49 lines
1.6 KiB
Python
49 lines
1.6 KiB
Python
"""Admin route registration — every endpoint must exist and require login.
|
|
|
|
ADMIN-003. The admin blueprint registers 10 routes. If one is accidentally
|
|
removed or renamed, the admin panel breaks silently. These tests walk the
|
|
URL map to catch that.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
|
|
ADMIN_ROUTES = [
|
|
'/admin',
|
|
'/admin/backup/create',
|
|
'/admin/toggle-tryouts',
|
|
'/admin/season/start',
|
|
'/admin/season/end',
|
|
'/admin/teams/wipe',
|
|
]
|
|
|
|
|
|
def _redirected(response):
|
|
return response.status_code in (301, 302)
|
|
|
|
|
|
class TestAdminRouteRegistration:
|
|
@pytest.mark.parametrize('route', ADMIN_ROUTES)
|
|
def test_route_is_registered(self, app, route):
|
|
"""Every admin endpoint must appear in the URL map."""
|
|
adapter = app.url_map.bind('localhost')
|
|
try:
|
|
adapter.match(route, method='GET')
|
|
except Exception:
|
|
# Some routes are POST-only; try POST
|
|
try:
|
|
adapter.match(route, method='POST')
|
|
except Exception as exc:
|
|
pytest.fail(f'Route {route} is not registered: {exc}')
|
|
|
|
@pytest.mark.parametrize('route', ADMIN_ROUTES)
|
|
def test_route_requires_login(self, client, route):
|
|
"""Unauthenticated access must redirect to login."""
|
|
response = client.get(route, follow_redirects=False)
|
|
# POST-only routes return 405 on GET, which is fine — the point is
|
|
# they don't return 200 to an anonymous caller.
|
|
if response.status_code == 405:
|
|
return
|
|
assert _redirected(response), (
|
|
f'{route} answered {response.status_code} to an anonymous caller'
|
|
) |