start

backend/tests/conftest.py

@@ -0,0 +1,52 @@
+import uuid
+from collections.abc import AsyncIterator
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.security import hash_password
+from app.db.session import async_session_maker, engine
+from app.main import app
+from app.models.user import User
+
+
+@pytest.fixture(autouse=True)
+async def _dispose_engine_after_test() -> AsyncIterator[None]:
+    # Each test runs in its own event loop; pooled asyncpg connections from a
+    # previous test's loop are unusable in the next one, so drop the pool.
+    yield
+    await engine.dispose()
+
+
+@pytest.fixture
+async def db() -> AsyncIterator[AsyncSession]:
+    async with async_session_maker() as session:
+        yield session
+
+
+@pytest.fixture
+async def client() -> AsyncIterator[AsyncClient]:
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as ac:
+        yield ac
+
+
+@pytest.fixture
+async def admin_user(db: AsyncSession) -> AsyncIterator[User]:
+    user = User(username=f"admin-{uuid.uuid4().hex[:8]}", hashed_password=hash_password("adminpass123"))
+    db.add(user)
+    await db.commit()
+    await db.refresh(user)
+    yield user
+    await db.delete(user)
+    await db.commit()
+
+
+@pytest.fixture
+async def auth_headers(client: AsyncClient, admin_user: User) -> dict[str, str]:
+    res = await client.post(
+        "/api/v1/auth/token", data={"username": admin_user.username, "password": "adminpass123"}
+    )
+    token = res.json()["access_token"]
+    return {"Authorization": f"Bearer {token}"}

backend/tests/test_auth.py

@@ -0,0 +1,23 @@
+from httpx import AsyncClient
+
+from app.models.user import User
+
+
+async def test_login_success(client: AsyncClient, admin_user: User) -> None:
+    res = await client.post(
+        "/api/v1/auth/token", data={"username": admin_user.username, "password": "adminpass123"}
+    )
+    assert res.status_code == 200
+    assert res.json()["token_type"] == "bearer"
+
+
+async def test_login_wrong_password(client: AsyncClient, admin_user: User) -> None:
+    res = await client.post(
+        "/api/v1/auth/token", data={"username": admin_user.username, "password": "wrong"}
+    )
+    assert res.status_code == 401
+
+
+async def test_mutation_requires_auth(client: AsyncClient) -> None:
+    res = await client.post("/api/v1/objects", json={"inventory_number": "X", "name": "X"})
+    assert res.status_code == 401

backend/tests/test_boxes.py

@@ -0,0 +1,49 @@
+from httpx import AsyncClient
+
+
+async def test_nested_box_restrict_delete_and_cycle_prevention(
+    client: AsyncClient, auth_headers: dict[str, str]
+) -> None:
+    parent_res = await client.post("/api/v1/boxes", headers=auth_headers, json={"name": "Parent"})
+    parent_id = parent_res.json()["id"]
+
+    child_res = await client.post(
+        "/api/v1/boxes", headers=auth_headers, json={"name": "Child", "parent_box_id": parent_id}
+    )
+    child_id = child_res.json()["id"]
+
+    # Cannot delete a box that still has children.
+    delete_res = await client.delete(f"/api/v1/boxes/{parent_id}", headers=auth_headers)
+    assert delete_res.status_code == 409
+
+    # Cannot move a box into its own descendant.
+    cycle_res = await client.put(
+        f"/api/v1/boxes/{parent_id}", headers=auth_headers, json={"parent_box_id": child_id}
+    )
+    assert cycle_res.status_code == 409
+
+    box_detail = await client.get(f"/api/v1/boxes/{child_id}")
+    assert box_detail.json()["ancestors"] == [{"id": parent_id, "name": "Parent"}]
+
+    await client.delete(f"/api/v1/boxes/{child_id}", headers=auth_headers)
+    await client.delete(f"/api/v1/boxes/{parent_id}", headers=auth_headers)
+
+
+async def test_deleting_box_unassigns_objects(client: AsyncClient, auth_headers: dict[str, str]) -> None:
+    box_res = await client.post("/api/v1/boxes", headers=auth_headers, json={"name": "Temp box"})
+    box_id = box_res.json()["id"]
+
+    obj_res = await client.post(
+        "/api/v1/objects",
+        headers=auth_headers,
+        json={"inventory_number": "BOX-TEST-1", "name": "In a box", "box_id": box_id},
+    )
+    object_id = obj_res.json()["id"]
+    assert obj_res.json()["box_id"] == box_id
+
+    await client.delete(f"/api/v1/boxes/{box_id}", headers=auth_headers)
+
+    obj_after = await client.get(f"/api/v1/objects/{object_id}")
+    assert obj_after.json()["box_id"] is None
+
+    await client.delete(f"/api/v1/objects/{object_id}", headers=auth_headers)

backend/tests/test_objects.py

@@ -0,0 +1,62 @@
+import uuid
+
+from httpx import AsyncClient
+
+
+async def test_create_read_update_delete_object(client: AsyncClient, auth_headers: dict[str, str]) -> None:
+    inventory_number = f"TEST-{uuid.uuid4().hex[:8]}"
+
+    create_res = await client.post(
+        "/api/v1/objects",
+        headers=auth_headers,
+        json={"inventory_number": inventory_number, "name": "Test drill", "description": "for tests"},
+    )
+    assert create_res.status_code == 201
+    object_id = create_res.json()["id"]
+
+    public_res = await client.get(f"/api/v1/objects/{object_id}")
+    assert public_res.status_code == 200
+    assert public_res.json()["inventory_number"] == inventory_number
+    assert public_res.json()["photos"] == []
+
+    update_res = await client.put(
+        f"/api/v1/objects/{object_id}", headers=auth_headers, json={"name": "Renamed drill"}
+    )
+    assert update_res.status_code == 200
+    assert update_res.json()["name"] == "Renamed drill"
+
+    delete_res = await client.delete(f"/api/v1/objects/{object_id}", headers=auth_headers)
+    assert delete_res.status_code == 204
+
+    missing_res = await client.get(f"/api/v1/objects/{object_id}")
+    assert missing_res.status_code == 404
+
+
+async def test_duplicate_inventory_number_conflicts(client: AsyncClient, auth_headers: dict[str, str]) -> None:
+    inventory_number = f"TEST-{uuid.uuid4().hex[:8]}"
+    payload = {"inventory_number": inventory_number, "name": "First"}
+
+    first = await client.post("/api/v1/objects", headers=auth_headers, json=payload)
+    assert first.status_code == 201
+
+    dup = await client.post(
+        "/api/v1/objects", headers=auth_headers, json={**payload, "name": "Second"}
+    )
+    assert dup.status_code == 409
+
+    await client.delete(f"/api/v1/objects/{first.json()['id']}", headers=auth_headers)
+
+
+async def test_object_qrcode(client: AsyncClient, auth_headers: dict[str, str]) -> None:
+    inventory_number = f"TEST-{uuid.uuid4().hex[:8]}"
+    create_res = await client.post(
+        "/api/v1/objects", headers=auth_headers, json={"inventory_number": inventory_number, "name": "QR test"}
+    )
+    object_id = create_res.json()["id"]
+
+    qr_res = await client.get(f"/api/v1/objects/{object_id}/qrcode.png")
+    assert qr_res.status_code == 200
+    assert qr_res.headers["content-type"] == "image/png"
+    assert qr_res.content[:8] == b"\x89PNG\r\n\x1a\n"
+
+    await client.delete(f"/api/v1/objects/{object_id}", headers=auth_headers)