pytest.mark.members_admin]
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── Helpers ────────────────────────────────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def _member(
|
|||
|
|
db: AsyncSession,
|
|||
|
|
email: str = "m@example.com",
|
|||
|
|
claimed: bool = True,
|
|||
|
|
status: str = "active",
|
|||
|
|
) -> Member:
|
|||
|
|
m = Member(
|
|||
|
|
email=email,
|
|||
|
|
first_name="Jane",
|
|||
|
|
last_name="Doe",
|
|||
|
|
phone="021 000 0000",
|
|||
|
|
is_claimed=claimed,
|
|||
|
|
is_active=True,
|
|||
|
|
member_status=status,
|
|||
|
|
hashed_password=hash_password("Password1!") if claimed else None,
|
|||
|
|
onboarding_data={"dog_name": "Rex"},
|
|||
|
|
)
|
|||
|
|
db.add(m)
|
|||
|
|
await db.commit()
|
|||
|
|
await db.refresh(m)
|
|||
|
|
return m
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def _walk(db: AsyncSession, member_id) -> Walk:
|
|||
|
|
w = Walk(
|
|||
|
|
member_id=member_id,
|
|||
|
|
walked_at=datetime(2026, 3, 15, 9, 0, tzinfo=timezone.utc),
|
|||
|
|
service_type="pack_walk",
|
|||
|
|
duration_minutes=60,
|
|||
|
|
notes="Test walk",
|
|||
|
|
recorded_by="admin@example.com",
|
|||
|
|
)
|
|||
|
|
db.add(w)
|
|||
|
|
await db.commit()
|
|||
|
|
await db.refresh(w)
|
|||
|
|
return w
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def _booking(db: AsyncSession, member_id) -> Booking:
|
|||
|
|
b = Booking(
|
|||
|
|
member_id=member_id,
|
|||
|
|
service_type="pack_walk",
|
|||
|
|
status="pending",
|
|||
|
|
notes="Morning preferred",
|
|||
|
|
)
|
|||
|
|
db.add(b)
|
|||
|
|
await db.commit()
|
|||
|
|
await db.refresh(b)
|
|||
|
|
return b
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def _lead(db: AsyncSession, email: str = "lead@example.com") -> ContactLead:
|
|||
|
|
lead = ContactLead(
|
|||
|
|
full_name="Alex Prospect",
|
|||
|
|
email=email,
|
|||
|
|
phone="021 222 2222",
|
|||
|
|
suburb="Devonport",
|
|||
|
|
pet_name="Milo",
|
|||
|
|
status="invite",
|
|||
|
|
)
|
|||
|
|
db.add(lead)
|
|||
|
|
await db.commit()
|
|||
|
|
await db.refresh(lead)
|
|||
|
|
return lead
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── GET /admin/members/{member_id} ─────────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_get_member(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "getme@example.com")
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{member.id}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert data["id"] == str(member.id)
|
|||
|
|
assert data["email"] == "getme@example.com"
|
|||
|
|
assert data["first_name"] == "Jane"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_not_found(client: AsyncClient, admin_token: str):
|
|||
|
|
import uuid
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{uuid.uuid4()}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 404
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_requires_auth(client: AsyncClient, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "noauth@example.com")
|
|||
|
|
resp = await client.get(f"/api/v1/admin/members/{member.id}")
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── GET /admin/members/{member_id}/walks ───────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_walks_empty(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "nowalks@example.com")
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/walks",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json() == []
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_walks_with_data(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "haswalks@example.com")
|
|||
|
|
await _walk(db_session, member.id)
|
|||
|
|
await _walk(db_session, member.id)
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/walks",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert len(resp.json()) == 2
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_walks_only_own(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
"""Walks returned belong only to the requested member, not all members."""
|
|||
|
|
m1 = await _member(db_session, "walker1@example.com")
|
|||
|
|
m2 = await _member(db_session, "walker2@example.com")
|
|||
|
|
await _walk(db_session, m1.id)
|
|||
|
|
await _walk(db_session, m2.id)
|
|||
|
|
await _walk(db_session, m2.id)
|
|||
|
|
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{m1.id}/walks",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert len(resp.json()) == 1
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── GET /admin/members/{member_id}/bookings ────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_bookings_empty(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "nobookings@example.com")
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json() == []
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_bookings_with_data(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "hasbookings@example.com")
|
|||
|
|
await _booking(db_session, member.id)
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert len(data) == 1
|
|||
|
|
assert data[0]["service_type"] == "pack_walk"
|
|||
|
|
assert data[0]["status"] == "pending"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_member_bookings_only_own(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
"""Bookings returned belong only to the requested member."""
