romfast/rar-autopass
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: comentarii strict functionale, fara referinte PRD/stories

Browse Source 
Curatare globala a comentariilor si docstring-urilor (app, tools, teste,
scripturi): eliminate referintele la PRD-uri, US-xxx, task-uri istorice si
review-uri; pastrata doar informatia functionala, formulata scurt. Regula
adaugata in CLAUDE.md (sectiunea Stil). Fara modificari de cod sau comportament.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Claude Agent
2026-07-06 13:48:38 +00:00
parent 86408887e5
commit 44f261e269
226 changed files with 1313 additions and 1760 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
tests/test_web_scope.py
View File

@@ -1,4 +1,4 @@
"""US-011 (PRD 5.15): account-scope pe GET-urile de listare web (securitate).
"""Teste pentru account-scope pe GET-urile de listare web (securitate).
Verifica:
- /_fragments/submissions: un cont nu vede randurile altui cont
@@ -6,10 +6,6 @@ Verifica:
- /_fragments/nomenclator: necesita autentificare (fragment dashboard, nu endpoint public)
- /_fragments/trimiteri-versiune: necesita autentificare
- Unauthenticated access -> redirect 303 pe ORICE fragment cu date
Legatura cu implementare: mecanismul de scope existent (require_login +
account_scope_clause) se reutilizeaza fara logica noua. Nomenclatorul primeste
require_login din US-011 (fragment dashboard, nu endpoint public).
"""
from __future__ import annotations
@@ -104,24 +100,21 @@ def test_get_listare_scoped_cont(client):
"""
NR_A = "BV01SCO"
NR_B = "BV02SCO"
VIN_A = "WVWZZZ1JZXW111AAA" # vin_scurt va fi '...111AAA'
VIN_B = "WVWZZZ1JZXW222BBB" # vin_scurt va fi '...222BBB'
VIN_A = "WVWZZZ1JZXW111AAA"
VIN_B = "WVWZZZ1JZXW222BBB"
acct_a = _create_account_user("scope-a@test.com", name="ContA")
acct_b = _create_account_user("scope-b@test.com", name="ContB")
_insert_submission(acct_a, vin=VIN_A, nr=NR_A)
_insert_submission(acct_b, vin=VIN_B, nr=NR_B)
# Login ca cont B
_login(client, "scope-b@test.com")
resp = client.get("/_fragments/submissions")
assert resp.status_code == 200
html = resp.text
# Contul B vede propriul nr inmatriculare
assert NR_B in html, "Contul B ar trebui sa vada propriul nr inmatriculare"
# Contul B NU vede nr inmatriculare si VIN (vin_scurt) ale contului A
assert NR_A not in html, "Scurgere cross-account: nr_inmatriculare contului A vizibil contului B"
assert "111AAA" not in html, "Scurgere cross-account: VIN (vin_scurt) contului A vizibil contului B"
@@ -152,31 +145,26 @@ def test_get_detaliu_scoped_404(client):
_create_account_user("detscope-b@test.com", name="DetB")
sid_a = _insert_submission(acct_a, vin="WVWZZZ1JZXWAAA111")
# Login ca cont B
_login(client, "detscope-b@test.com")
# Cerere detaliu pe submission-ul contului A
resp = client.get(f"/_fragments/trimitere/{sid_a}")
assert resp.status_code == 404, (
f"Asteptat 404, primit {resp.status_code}. "
"Nu trebuie confirmata existenta unui submission al altui cont."
)
# Id inexistent -> acelasi 404 (nu confirmam existenta)
resp2 = client.get("/_fragments/trimitere/999999")
assert resp2.status_code == 404
# ---------------------------------------------------------------------------
# Test 4: nomenclator necesita autentificare (RED inainte de fix)
# Test 4: nomenclator necesita autentificare
# ---------------------------------------------------------------------------
def test_get_nomenclator_neautentificat_redirect(client):
"""/_fragments/nomenclator este un fragment al dashboard-ului autentificat.
Fara sesiune, trebuie sa returneze 303 redirect la /login.
RED inainte de fix: in prezent fragmentul nu apeleaza require_login
si returneaza 200 chiar fara autentificare.
"""
resp = client.get("/_fragments/nomenclator")
assert resp.status_code == 303, (