feat: add super admin bypass in tree list filter

Super admins now see all trees regardless of ownership, team, or
public/default status. Previously the build_tree_access_filter function
had no super_admin check, so admins could only see their own trees plus
public/default/team trees.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
chihlasm
2026-02-05 23:25:56 -05:00
parent 71ba0b95a5
commit 02d06acfb8
2 changed files with 40 additions and 4 deletions

View File

@@ -172,6 +172,37 @@ class TestTrees:
active_ids = [tree["id"] for tree in active_trees]
assert test_tree["id"] not in active_ids
@pytest.mark.asyncio
async def test_super_admin_sees_all_trees(
self, client: AsyncClient, auth_headers: dict, admin_auth_headers: dict
):
"""Test that super admin can see all trees including private ones from other users."""
# Create a private (non-public, non-default) tree as a regular user
tree_data = {
"name": "Private User Tree",
"description": "Only visible to author and super admin",
"tree_structure": {
"id": "root",
"type": "solution",
"title": "Private",
"description": "Private tree"
},
"is_public": False,
"is_default": False
}
create_response = await client.post(
"/api/v1/trees", json=tree_data, headers=auth_headers
)
assert create_response.status_code == 201
private_tree_id = create_response.json()["id"]
# Super admin should see it in list
list_response = await client.get("/api/v1/trees", headers=admin_auth_headers)
assert list_response.status_code == 200
tree_ids = [t["id"] for t in list_response.json()]
assert private_tree_id in tree_ids
@pytest.mark.asyncio
async def test_create_tree_unauthorized(self, client: AsyncClient):
"""Test that creating a tree without auth fails."""