Authorize operation details by admin scope and isolate scoped clients

2026-10-06 22:27:26 +08:00
parent d9d9992e40
commit 28b154091c
4 changed files with 50 additions and 3 deletions
@@ -399,3 +399,27 @@ def test_docs_offline_resources(client):
    assert "cdn.jsdelivr" not in html
    assert client.get("/ui/swagger-ui-bundle.js").status_code == 200
    assert client.get("/ui/swagger-ui.css").status_code == 200
+
+
+def test_scoped_client_operation_isolation(client, service):
+    token = "restricted-client-fixture"
+    service.db.execute(
+        "INSERT INTO clients VALUES(?,?,?,?,?,?,?)",
+        (
+            "reader",
+            hashlib.sha256(token.encode()).hexdigest(),
+            "Reader",
+            encode(["devices:read", "history:read"]),
+            now_iso(),
+            None,
+            1,
+        ),
+    )
+    own = service.submit("render", {}, "living-room", "reader", "own-request")
+    other = service.submit("render", {}, "living-room", "scheduler", "other-request")
+    client.headers["Authorization"] = "Bearer " + token
+    assert client.get("/api/v1/operations/" + own).status_code == 200
+    assert client.get("/api/v1/operations/" + other).status_code == 403
+    assert [op["operation_id"] for op in client.get("/api/v1/operations").json()] == [
+        own
+    ]