bvandeusenandClaude Opus 4.8
04e3ab20cf
Foundation & Identity backend for ThoughtSync: - Quart app factory (create_app) with /api/health + SPA history-fallback - async SQLAlchemy 2.0 + asyncpg engine/session (lazy; boots without a DB) - native email+password auth via signed-cookie session (register/login/logout/me + login_required guard); bcrypt password hashing (72-byte safe) - multi-user sharing-ACL spine (rule 47): users, groups, group_members, and a polymorphic shares table + visible_to_user() SQL predicate (owner OR direct share OR group share) that M1's notes will scope through - Alembic async env (adapted from family pattern) + 0001 foundation migration - DB-free unit tests (app/health/auth-guard, password roundtrip, ACL compile) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm
19 lines
745 B
Python
19 lines
745 B
Python
import uuid
|
|
|
|
from thoughtsync.acl import visible_to_user
|
|
from thoughtsync.models.user import User
|
|
|
|
|
|
def test_visible_to_user_builds_owner_or_shared_predicate():
|
|
"""DB-free smoke test: the predicate compiles and references both the direct
|
|
(shares) and group (group_members) grant paths. Functional row-visibility is
|
|
verified against a live database in M1, once notes are a real shareable
|
|
resource (family practice: DB-backed tests run against the dev image, not CI).
|
|
"""
|
|
uid = uuid.uuid4()
|
|
# User stands in as a shareable resource purely to exercise the SQL builder.
|
|
clause = visible_to_user("note", User.id, User.id, uid)
|
|
sql = str(clause).lower()
|
|
assert "shares" in sql
|
|
assert "group_members" in sql
|