|
|||
|
|
m1 = await _member(db_session, "bk1@example.com")
|
|||
|
|
m2 = await _member(db_session, "bk2@example.com")
|
|||
|
|
await _booking(db_session, m1.id)
|
|||
|
|
await _booking(db_session, m2.id)
|
|||
|
|
|
|||
|
|
resp = await client.get(
|
|||
|
|
f"/api/v1/admin/members/{m2.id}/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert len(resp.json()) == 1
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── GET /admin/bookings ────────────────────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_list_bookings_empty(client: AsyncClient, admin_token: str):
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json() == []
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_list_bookings_includes_member_details(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
"""Each booking in the admin list includes the member's name and email."""
|
|||
|
|
member = await _member(db_session, "listbooking@example.com")
|
|||
|
|
await _booking(db_session, member.id)
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert len(data) == 1
|
|||
|
|
assert data[0]["member_email"] == "listbooking@example.com"
|
|||
|
|
assert data[0]["member_first_name"] == "Jane"
|
|||
|
|
assert data[0]["member_last_name"] == "Doe"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_list_bookings_multiple_members(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
m1 = await _member(db_session, "mb1@example.com")
|
|||
|
|
m2 = await _member(db_session, "mb2@example.com")
|
|||
|
|
await _booking(db_session, m1.id)
|
|||
|
|
await _booking(db_session, m2.id)
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert len(resp.json()) == 2
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_list_bookings_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.get("/api/v1/admin/bookings")
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_bookings_feature_can_be_disabled(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
member = await _member(db_session, "disabledbookings@example.com")
|
|||
|
|
await _booking(db_session, member.id)
|
|||
|
|
db_session.add(SiteSettings(site_name="", bookings_enabled=False))
|
|||
|
|
await db_session.commit()
|
|||
|
|
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 404
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── PUT /admin/bookings/{booking_id} ──────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_create_booking(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
member = await _member(db_session, "createbooking@example.com")
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={
|
|||
|
|
"member_id": str(member.id),
|
|||
|
|
"service_type": "1_1_walk",
|
|||
|
|
"requested_date": "2026-04-09T07:00:00Z",
|
|||
|
|
"status": "confirmed",
|
|||
|
|
"admin_notes": "Created from mobile planner",
|
|||
|
|
},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code == 201
|
|||
|
|
data = resp.json()
|
|||
|
|
assert data["member_id"] == str(member.id)
|
|||
|
|
assert data["service_type"] == "1_1_walk"
|
|||
|
|
assert data["status"] == "confirmed"
|
|||
|
|
assert data["member_email"] == "createbooking@example.com"
|
|||
|
|
assert data["member_dog_name"] == "Rex"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_create_booking_requires_auth(client: AsyncClient, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "createbooking-noauth@example.com")
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
json={
|
|||
|
|
"member_id": str(member.id),
|
|||
|
|
"service_type": "pack_walk",
|
|||
|
|
},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_create_booking_feature_can_be_disabled(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
member = await _member(db_session, "createbooking-disabled@example.com")
|
|||
|
|
db_session.add(SiteSettings(site_name="", bookings_enabled=False))
|
|||
|
|
await db_session.commit()
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
"/api/v1/admin/bookings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={
|
|||
|
|
"member_id": str(member.id),
|
|||
|
|
"service_type": "pack_walk",
|
|||
|
|
},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code == 404
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── PUT /admin/bookings/{booking_id} ──────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_update_booking_status(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
member = await _member(db_session, "updatebooking@example.com")
|
|||
|
|
booking = await _booking(db_session, member.id)
|
|||
|
|
|
|||
|
|
resp = await client.put(
|
|||
|
|
f"/api/v1/admin/bookings/{booking.id}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"status": "confirmed"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert data["status"] == "confirmed"
|
|||
|
|
assert data["id"] == str(booking.id)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_update_booking_admin_notes(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
member = await _member(db_session, "booknotes@example.com")
|
|||
|
|
booking = await _booking(db_session, member.id)
|
|||
|
|
|
|||
|
|
resp = await client.put(
|
|||
|
|
f"/api/v1/admin/bookings/{booking.id}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"admin_notes": "Revised to afternoon slot"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json()["admin_notes"] == "Revised to afternoon slot"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_update_booking_requested_date(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
member = await _member(db_session, "bookmove@example.com")
|
|||
|
|
booking = await _booking(db_session, member.id)
|
|||
|
|
moved_to = "2026-04-09T13:00:00Z"
|
|||
|
|
|
|||
|
|
resp = await client.put(
|
|||
|
|
f"/api/v1/admin/bookings/{booking.id}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"requested_date": moved_to, "admin_notes": "Moved to PM route"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert data["requested_date"] == moved_to
|
|||
|
|
assert data["admin_notes"] == "Moved to PM route"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_update_booking_not_found(client: AsyncClient, admin_token: str):
|
|||
|
|
import uuid
|
|||
|
|
resp = await client.put(
|
|||
|
|
f"/api/v1/admin/bookings/{uuid.uuid4()}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"status": "confirmed"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 404
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_update_booking_includes_member_details(
|
|||
|
|
client: AsyncClient, admin_token: str, db_session: AsyncSession
|
|||
|
|
):
|
|||
|
|
"""Response includes member name and email even after update."""
