feat: add super admin bypass in tree list filter
Super admins now see all trees regardless of ownership, team, or public/default status. Previously the build_tree_access_filter function had no super_admin check, so admins could only see their own trees plus public/default/team trees. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -172,6 +172,37 @@ class TestTrees:
|
||||
active_ids = [tree["id"] for tree in active_trees]
|
||||
assert test_tree["id"] not in active_ids
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_super_admin_sees_all_trees(
|
||||
self, client: AsyncClient, auth_headers: dict, admin_auth_headers: dict
|
||||
):
|
||||
"""Test that super admin can see all trees including private ones from other users."""
|
||||
# Create a private (non-public, non-default) tree as a regular user
|
||||
tree_data = {
|
||||
"name": "Private User Tree",
|
||||
"description": "Only visible to author and super admin",
|
||||
"tree_structure": {
|
||||
"id": "root",
|
||||
"type": "solution",
|
||||
"title": "Private",
|
||||
"description": "Private tree"
|
||||
},
|
||||
"is_public": False,
|
||||
"is_default": False
|
||||
}
|
||||
|
||||
create_response = await client.post(
|
||||
"/api/v1/trees", json=tree_data, headers=auth_headers
|
||||
)
|
||||
assert create_response.status_code == 201
|
||||
private_tree_id = create_response.json()["id"]
|
||||
|
||||
# Super admin should see it in list
|
||||
list_response = await client.get("/api/v1/trees", headers=admin_auth_headers)
|
||||
assert list_response.status_code == 200
|
||||
tree_ids = [t["id"] for t in list_response.json()]
|
||||
assert private_tree_id in tree_ids
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_create_tree_unauthorized(self, client: AsyncClient):
|
||||
"""Test that creating a tree without auth fails."""
|
||||
|
||||
Reference in New Issue
Block a user