625275e55b
Add the Healthcare platform backend (phases 13.0–13.7) with Alembic migration revision fix, production deploy script, validation reports, shared UI exports, and loyalty list page client directives so Next.js build succeeds. Co-authored-by: Cursor <cursoragent@cursor.com>
66 lines
1.9 KiB
Python
66 lines
1.9 KiB
Python
"""Tenant isolation tests — Phase 13.0."""
|
|
from __future__ import annotations
|
|
|
|
from app.tests.conftest import TENANT_A, TENANT_B, tenant_headers
|
|
|
|
|
|
async def test_tenant_required(client):
|
|
res = await client.get("/api/v1/clinics")
|
|
assert res.status_code in (400, 422)
|
|
|
|
|
|
async def test_clinic_tenant_isolation(client):
|
|
headers_a = tenant_headers(TENANT_A)
|
|
headers_b = tenant_headers(TENANT_B)
|
|
|
|
created = await client.post(
|
|
"/api/v1/clinics",
|
|
headers=headers_a,
|
|
json={"code": "TISO", "name": "Isolated Clinic"},
|
|
)
|
|
assert created.status_code == 201
|
|
clinic_id = created.json()["id"]
|
|
|
|
other = await client.get(f"/api/v1/clinics/{clinic_id}", headers=headers_b)
|
|
assert other.status_code == 404
|
|
|
|
|
|
async def test_doctor_tenant_isolation(client):
|
|
headers_a = tenant_headers(TENANT_A)
|
|
headers_b = tenant_headers(TENANT_B)
|
|
|
|
doctor = await client.post(
|
|
"/api/v1/doctors",
|
|
headers=headers_a,
|
|
json={
|
|
"user_id": "iso-doc-1",
|
|
"code": "DISO",
|
|
"display_name": "Dr. Iso",
|
|
},
|
|
)
|
|
assert doctor.status_code == 201
|
|
doctor_id = doctor.json()["id"]
|
|
|
|
denied = await client.get(f"/api/v1/doctors/{doctor_id}", headers=headers_b)
|
|
assert denied.status_code == 404
|
|
|
|
|
|
async def test_patient_tenant_isolation(client):
|
|
headers_a = tenant_headers(TENANT_A)
|
|
headers_b = tenant_headers(TENANT_B)
|
|
|
|
patient = await client.post(
|
|
"/api/v1/patients",
|
|
headers=headers_a,
|
|
json={
|
|
"user_id": "iso-pat-1",
|
|
"code": "PISO",
|
|
"display_name": "Patient Iso",
|
|
},
|
|
)
|
|
assert patient.status_code == 201
|
|
patient_id = patient.json()["id"]
|
|
|
|
denied = await client.get(f"/api/v1/patients/{patient_id}", headers=headers_b)
|
|
assert denied.status_code == 404
|