|
|||
|
|
member = await _member(db_session, "updatebk2@example.com")
|
|||
|
|
booking = await _booking(db_session, member.id)
|
|||
|
|
|
|||
|
|
resp = await client.put(
|
|||
|
|
f"/api/v1/admin/bookings/{booking.id}",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"status": "cancelled"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert data["member_email"] == "updatebk2@example.com"
|
|||
|
|
assert data["status"] == "cancelled"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_can_archive_member(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "archive-me@example.com")
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/archive",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert data["member_status"] == "archived"
|
|||
|
|
assert data["is_active"] is False
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_can_deactivate_member(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "deactivate-me@example.com")
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/deactivate",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json()["is_active"] is False
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_can_toggle_member_force_two_factor(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "force-toggle@example.com")
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/force-2fa",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"enabled": True},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json()["force_two_factor"] is True
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_can_reset_member_password(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "reset-password@example.com")
|
|||
|
|
|
|||
|
|
resp = await client.post(
|
|||
|
|
f"/api/v1/admin/members/{member.id}/reset-password",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json()["is_claimed"] is False
|
|||
|
|
|
|||
|
|
await db_session.refresh(member)
|
|||
|
|
assert member.hashed_password is None
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── GET /admin/notifications/settings ─────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_list_messages_history(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "history@example.com")
|
|||
|
|
message = AdminMessage(
|
|||
|
|
member_id=member.id,
|
|||
|
|
subject="Walk update",
|
|||
|
|
body="Tomorrow's slot is confirmed.",
|
|||
|
|
sent_by="admin@example.com",
|
|||
|
|
read_at=datetime(2026, 4, 1, 9, 30, tzinfo=timezone.utc),
|
|||
|
|
)
|
|||
|
|
db_session.add(message)
|
|||
|
|
await db_session.commit()
|
|||
|
|
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/messages",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert len(data) == 1
|
|||
|
|
assert data[0]["member_email"] == "history@example.com"
|
|||
|
|
assert data[0]["subject"] == "Walk update"
|
|||
|
|
assert data[0]["read_at"] is not None
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_list_messages_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.get("/api/v1/admin/messages")
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_list_notifications(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "notify@example.com", status="pending_review")
|
|||
|
|
booking = await _booking(db_session, member.id)
|
|||
|
|
lead = await _lead(db_session, "notifylead@example.com")
|
|||
|
|
db_session.add_all(
|
|||
|
|
[
|
|||
|
|
AuditLog(
|
|||
|
|
member_id=member.id,
|
|||
|
|
member_email=member.email,
|
|||
|
|
action_type="login",
|
|||
|
|
area="members/login",
|
|||
|
|
description="Member logged in successfully.",
|
|||
|
|
status="success",
|
|||
|
|
timestamp=datetime.now(timezone.utc),
|
|||
|
|
),
|
|||
|
|
AuditLog(
|
|||
|
|
member_id=member.id,
|
|||
|
|
member_email=member.email,
|
|||
|
|
action_type="logout",
|
|||
|
|
area="members/logout",
|
|||
|
|
description="Member ended their session.",
|
|||
|
|
status="success",
|
|||
|
|
timestamp=datetime.now(timezone.utc),
|
|||
|
|
),
|
|||
|
|
]
|
|||
|
|
)
|
|||
|
|
await db_session.commit()
|
|||
|
|
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/notifications",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert "items" in data
|
|||
|
|
assert "settings" in data
|
|||
|
|
assert data["total"] >= 3
|
|||
|
|
item_types = {item["type"] for item in data["items"]}
|
|||
|
|
assert "pending_booking" in item_types
|
|||
|
|
assert "new_lead" in item_types
|
|||
|
|
assert "pending_review" in item_types
|
|||
|
|
assert "member_login" in item_types
|
|||
|
|
assert "member_logout" in item_types
