Authorize operation details by admin scope and isolate scoped clients

tests/test_accounts.py

@@ -125,3 +125,19 @@ def test_openapi_describes_cookie_auth_and_docs_csrf(client):
         "security"
     ]
     assert "X-CSRF-Token" in client.get("/docs").text
+
+
+def test_browser_admin_can_read_other_clients_operation(client, app, service):
+    operation_id = service.submit(
+        "render",
+        {"template": "quote"},
+        "living-room",
+        "scheduler",
+        "fixture-request",
+        None,
+    )
+    assert login(client, app).status_code == 200
+    assert client.get("/api/v1/operations/" + operation_id).status_code == 200
+    assert operation_id in [
+        op["operation_id"] for op in client.get("/api/v1/operations").json()
+    ]

tests/test_api.py

@@ -399,3 +399,27 @@ def test_docs_offline_resources(client):
     assert "cdn.jsdelivr" not in html
     assert client.get("/ui/swagger-ui-bundle.js").status_code == 200
     assert client.get("/ui/swagger-ui.css").status_code == 200
+
+
+def test_scoped_client_operation_isolation(client, service):
+    token = "restricted-client-fixture"
+    service.db.execute(
+        "INSERT INTO clients VALUES(?,?,?,?,?,?,?)",
+        (
+            "reader",
+            hashlib.sha256(token.encode()).hexdigest(),
+            "Reader",
+            encode(["devices:read", "history:read"]),
+            now_iso(),
+            None,
+            1,
+        ),
+    )
+    own = service.submit("render", {}, "living-room", "reader", "own-request")
+    other = service.submit("render", {}, "living-room", "scheduler", "other-request")
+    client.headers["Authorization"] = "Bearer " + token
+    assert client.get("/api/v1/operations/" + own).status_code == 200
+    assert client.get("/api/v1/operations/" + other).status_code == 403
+    assert [op["operation_id"] for op in client.get("/api/v1/operations").json()] == [
+        own
+    ]