From 933f0a5471889f24e9816c899df9634044db2545 Mon Sep 17 00:00:00 2001 From: root Date: Sat, 22 Aug 2026 21:16:34 +0000 Subject: [PATCH] test(rbac): isolate admin permission mutation --- tests/integration/test_rbac.py | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/tests/integration/test_rbac.py b/tests/integration/test_rbac.py index b014533..37468dc 100644 --- a/tests/integration/test_rbac.py +++ b/tests/integration/test_rbac.py @@ -188,9 +188,24 @@ def test_admin_is_explicit_and_loses_removed_permission(app): assert not has_permission('*', user) assert has_permission('stock.view', user) stock = Permission.query.filter_by(code='stock.view').first() - RolePermission.query.filter_by(role_id=admin.id, permission_id=stock.id).delete() - db.session.commit() - assert not has_permission('stock.view', user) + link = RolePermission.query.filter_by( + role_id=admin.id, permission_id=stock.id + ).one() + try: + db.session.delete(link) + db.session.commit() + assert not has_permission('stock.view', user) + finally: + # Ce test vérifie un retrait temporaire ; il ne doit pas laisser + # le rôle système admin dans un état modifié pour les tests + # suivants (notamment les smoke tests stock). + if not RolePermission.query.filter_by( + role_id=admin.id, permission_id=stock.id + ).first(): + db.session.add(RolePermission( + role_id=admin.id, permission_id=stock.id, effect='allow' + )) + db.session.commit() def test_last_super_admin_cannot_be_removed_or_deactivated(app):