|
|||
|
|
hrefs = {item["id"]: item["href"] for item in data["items"]}
|
|||
|
|
assert hrefs[str(booking.id)] == "/admin/bookings"
|
|||
|
|
assert hrefs[str(lead.id)] == "/admin/leads"
|
|||
|
|
assert hrefs[str(member.id)] == f"/admin/members/{member.id}"
|
|||
|
|
session_hrefs = {item["type"]: item["href"] for item in data["items"] if item["type"] in {"member_login", "member_logout"}}
|
|||
|
|
assert session_hrefs["member_login"] == f"/admin/members/{member.id}"
|
|||
|
|
assert session_hrefs["member_logout"] == f"/admin/members/{member.id}"
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_list_notifications_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.get("/api/v1/admin/notifications")
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
async def test_admin_get_notification_settings(client: AsyncClient, admin_token: str):
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/notifications/settings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert "automatic_member_notifications_enabled" in data
|
|||
|
|
assert "nz_public_holiday_notifications_enabled" in data
|
|||
|
|
assert "invoice_reminder_notifications_enabled" in data
|
|||
|
|
assert "invoice_day_of_week" in data
|
|||
|
|
assert isinstance(data["invoice_day_of_week"], int)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_get_notification_settings_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.get("/api/v1/admin/notifications/settings")
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── GET /settings/features ────────────────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_get_feature_settings_defaults(client: AsyncClient):
|
|||
|
|
resp = await client.get("/api/v1/settings/features")
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json() == {
|
|||
|
|
"bookings_enabled": True,
|
|||
|
|
"walks_enabled": True,
|
|||
|
|
"messages_enabled": True,
|
|||
|
|
"two_factor_enabled": True,
|
|||
|
|
"audit_history_enabled": True,
|
|||
|
|
"experiments_enabled": True,
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── PUT /settings/features ────────────────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_update_feature_settings(client: AsyncClient, admin_token: str):
|
|||
|
|
resp = await client.put(
|
|||
|
|
"/api/v1/settings/features",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={
|
|||
|
|
"bookings_enabled": False,
|
|||
|
|
"walks_enabled": True,
|
|||
|
|
"messages_enabled": False,
|
|||
|
|
"two_factor_enabled": False,
|
|||
|
|
"audit_history_enabled": False,
|
|||
|
|
"experiments_enabled": False,
|
|||
|
|
},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json() == {
|
|||
|
|
"bookings_enabled": False,
|
|||
|
|
"walks_enabled": True,
|
|||
|
|
"messages_enabled": False,
|
|||
|
|
"two_factor_enabled": False,
|
|||
|
|
"audit_history_enabled": False,
|
|||
|
|
"experiments_enabled": False,
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_update_feature_settings_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.put(
|
|||
|
|
"/api/v1/settings/features",
|
|||
|
|
json={"bookings_enabled": False},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_get_service_pricing_defaults(client: AsyncClient):
|
|||
|
|
resp = await client.get("/api/v1/settings/pricing")
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()["service_pricing"]
|
|||
|
|
assert data["pack_walk"]["amount"] == 58.0
|
|||
|
|
assert data["1_1_walk"]["amount"] == 45.0
|
|||
|
|
assert data["puppy_visit"]["amount"] == 39.0
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_update_service_pricing(client: AsyncClient, admin_token: str):
|
|||
|
|
resp = await client.put(
|
|||
|
|
"/api/v1/settings/pricing",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={
|
|||
|
|
"service_pricing": {
|
|||
|
|
"pack_walk": {"amount": 61, "label": "Pack Walk", "unit": "per walk"},
|
|||
|
|
"1_1_walk": {"amount": 52, "label": "1-1 Walk", "unit": "per walk"},
|
|||
|
|
"puppy_visit": {"amount": 44, "label": "Puppy Visit", "unit": "per visit"},
|
|||
|
|
}
|
|||
|
|
},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()["service_pricing"]
|
|||
|
|
assert data["pack_walk"]["amount"] == 61.0
|
|||
|
|
assert data["1_1_walk"]["amount"] == 52.0
|
|||
|
|
assert data["puppy_visit"]["amount"] == 44.0
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_update_service_pricing_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.put(
|
|||
|
|
"/api/v1/settings/pricing",
|
|||
|
|
