fix: household leader selection and mobile monitoring experience v0.1.36

test_households.py

@@ -207,6 +207,28 @@ class HouseholdTests(unittest.TestCase):
         self.assertEqual(saved,user)
         self.assertEqual([tuple(r) for r in before],[tuple(r) for r in app.DB.execute('SELECT * FROM sessions ORDER BY hash')])
 
+    def test_leadership_member_requires_explicit_grant_and_revokes_old_session(self):
+        member=self.members[self.aid]
+        self.assertEqual(self.leadership(ownerId=member['id'],successorId='')[0],400)
+        self.assertEqual(app.get_object('users',member['id'])['role'],'member')
+        self.assertEqual(self.leadership(ownerId=member['id'],successorId='',grantManagement='true')[0],400)
+        self.assertEqual(self.leadership(ownerId=member['id'],successorId='',grantManagement=True)[0],200)
+        self.assertEqual(app.get_object('users',member['id'])['role'],'family_admin')
+        home=app.get_object('households',self.aid)
+        self.assertEqual(home['ownerId'],member['id'])
+        self.assertEqual(home['leadershipHistory'][-1]['promotedUserIds'],[member['id']])
+        self.assertEqual(app.DB.execute('SELECT count(*) FROM sessions WHERE user_id=?',(member['id'],)).fetchone()[0],0)
+
+    def test_leadership_grant_does_not_bypass_scope_or_partial_validation(self):
+        member=self.members[self.aid]
+        self.assertEqual(self.leadership(ownerId=member['id'],successorId=self.other['id'],grantManagement=True)[0],404)
+        self.assertEqual(app.get_object('users',member['id'])['role'],'member')
+        self.assertEqual(app.get_object('households',self.aid).get('leadershipRevision',0),0)
+        disabled=dict(self.backup,disabled=True);app.save_object('users',disabled)
+        self.assertEqual(self.leadership(ownerId=member['id'],grantManagement=True)[0],400)
+        self.assertEqual(app.get_object('users',member['id'])['role'],'member')
+        self.assertEqual(self.leadership(user=member,ownerId=member['id'],successorId='',grantManagement=True)[0],403)
+
     def test_office_factory_and_custom_grouping_are_independent(self):
         for kind in ('office','factory'):
             code, scope=self.request('/api/households',self.root,dict(name=kind,kind=kind))