From 348da79175b28d7c07987050a2a9f8fe2a1289c1 Mon Sep 17 00:00:00 2001 From: Colin Maudry Date: Fri, 3 Jul 2026 10:44:31 +0200 Subject: [PATCH] test(admin): verify login succeeded in non-admin 404 test test_admin_non_admin_gets_404 asserted the same /admin 404 that anonymous visitors also get, without first confirming the login actually went through. A broken login (falls back to /connexion on bad credentials, unverified email, etc.) would leave the session anonymous and the test would keep passing for the wrong reason, silently degrading into a duplicate of test_admin_anonymous_gets_404. Now waits for the post-login redirect to /compte/abonnement (this user has no subscription) before exercising the admin guard. --- tests/admin/test_pages.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/admin/test_pages.py b/tests/admin/test_pages.py index 1e1f403..26b6dd5 100644 --- a/tests/admin/test_pages.py +++ b/tests/admin/test_pages.py @@ -67,6 +67,16 @@ def test_admin_non_admin_gets_404(dash_duo: DashComposite, monkeypatch): try: dash_duo.start_server(app) _login(dash_duo, email) + # Confirm login actually succeeded before relying on the admin guard. + # A failed login (bad credentials, unverified email, ...) redirects + # back to /connexion rather than raising, leaving the session + # anonymous — which would also yield a 404 at /admin and make this + # test indistinguishable from test_admin_anonymous_gets_404. Since + # this user has no subscription, a successful login redirects to + # /compte/abonnement (see _post_login_url in src/auth/routes.py). + dash_duo.wait_for_text_to_equal("h2", "Abonnement", timeout=8) + assert "/connexion" not in dash_duo.driver.current_url + dash_duo.driver.get(dash_duo.server_url + "/admin") dash_duo.wait_for_text_to_equal("#admin-404-heading", "404", timeout=8) finally: