Docker/mealie
Docker/mealie
1
0
Fork 0
mirror of https://github.com/mealie-recipes/mealie.git synced 2025-08-08 06:55:24 +02:00
Code Issues Releases Activity

fix: allow admin users to delete other household recipes (#5767)

Browse source 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
This commit is contained in:
Mario Džoić 2025-07-30 00:46:23 +02:00 • committed by GitHub
parent bd0aed06ce
commit 5f522b5324
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 128 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

45
tests/integration_tests/user_recipe_tests/test_recipe_owner.py
View file

@ -1,7 +1,11 @@
from datetime import UTC, datetime
from uuid import UUID
from fastapi.testclient import TestClient
from mealie.repos.repository_factory import AllRepositories
from mealie.schema.recipe.recipe import Recipe
from mealie.schema.recipe.recipe_settings import RecipeSettings
from tests.utils import api_routes
from tests.utils.factories import random_string
from tests.utils.fixture_schemas import TestUser
@ -135,3 +139,44 @@ def test_other_user_cant_lock_recipe(api_client: TestClient, user_tuple: list[Te
recipe["settings"]["locked"] = True
response = api_client.put(api_routes.recipes + f"/{recipe_name}", json=recipe, headers=usr_2.token)
assert response.status_code == 403
def test_other_user_cant_delete_recipe(api_client: TestClient, user_tuple: list[TestUser]):
slug = random_string(10)
unique_user, other_user = user_tuple
unique_user.repos.recipes.create(
Recipe(
user_id=unique_user.user_id,
group_id=unique_user.group_id,
name=slug,
settings=RecipeSettings(locked=True),
)
)
response = api_client.delete(api_routes.recipes_slug(slug), headers=other_user.token)
assert response.status_code == 403
def test_admin_can_delete_locked_recipe_owned_by_another_user(
api_client: TestClient, unfiltered_database: AllRepositories, unique_user: TestUser, admin_user: TestUser
):
slug = random_string(10)
unique_user.repos.recipes.create(
Recipe(
user_id=unique_user.user_id,
group_id=unique_user.group_id,
name=slug,
settings=RecipeSettings(locked=True),
)
)
# Make sure admin belongs to same group/household as user
admin_data = unfiltered_database.users.get_one(admin_user.user_id)
assert admin_data
admin_data.group_id = UUID(unique_user.group_id)
admin_data.household_id = UUID(unique_user.household_id)
unfiltered_database.users.update(admin_user.user_id, admin_data)
response = api_client.delete(api_routes.recipes_slug(slug), headers=admin_user.token)
assert response.status_code == 200