Files
huntingclubroster/tests/security_capacity_runner.py

21 lines
1.3 KiB
Python

import json,os,subprocess
from application_harness import Application,PHP,ROOT
os.environ['HCR_EXPORT_MAX_ROWS']='30'
app=Application()
try:
ids=app.fixture('tenantSeed');app.env['HCR_TENANT_IDS']=json.dumps(ids)
subprocess.run(PHP+['tests/capacity_service.php'],cwd=ROOT,env=app.env,check=True)
app.login('admina2@example.test','Tenant test password 123!');checks=0
for scope in ['members','seasons','dues','payments','adjustments','invitations']:
status,body,_=app.request('/main.php?Xaction=Roster.workspace&club_serial='+str(ids['clubA'])+'&'+scope+'_page=9999')
assert status==200 and ('aria-label="'+scope+' pages"').encode() in body,(scope,status,body[:500])
checks+=1;print('PASS:',scope,'pager opens the final page through HTTP')
status,body,_=app.request('/main.php?Xaction=RosterReports.catalog&clubs_page=9999')
assert status==200 and b'Tenant Alpha' in body and b'Tenant Beta' not in body
checks+=1;print('PASS: Read-only report catalog paging retains managed-club scope')
for route in ['csv','excel','pdf','ledger']:
assert app.post('RosterReports.'+route,club_serial=ids['clubA'])[0]==422
checks+=1;print('PASS:',route,'export rejects the oversized selection through HTTP')
print(checks,'capacity page HTTP checks passed.')
finally:app.close()