Logan CusanoandClaude Opus 5.5
2b42e5ee9a
A viewer whose first login ran self-serve signup got an empty org of
their own (org_role owner), so they saw no incidents or calls, and the
earlier fix deliberately never moved a user who already had an org.
PATCH /admin/users/{uid} now moves a user when org_id is passed
explicitly (claims + org_members, audited with left_org_id; the old org
is not deleted). The user list returns org_id/org_role, and the admin
user panel shows the org and a 'Move to my organization' button when it
isn't yours.
Verified: c2-core pytest 496 passed; frontend tsc --noEmit clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
95 lines
4.0 KiB
Python
95 lines
4.0 KiB
Python
"""
|
|
Admin-created users must land in an org. firestore.rules gates every read on
|
|
the org_id claim, so a viewer created via POST /admin/users without one saw no
|
|
incidents or calls at all (reported 2026-09-27).
|
|
"""
|
|
from types import SimpleNamespace
|
|
from unittest.mock import AsyncMock, patch
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.main import app
|
|
from app.internal.auth import require_admin_token
|
|
from app.routers import users
|
|
|
|
client = TestClient(app)
|
|
ADMIN = {"uid": "admin-1", "email": "a@x", "role": "admin", "org_id": "org-A"}
|
|
|
|
|
|
def _as(decoded):
|
|
app.dependency_overrides[require_admin_token] = lambda: decoded
|
|
|
|
|
|
def teardown_function():
|
|
app.dependency_overrides.pop(require_admin_token, None)
|
|
|
|
|
|
def _fb(**kw):
|
|
base = dict(uid="u1", email="v@x", display_name="", custom_claims={}, disabled=False,
|
|
email_verified=False, user_metadata=SimpleNamespace(creation_timestamp=0, last_sign_in_timestamp=None))
|
|
return SimpleNamespace(**{**base, **kw})
|
|
|
|
|
|
def _run(method, path, body, fb_user, orgs=("org-A", "founding")):
|
|
fa = users.firebase_auth
|
|
with patch.object(fa, "create_user", return_value=fb_user, create=True), \
|
|
patch.object(fa, "get_user", return_value=fb_user, create=True), \
|
|
patch.object(fa, "set_custom_user_claims", create=True) as set_claims, \
|
|
patch.object(fa, "generate_password_reset_link", return_value="link", create=True), \
|
|
patch.object(users.fstore, "doc_get", AsyncMock(side_effect=lambda c, i: {"org_id": i} if c == "organizations" and i in orgs else None)), \
|
|
patch.object(users.fstore, "doc_set", AsyncMock()) as doc_set, \
|
|
patch.object(users.audit, "write_audit", AsyncMock()):
|
|
resp = getattr(client, method)(path, json=body)
|
|
members = [c for c in doc_set.await_args_list if c.args[0] == "org_members"]
|
|
return resp, set_claims, members
|
|
|
|
|
|
def test_created_viewer_joins_the_admins_org_as_member():
|
|
_as(ADMIN)
|
|
resp, set_claims, members = _run("post", "/admin/users", {"email": "v@x", "role": "viewer"}, _fb())
|
|
assert resp.status_code == 200, resp.text
|
|
claims = set_claims.call_args.args[1]
|
|
assert (claims["org_id"], claims["org_role"], claims["role"]) == ("org-A", "member", "viewer")
|
|
assert members and members[0].args[2]["org_id"] == "org-A"
|
|
|
|
|
|
def test_admin_without_an_org_claim_defaults_to_founding():
|
|
_as({k: v for k, v in ADMIN.items() if k != "org_id"})
|
|
resp, set_claims, _ = _run("post", "/admin/users", {"email": "v@x", "role": "viewer"}, _fb())
|
|
assert resp.status_code == 200, resp.text
|
|
assert set_claims.call_args.args[1]["org_id"] == "founding"
|
|
|
|
|
|
def test_unknown_org_is_rejected():
|
|
_as(ADMIN)
|
|
resp, set_claims, _ = _run("post", "/admin/users", {"email": "v@x", "role": "viewer", "org_id": "nope"}, _fb())
|
|
assert resp.status_code == 400
|
|
set_claims.assert_not_called()
|
|
|
|
|
|
def test_editing_an_orgless_user_heals_them():
|
|
_as(ADMIN)
|
|
resp, set_claims, members = _run("patch", "/admin/users/u1", {"role": "viewer"}, _fb(custom_claims={"role": "viewer"}))
|
|
assert resp.status_code == 200, resp.text
|
|
assert set_claims.call_args.args[1]["org_id"] == "org-A"
|
|
assert members
|
|
|
|
|
|
def test_editing_never_silently_moves_an_existing_org():
|
|
_as(ADMIN)
|
|
fb = _fb(custom_claims={"role": "viewer", "org_id": "org-B", "org_role": "member"})
|
|
resp, set_claims, members = _run("patch", "/admin/users/u1", {"role": "viewer"}, fb)
|
|
assert resp.status_code == 200
|
|
assert set_claims.call_args.args[1]["org_id"] == "org-B"
|
|
assert not members
|
|
|
|
|
|
def test_explicit_org_id_moves_a_self_provisioned_owner_into_the_network():
|
|
_as(ADMIN)
|
|
fb = _fb(custom_claims={"role": "viewer", "org_id": "own-empty-org", "org_role": "owner"})
|
|
resp, set_claims, members = _run("patch", "/admin/users/u1", {"org_id": "org-A"}, fb)
|
|
assert resp.status_code == 200, resp.text
|
|
claims = set_claims.call_args.args[1]
|
|
assert (claims["org_id"], claims["org_role"]) == ("org-A", "member")
|
|
assert members and members[0].args[2]["org_id"] == "org-A"
|