Herculino Trotta 039ad225d3 test(rules): cover object-level authorization for transaction rules ...

Regression tests for GHSA-83g9-vjqf-2j5q, one per endpoint the advisory
named plus the delete and view paths found alongside them: a non-owner
gets 403 on every mutation of a public or shared rule, and the object is
asserted unchanged afterwards.

Also covers the parts that are easy to regress in the other direction:
shared users keep read access, a shared user deleting only revokes their
own access, unowned rules stay claimable, and children of invisible rules
answer 404 rather than 403.

SharedObjectPredicateParityTests asserts is_visible_to agrees with
SharedObjectManager across every owner/visibility/shared combination.
The manager builds a Q and the predicate tests an instance, so they
cannot share an implementation and can otherwise drift apart.

2026-09-01 21:43:13 -03:00

..

__init__.py

fix(procrastinate): close Django connections around jobs

2026-05-02 16:15:26 -03:00

test_oauth.py

Add API tokens and OAuth2 client support for external integrations

2026-06-24 19:15:31 +04:00

test_permissions.py

test(rules): cover object-level authorization for transaction rules

2026-09-01 21:43:13 -03:00

test_procrastinate.py

fix(procrastinate): close Django connections around jobs

2026-05-02 16:15:26 -03:00