json={"service_pricing": {"pack_walk": {"amount": 62}}},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_audit_history_returns_404_when_disabled(
|
|||
|
|
client: AsyncClient,
|
|||
|
|
admin_token: str,
|
|||
|
|
db_session: AsyncSession,
|
|||
|
|
):
|
|||
|
|
db_session.add(SiteSettings(site_name="", audit_history_enabled=False))
|
|||
|
|
await db_session.commit()
|
|||
|
|
|
|||
|
|
resp = await client.get(
|
|||
|
|
"/api/v1/admin/audit",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 404
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── PUT /admin/notifications/settings ─────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_update_notification_settings_toggle(client: AsyncClient, admin_token: str):
|
|||
|
|
# Read current state
|
|||
|
|
get_resp = await client.get(
|
|||
|
|
"/api/v1/admin/notifications/settings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
current = get_resp.json()["automatic_member_notifications_enabled"]
|
|||
|
|
|
|||
|
|
# Flip the flag
|
|||
|
|
put_resp = await client.put(
|
|||
|
|
"/api/v1/admin/notifications/settings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"automatic_member_notifications_enabled": not current},
|
|||
|
|
)
|
|||
|
|
assert put_resp.status_code == 200
|
|||
|
|
assert put_resp.json()["automatic_member_notifications_enabled"] is not current
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_update_invoice_day_of_week(client: AsyncClient, admin_token: str):
|
|||
|
|
resp = await client.put(
|
|||
|
|
"/api/v1/admin/notifications/settings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"invoice_day_of_week": 4}, # Friday
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
assert resp.json()["invoice_day_of_week"] == 4
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_update_invoice_day_invalid(client: AsyncClient, admin_token: str):
|
|||
|
|
"""Day of week must be 0–6; out-of-range values are rejected."""
|
|||
|
|
resp = await client.put(
|
|||
|
|
"/api/v1/admin/notifications/settings",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
json={"invoice_day_of_week": 7},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 422
|
|||
|
|
|
|||
|
|
|
|||
|
|
# ── POST /admin/notifications/run ─────────────────────────────────────────────
|
|||
|
|
|
|||
|
|
async def test_admin_run_notifications(client: AsyncClient, admin_token: str):
|
|||
|
|
resp = await client.post(
|
|||
|
|
"/api/v1/admin/notifications/run",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert resp.status_code == 200
|
|||
|
|
data = resp.json()
|
|||
|
|
assert "automatic_member_notifications_enabled" in data
|
|||
|
|
assert "public_holiday_messages_sent" in data
|
|||
|
|
assert "invoice_reminders_sent" in data
|
|||
|
|
assert isinstance(data["public_holiday_messages_sent"], int)
|
|||
|
|
assert isinstance(data["invoice_reminders_sent"], int)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_run_notifications_requires_auth(client: AsyncClient):
|
|||
|
|
resp = await client.post("/api/v1/admin/notifications/run")
|
|||
|
|
assert resp.status_code in (401, 403)
|
|||
|
|
|
|||
|
|
|
|||
|
|
async def test_admin_can_clear_notifications(client: AsyncClient, admin_token: str, db_session: AsyncSession):
|
|||
|
|
member = await _member(db_session, "clearable@example.com", status="pending_review")
|
|||
|
|
await _booking(db_session, member.id)
|
|||
|
|
db_session.add(
|
|||
|
|
AuditLog(
|
|||
|
|
member_id=member.id,
|
|||
|
|
member_email=member.email,
|
|||
|
|
action_type="login",
|
|||
|
|
area="members/login",
|
|||
|
|
description="Member logged in successfully.",
|
|||
|
|
status="success",
|
|||
|
|
timestamp=datetime.now(timezone.utc),
|
|||
|
|
)
|
|||
|
|
)
|
|||
|
|
await db_session.commit()
|
|||
|
|
|
|||
|
|
clear_resp = await client.post(
|
|||
|
|
"/api/v1/admin/notifications/clear",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert clear_resp.status_code == 200
|
|||
|
|
cleared = clear_resp.json()
|
|||
|
|
assert cleared["items"] == []
|
|||
|
|
assert cleared["total"] == 0
|
|||
|
|
|
|||
|
|
settings_row = (await db_session.execute(select(SiteSettings))).scalars().first()
|
|||
|
|
assert settings_row is not None
|
|||
|
|
assert settings_row.admin_notifications_cleared_before is not None
|
|||
|
|
|
|||
|
|
feed_resp = await client.get(
|
|||
|
|
"/api/v1/admin/notifications",
|
|||
|
|
headers={"Authorization": f"Bearer {admin_token}"},
|
|||
|
|
)
|
|||
|
|
assert feed_resp.status_code == 200
|
|||
|
|
assert feed_resp.json()["items"] == []
|