counterweight/arbret
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add FETCH_PRICE permission for manual price fetch endpoint

Browse source 
The POST /api/audit/price-history/fetch endpoint now requires
FETCH_PRICE permission instead of VIEW_AUDIT, which is more
semantically correct since it's a write operation.
This commit is contained in:
counterweight 2025-12-22 16:22:54 +01:00
parent 54709888e1
commit 3806361fac
Signed by: counterweight
GPG key ID: 883EDBAA726BD96C
4 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
backend/tests/test_price_history.py
View file

@ -215,7 +215,7 @@ class TestManualFetch:
assert response.status_code == 401
@pytest.mark.asyncio
async def test_requires_view_audit_permission(self, client_factory, regular_user):
async def test_requires_fetch_price_permission(self, client_factory, regular_user):
"""Verify regular users cannot trigger manual fetch."""
async with client_factory.create(cookies=regular_user["cookies"]) as authed:
response = await authed.post("/api/audit/price-history/fetch")