test: pin the 2.x me-403 contract; fix settings-override pollution - #921
Merged
Conversation
Pins 2.x behavior where /users/me/ returns 403 (not 404) when permission is denied. Uses DELETE instead of GET because DELETE permission (user_delete) is resolved at request time via get_permissions(), so override_settings actually applies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uYLkj9YnPJ1sNE2Juek2m
…ate defaults Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uYLkj9YnPJ1sNE2Juek2m
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #921 +/- ##
=======================================
Coverage 99.33% 99.33%
=======================================
Files 27 27
Lines 908 908
=======================================
Hits 902 902
Misses 6 6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR #920 was merged into master before its fix commit was pushed to the branch, so master carried a weak
test_me_returns_200_for_authenticated_usertest instead of the required 403-contract test. This PR carries that fix commit forward:test_me_delete_returns_403_not_404_when_permission_denied, which pins that a denied/users/me/request answers 403 (not 404) in 2.x. It uses DELETE instead of GET because DELETE's permission (user_delete) is resolved at request time viaget_permissions(), sooverride_settingsactually takes effect.djoser/conf.py'sSettings._override_settings: dict-valued DJOSER overrides were merged into the shared defaultObjDictobject in place, so an override made in one test leaked into every later settings reload in the process. The new test'soverride_settings(DJOSER={"PERMISSIONS": ...})call would otherwise pollute later tests (test_user_delete.py/test_user_me.pyDELETE tests fail when the override test runs first, without this fix). The fix copies the existing dict before merging in the override.Test plan
uv run py.test testproject/testapp/tests/test_urls/test_method_parity.py::test_me_delete_returns_403_not_404_when_permission_denied testproject/testapp/tests/test_user_delete.py testproject/testapp/tests/test_user_me.py -q— 17 passeduv run py.test testproject -q— 221 passed🤖 Generated with Claude Code
https://claude.ai/code/session_011uYLkj9YnPJ1sNE2Juek2m