Skip to content

test: pin the 2.x me-403 contract; fix settings-override pollution - #921

Merged
tomwojcik merged 2 commits into
masterfrom
tests/2x-me-403-followup
Aug 1, 2026
Merged

test: pin the 2.x me-403 contract; fix settings-override pollution#921
tomwojcik merged 2 commits into
masterfrom
tests/2x-me-403-followup

Conversation

@tomwojcik

Copy link
Copy Markdown
Collaborator

PR #920 was merged into master before its fix commit was pushed to the branch, so master carried a weak test_me_returns_200_for_authenticated_user test instead of the required 403-contract test. This PR carries that fix commit forward:

  1. Replaces the weak test with test_me_delete_returns_403_not_404_when_permission_denied, which pins that a denied /users/me/ request answers 403 (not 404) in 2.x. It uses DELETE instead of GET because DELETE's permission (user_delete) is resolved at request time via get_permissions(), so override_settings actually takes effect.
  2. Fixes a one-line bug in djoser/conf.py's Settings._override_settings: dict-valued DJOSER overrides were merged into the shared default ObjDict object in place, so an override made in one test leaked into every later settings reload in the process. The new test's override_settings(DJOSER={"PERMISSIONS": ...}) call would otherwise pollute later tests (test_user_delete.py / test_user_me.py DELETE tests fail when the override test runs first, without this fix). The fix copies the existing dict before merging in the override.

Test plan

  • uv run py.test testproject/testapp/tests/test_urls/test_method_parity.py::test_me_delete_returns_403_not_404_when_permission_denied testproject/testapp/tests/test_user_delete.py testproject/testapp/tests/test_user_me.py -q — 17 passed
  • uv run py.test testproject -q — 221 passed

🤖 Generated with Claude Code

https://claude.ai/code/session_011uYLkj9YnPJ1sNE2Juek2m

tomwojcik and others added 2 commits August 1, 2026 22:03
Pins 2.x behavior where /users/me/ returns 403 (not 404) when permission
is denied. Uses DELETE instead of GET because DELETE permission (user_delete)
is resolved at request time via get_permissions(), so override_settings
actually applies.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011uYLkj9YnPJ1sNE2Juek2m
…ate defaults

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011uYLkj9YnPJ1sNE2Juek2m
@codecov

codecov Bot commented Aug 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.33%. Comparing base (6059138) to head (26b83f2).

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #921   +/-   ##
=======================================
  Coverage   99.33%   99.33%           
=======================================
  Files          27       27           
  Lines         908      908           
=======================================
  Hits          902      902           
  Misses          6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@tomwojcik
tomwojcik merged commit ca106b1 into master Aug 1, 2026
32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant