From 1453b31cee6a81a507b36716c7378d7dc833d4d7 Mon Sep 17 00:00:00 2001 From: AdrianoDev Date: Thu, 15 Oct 2026 09:53:33 +0200 Subject: [PATCH] by-code: auth da utente loggato qualunque, come /recipes (#72) Lo chiama il proxy Flask con la chiave dell'operatore MeasurementTec, quindi get_current_user al posto di require_admin_user. Test: MeasurementTec 200, senza chiave 401. Co-Authored-By: Claude Sonnet 5.5 --- src/backend/api/routers/stations.py | 4 ++-- src/backend/tests/test_stations_api.py | 14 +++++++++++--- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/src/backend/api/routers/stations.py b/src/backend/api/routers/stations.py index 0333544..4f2f577 100644 --- a/src/backend/api/routers/stations.py +++ b/src/backend/api/routers/stations.py @@ -70,10 +70,10 @@ async def create_new_station( @router.get("/by-code/{code}", response_model=StationResponse) async def get_station_by_code( code: str, - admin: User = Depends(require_admin_user), + user: User = Depends(get_current_user), db: AsyncSession = Depends(get_db), ): - """Get a station by its code (admin only, like GET /{station_id}) (#72).""" + """Get a station by its code (any authenticated user, like /by-code/{code}/recipes) (#72).""" station = await station_service.get_station_by_code(db, code) if station is None: raise HTTPException( diff --git a/src/backend/tests/test_stations_api.py b/src/backend/tests/test_stations_api.py index 7b15eca..0fbcd0b 100644 --- a/src/backend/tests/test_stations_api.py +++ b/src/backend/tests/test_stations_api.py @@ -515,10 +515,18 @@ async def test_station_by_code_unknown_is_404(client: AsyncClient, admin_user): assert resp.status_code == 404 -async def test_station_by_code_requires_admin(client: AsyncClient, maker_user, admin_user): +async def test_station_by_code_any_authenticated_user( + client: AsyncClient, measurement_tec_user, admin_user, +): await client.post( "/api/stations", headers=auth_headers(admin_user), json={"code": "ST-BA", "name": "BA"}, ) - resp = await client.get("/api/stations/by-code/ST-BA", headers=auth_headers(maker_user)) - assert resp.status_code == 403 + resp = await client.get("/api/stations/by-code/ST-BA", headers=auth_headers(measurement_tec_user)) + assert resp.status_code == 200, resp.text + assert resp.json()["code"] == "ST-BA" + + +async def test_station_by_code_requires_auth(client: AsyncClient): + resp = await client.get("/api/stations/by-code/ST-BA") + assert resp.status_code == 401