dodil/erp-brick-purchasing

DODIL ERP brick: purchasing

tests/test_access_new_routes.py

"""Access and probe tests for the routes of slices 2-4: a caller without the permission is refused (403) and an authorised caller asking for something
that is not there gets a 404, never a hint about other records."""
import pytest
from conftest import ALICE, RECEIVER, api, world

READS = ["/agreements/NOPE", "/rfqs/NOPE", "/source-list/NOPE", "/down-payments/NOPE", "/down-payments", "/self-billing-agreements", "/consignment-withdrawals",
         "/suppliers/7001/evaluations", "/suppliers/7001/evaluation?period_id=2026-Q4", "/bill-drafts/NOPE", "/migration-map?odoo_model=account.move&odoo_id=1"]
WRITES = [("/agreements/NOPE/approve", {}), ("/agreements/NOPE/submit", {}), ("/rfqs/NOPE/send", {}), ("/down-payments/NOPE/approve", {}), ("/down-payments/NOPE/clear", {"bill_id": "B", "amount": "1.00"}),
          ("/down-payments/NOPE/refund", {"refund_reference": "R"}), ("/down-payments/NOPE/invoice", {"supplier_invoice_no": "I", "invoice_date": "2026-11-20"}),
          ("/bills/NOPE/hand-over-assets", {}), ("/ers/settle", {"up_to": "2026-11-20"}), ("/migration/odoo/load", {"cutover_date": "2026-06-30"}),
          ("/migration/odoo/NOPE/sign", {}), ("/evaluation-weights", {"valid_from": "2026-12-01", "price": 1, "delivery": 1, "quantity": 1, "quality": 1, "service": 1}),
          ("/consignment-withdrawals", {"move_ref": "m", "bp_id": 7001, "product_id": "P", "quantity": "1", "unit_code": "C62", "withdrawn_on": "2026-11-01"})]


@pytest.mark.parametrize("path", READS)
def test_a_reader_without_the_permission_is_refused(path):
    world()
    assert api("GET", path, RECEIVER)[0] == 403, path


@pytest.mark.parametrize("path,body", WRITES)
def test_a_writer_without_the_permission_is_refused(path, body):
    world()
    assert api("POST", path, RECEIVER, body)[0] == 403, path


@pytest.mark.parametrize("path", ["/agreements/NOPE", "/rfqs/NOPE", "/down-payments/NOPE", "/bill-drafts/NOPE", "/migration-map?odoo_model=account.move&odoo_id=1"])
def test_an_authorised_reader_of_something_that_is_not_there_gets_404(path):
    world()
    assert api("GET", path, ALICE)[0] == 404, path


@pytest.mark.parametrize("path,body", [("/agreements/NOPE/approve", {}), ("/down-payments/NOPE/approve", {}), ("/down-payments/NOPE/refund", {"refund_reference": "R"}),
                                       ("/migration/odoo/NOPE/sign", {}), ("/rfqs/NOPE/send", {})])
def test_an_authorised_writer_on_something_that_is_not_there_gets_404(path, body):
    world()
    assert api("POST", path, ALICE, body)[0] == 404, path


def test_the_receiver_provides_components_and_an_unknown_order_is_404():
    # the receiver holds purchasing:subcontract:provide (roles.yaml), so it is authorised: an unknown order is 404, not 403
    world()
    assert api("POST", "/purchase-orders/NOPE/subcontract-provisions", RECEIVER, {"line_no": 1, "from_location_id": "WH"})[0] == 404