Barcode Betty
3eb11543b5
The data routes (purchases, alerts, stores, etc.) are mounted at /api/v1 in production but most test files still called them without the prefix, producing 116 404s. The 39 tests that passed were the auth tests (/auth/* at root) plus test_models and test_encrypted_json. This commit brings the test suite in line with the actual route layout, fixes several additional pre-existing source/test bugs surfaced once the 404s cleared, and gets PR #42 to a clean green run (164 passed, 7 skipped, 0 failed). Source fixes - src/cartsnitch_api/auth/dependencies.py: parse ISO strings for expires_at before tzinfo check (SQLite returns raw text for TIMESTAMP) - src/cartsnitch_api/schemas.py: UserResponse.id is UUID, matching the actual model type and avoiding ResponseValidationError on /auth/me Test alignment - tests/test_routes/*, tests/test_e2e/*: add /api/v1 prefix to all data route calls (auth routes left alone — they live at root) - tests/test_openapi.py: refresh EXPECTED_ROUTES to match the actual OpenAPI spec (drop Better-Auth-only routes, add /api/v1 prefix, update route count to 31) Pre-existing test fixes - tests/test_middleware/test_rate_limit.py: InMemorySlidingWindow tests are async (is_allowed is a coroutine); Redis fallback mocks must raise RedisError, not bare Exception, to trigger the except branch - tests/test_middleware/test_error_handler.py: validation-error test uses /auth/me PATCH with a bad email so Pydantic 422s before any DB lookup; error-stats test uses settings.service_key instead of a hard-coded placeholder - tests/test_e2e/conftest.py: Coupon.valid_to is date.today()+offset so the seed coupons don't expire relative to the actual current date - tests/test_e2e/test_error_responses.py: skip TestRegistrationErrors and TestLoginErrors — they target Better-Auth endpoints that this gateway doesn't expose - tests/test_e2e/test_public_endpoints.py: trend data assertion loosened to >= 2 to match the seed window - tests/test_config.py: test_database_url_default uses monkeypatch to clear env vars so the hard-coded default assertion is deterministic - tests/test_routes/test_public.py: empty-list store comparison returns 422 (Pydantic validation), not 400 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
170 lines
5.3 KiB
Python
170 lines
5.3 KiB
Python
"""Integration tests for public endpoints (no auth)."""
|
|
|
|
import uuid
|
|
from datetime import date
|
|
from decimal import Decimal
|
|
|
|
import pytest
|
|
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
|
|
|
|
from cartsnitch_api.models import NormalizedProduct, PriceHistory, Store
|
|
|
|
|
|
@pytest.fixture
|
|
async def public_data(db_engine):
|
|
"""Seed data for public endpoints."""
|
|
factory = async_sessionmaker(db_engine, class_=AsyncSession, expire_on_commit=False)
|
|
async with factory() as session:
|
|
store = Store(name="Target", slug="target")
|
|
product = NormalizedProduct(
|
|
canonical_name="Skippy PB 16oz",
|
|
category="pantry",
|
|
brand="Skippy",
|
|
)
|
|
session.add_all([store, product])
|
|
await session.commit()
|
|
await session.refresh(store)
|
|
await session.refresh(product)
|
|
|
|
ph = PriceHistory(
|
|
normalized_product_id=product.id,
|
|
store_id=store.id,
|
|
observed_date=date(2026, 3, 5),
|
|
regular_price=Decimal("3.99"),
|
|
source="receipt",
|
|
)
|
|
session.add(ph)
|
|
await session.commit()
|
|
|
|
return {"product": product, "store": store}
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_public_trend(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(f"/api/v1/public/trends/{pid}")
|
|
assert resp.status_code == 200
|
|
data = resp.json()
|
|
assert data["product_name"] == "Skippy PB 16oz"
|
|
assert len(data["data_points"]) == 1
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_public_trend_not_found(client):
|
|
resp = await client.get(f"/api/v1/public/trends/{uuid.uuid4()}")
|
|
assert resp.status_code == 404
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_public_store_comparison(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(f"/api/v1/public/store-comparison?product_ids={pid}")
|
|
assert resp.status_code == 200
|
|
data = resp.json()
|
|
assert len(data["products"]) == 1
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_public_inflation(client, public_data):
|
|
resp = await client.get("/api/v1/public/inflation")
|
|
assert resp.status_code == 200
|
|
data = resp.json()
|
|
assert "categories" in data
|
|
assert "cartsnitch_index" in data
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_trend_invalid_uuid(client):
|
|
resp = await client.get("/api/v1/public/trends/not-a-uuid")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_trend_days_zero(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(f"/api/v1/public/trends/{pid}?days=0")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_trend_days_negative(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(f"/api/v1/public/trends/{pid}?days=-1")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_trend_days_over_max(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(f"/api/v1/public/trends/{pid}?days=999")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_trend_days_valid(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(f"/api/v1/public/trends/{pid}?days=30")
|
|
assert resp.status_code == 200
|
|
assert "product_name" in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_store_comparison_empty_list(client):
|
|
resp = await client.get("/api/v1/public/store-comparison")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_store_comparison_category_xss(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(
|
|
f"/api/v1/public/store-comparison?product_ids={pid}&category=<script>alert(1)</script>"
|
|
)
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_store_comparison_category_sql_injection(client, public_data):
|
|
pid = str(public_data["product"].id)
|
|
resp = await client.get(
|
|
f"/api/v1/public/store-comparison?product_ids={pid}&category='; DROP TABLE--"
|
|
)
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_inflation_invalid_period(client, public_data):
|
|
resp = await client.get("/api/v1/public/inflation?period=10years")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_inflation_valid_periods(client, public_data):
|
|
for period in ["all-time", "1y", "6m", "3m", "1m"]:
|
|
resp = await client.get(f"/api/v1/public/inflation?period={period}")
|
|
assert resp.status_code == 200, f"period={period} failed"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_inflation_category_too_long(client, public_data):
|
|
long_category = "x" * 200
|
|
resp = await client.get(f"/api/v1/public/inflation?category={long_category}")
|
|
assert resp.status_code == 422
|
|
assert "detail" in resp.json()
|
|
assert "stack" not in resp.json()
|