mivanchenko
456ca3872f
Test backoffice (smb-crm) / test (push) Successful in 1m46s
Enables multiple barbers/staff bookable at the same location and time -- previously "resource" conflated "location" and "the thing that can't double-book itself" into one row, so a Filiale could only ever have exactly one bookable slot at once. - New `locations` table; `resources.location_id` with a generic, idempotent backfill migration (any resource without a location gets one auto-created matching its name -- not a one-off for any single client, protects any future resource stuck in the old flat shape too) - `resources`/`resource_hours`/services keep everything they already had (hours, min-notice, max-advance, buffer, the no-overlap constraint) scoped to resource_id, not location_id -- two barbers at one location must stay independently bookable at the same time - booking_db.py: new locations CRUD mirroring the existing resources/services pattern; create_resource now requires a location_id, guarded the same way every other tenant check here is (get_location existence check, no real FK -- matches this schema's existing no-FK convention throughout) - app.py: new POST /api/locations provisioning route; POST /api/resources now requires location_id - owner_settings.py + settings.html: new self-service "add a Filiale" / "add a barber" UI -- there was previously no way to create a resource at all outside the CRM/n8n provisioning API - public_booking.py + book.html: new Filiale picker (reuses the existing wireOptionGroup button-group pattern), filtering the Mitarbeiter picker to the selected location -- a single-location client sees no extra click, same as before Filialen existed - owner_booking.py + agenda.html: the Filiale show/hide toggle and hide-cancelled toggle (shipped earlier this session) now key off location_id instead of resource_id, so hiding a Filiale hides every barber's bookings at it; manual-booking dropdown grouped by Filiale - n8n/onboarding.json: default provisioning now creates a "Hauptfiliale" location before its resource (inert until re-imported into the live n8n instance) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
122 lines
4.2 KiB
Python
122 lines
4.2 KiB
Python
"""Flask test client / real-DB integration tests for the per-client ICS
|
|
calendar feed (#22): each client's clients.ics_token gates and scopes
|
|
/api/bookings.ics, replacing the old shared ICS_TOKEN + client_id query
|
|
param. Same testing decision as #20/#21: assert on HTTP response + DB state.
|
|
"""
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
import pytest
|
|
|
|
import booking_db as bdb
|
|
from app import app as flask_app
|
|
|
|
CLIENT_A = "C-TEST-ICS-A"
|
|
CLIENT_B = "C-TEST-ICS-B"
|
|
|
|
|
|
@pytest.fixture
|
|
def client():
|
|
flask_app.config["TESTING"] = True
|
|
flask_app.secret_key = "test-secret"
|
|
return flask_app.test_client()
|
|
|
|
|
|
def _setup(client_id, business_name):
|
|
with bdb.db.connect() as conn, conn.cursor() as cur:
|
|
cur.execute(
|
|
"INSERT INTO clients (client_id, business_name, timezone, auto_confirm, ics_token) "
|
|
"VALUES (%s, %s, %s, %s, NULL) ON CONFLICT (client_id) DO UPDATE SET "
|
|
"business_name = EXCLUDED.business_name, ics_token = NULL",
|
|
(client_id, business_name, "Europe/Berlin", True))
|
|
conn.commit()
|
|
location = bdb.create_location(client_id, "Main")
|
|
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1")
|
|
start = datetime.now(timezone.utc).replace(microsecond=0) + timedelta(days=1)
|
|
booking = bdb.create_booking(
|
|
client_id, resource["resource_id"], "Ivy", "ivy@example.com",
|
|
"Haircut", start, start + timedelta(minutes=30))
|
|
return resource, booking
|
|
|
|
|
|
def _login(client, client_id, email="owner@example.com", password="correct horse"):
|
|
bdb.create_user(client_id, email, password)
|
|
client.post("/owner/login", data={"email": email, "password": password})
|
|
|
|
|
|
# ---- token gating ----
|
|
|
|
def test_missing_token_is_forbidden(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
resp = client.get("/api/bookings.ics")
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_bogus_token_is_forbidden(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
resp = client.get("/api/bookings.ics", query_string={"token": "not-a-real-token"})
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_valid_token_returns_only_that_clients_bookings(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
_setup(CLIENT_B, "Cafe Lichtblick")
|
|
token_a = bdb.ensure_ics_token(CLIENT_A)
|
|
resp = client.get("/api/bookings.ics", query_string={"token": token_a})
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
assert "Ivy" in body
|
|
assert CLIENT_A in body
|
|
assert CLIENT_B not in body
|
|
|
|
|
|
def test_swapping_client_id_query_param_has_no_effect(client):
|
|
"""The old feed let any token holder view another client's bookings by
|
|
changing client_id -- the new feed resolves the client from the token
|
|
alone, so a client_id param (even another tenant's) is simply ignored."""
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
resource_b, booking_b = _setup(CLIENT_B, "Cafe Lichtblick")
|
|
token_a = bdb.ensure_ics_token(CLIENT_A)
|
|
resp = client.get("/api/bookings.ics", query_string={
|
|
"token": token_a, "client_id": CLIENT_B})
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
assert CLIENT_B not in body
|
|
assert CLIENT_A in body
|
|
|
|
|
|
# ---- token provisioning ----
|
|
|
|
def test_ensure_ics_token_generates_and_persists(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
assert bdb.get_client(CLIENT_A)["ics_token"] is None
|
|
token = bdb.ensure_ics_token(CLIENT_A)
|
|
assert token
|
|
assert bdb.get_client(CLIENT_A)["ics_token"] == token
|
|
|
|
|
|
def test_ensure_ics_token_is_stable_across_calls(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
first = bdb.ensure_ics_token(CLIENT_A)
|
|
second = bdb.ensure_ics_token(CLIENT_A)
|
|
assert first == second
|
|
|
|
|
|
def test_ensure_ics_token_differs_per_client(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
_setup(CLIENT_B, "Cafe Lichtblick")
|
|
assert bdb.ensure_ics_token(CLIENT_A) != bdb.ensure_ics_token(CLIENT_B)
|
|
|
|
|
|
# ---- owner dashboard surfacing ----
|
|
|
|
def test_settings_page_shows_subscribe_url_with_own_token(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
_login(client, CLIENT_A)
|
|
resp = client.get("/owner/settings")
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
token = bdb.get_client(CLIENT_A)["ics_token"]
|
|
assert token
|
|
assert f"token={token}" in body
|
|
assert "bookings.ics" in body
|