feat: create feature request api endpoint #1204
Conversation
…ate_python_fastapi_web into dev feat: implement feature requests api
…re request endpoints - Fixed mock setups for `create_feature_request`, `get_feature_requests`, and related functions to ensure proper calls. - Reordered authorization checks to prioritize "not found" checks before "forbidden" checks. - Corrected mock mismatches in `get_feature_request_success_admin` and other tests. - Improved test assertions and coverage for error cases (404, 403) and success scenarios.
DanielleBadobre
changed the title
DanielleBadobre
changed the title
Signed-off-by: DanielleBadobre <[email protected]>
Signed-off-by: DanielleBadobre <[email protected]>
done ✅ |
Signed-off-by: DanielleBadobre <[email protected]>
Signed-off-by: DanielleBadobre <[email protected]>
…hemas Signed-off-by: DanielleBadobre <[email protected]>
- Modify fixtures to remove status from feature request creation data - Add tests to verify status is always set to "Pending" on creation - Add test cases covering admin-only status update restriction - Ensure non-admin users can still update other fields - Fix capitalization of priority values to match model defaults Signed-off-by: DanielleBadobre <[email protected]>
| if not current_user.is_superadmin and "status" in update_data: | ||
| raise HTTPException( | ||
| status_code=status.HTTP_403_FORBIDDEN, | ||
| detail="Only admins can update the status field" | ||
| ) |
There was a problem hiding this comment.
Youve already made a check to verify admin access in line 89
these lines of code will never be reached.
You can remove it
There was a problem hiding this comment.
ok sir, but actually the two checks serve different purposes.
-
The first check (line 89) verifies if the user has permission to update the feature request at all. It checks if the user is either a superadmin OR the owner of the feature request.
-
The second check (lines 98-102) only applies when a user is trying to update the "status" field. Even if a user passes the first check (because they're the owner of the request), they'll still hit this second check if they're trying to update the status field.
should i still remove the lines ?
FEATURE REQUESTS API
Description
Implemented feature request functionality, including:
Related Issue (Link to issue ticket)
#1191
Motivation and Context
This feature enables users to request new functionalities directly from the application while ensuring that only authorized users can view, update, or delete their own requests. Superadmins have access to all feature requests.
How Has This Been Tested?
Screenshots (Postman, etc):
Pytest Results
Creating Feature Request
Getting User's Features Requests
Getting Feature Request by ID
Updating Feature Request
Deleting Feature Request
Accessing Deleted Feature Request
Types of changes
Checklist: