fix(auth): auth deps use their own DB session; smoke suites made dataset-independent

RUNTIME BUG (caught by live smoke tests): the global auth dependency queried the request-scoped session, auto-beginning its transaction — any endpoint opening 'async with db.begin()' afterwards crashed with 'transaction already begun' (POST /materials 500). get_current_user / get_actor now resolve in a short-lived session (expire_on_commit=False keeps the context usable detached); inventory/pm scopes keep passing the request session explicitly. Smoke suites rewritten against CURRENT contracts: - assertions are behavior-based (shapes, envelopes, filters), no magic seed counts; dynamic lookups instead of hard-coded names/ids - rerun-tolerant: tolerate 409-on-create by reusing prior artifacts - aligned with current rules: revert blocked after inventory receipts (v2.6), attachments allowed in every status, termsheets optional at quote level - SMOKE_USER/SMOKE_PASSWORD env for login (default tester/123456) Verified on a fresh volume: migration + audit_log bootstrap, Casdoor seed (bcrypt), demo data, and 29+76+61 smoke checks all green.
2026-09-19 00:49:15 +03:30
parent e03d94207b
commit e1495afee9
6 changed files with 351 additions and 167 deletions
@@ -35,15 +35,33 @@ if r.status_code == 200:
    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"

 # ---------- supplier + project for the test quote ----------
-sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران"}).json()["data"]
-proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"}).json()["data"]
-check("POST /suppliers + /projects", True)
+# dataset-independent: fetch/create whatever the seed does or doesn't have
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
+r_sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران", "category_id": cat["id"]})
+if r_sup.status_code == 201:
+    sup = r_sup.json()["data"]
+    check("POST /suppliers", True)
+else:  # rerun — the test supplier already exists
+    sup = c.get("/suppliers", params={"q": "تأمین‌کننده تست"}).json()["data"][0]
+    check("POST /suppliers (exists from previous run — 409 tolerated)", r_sup.status_code == 409, r_sup.text[:200])
+r_proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"})
+if r_proj.status_code == 201:
+    proj = r_proj.json()["data"]
+    check("POST /projects", True)
+else:
+    proj = c.get("/projects", params={"q": "پروژه تست"}).json()["data"][0]
+    check("POST /projects (exists from previous run — 409 tolerated)", r_proj.status_code == 409, r_proj.text[:200])

 # ---------- material with EAV + brands ----------
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
-brand = c.get("/brands", params={"q": "فولاد مبارکه"}).json()["data"][0]
+brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 defs = {d["attribute_key"]: d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]}
+# ensure the EAV keys this suite exercises exist (seed-independent)
+for _key, _dt in (("rebar_grade", "string"), ("rebar_diameter", "number"), ("rebar_ribbed", "boolean")):
+    if _key not in defs:
+        r = c.post("/attribute-definitions", json={"attribute_key": _key, "label": _key, "data_type": _dt})
+        check("POST /attribute-definitions (%s)" % _key, r.status_code == 201, r.text[:200])
+        defs[_key] = r.json()["data"]

 r = c.post(
    "/materials",
@@ -59,11 +77,15 @@ r = c.post(
        ],
    },
 )
-check("POST /materials (EAV+brands)", r.status_code == 201, r.text[:300])
-material = r.json()["data"]
+if r.status_code == 201:
+    material = r.json()["data"]
+    check("POST /materials (EAV+brands)", True)
+else:  # rerun — fetch the material a previous run created
+    material = c.get("/materials", params={"q": "میلگرد تست A3 سایز ۱۶"}).json()["data"][0]
+    check("POST /materials (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])

 r = c.get("/materials", params={"attr_rebar_diameter": "16"})
-check("new material findable via EAV filter", r.status_code == 200 and r.json()["meta"]["total"] == 1)
+check("new material findable via EAV filter", r.status_code == 200 and any(m["id"] == material["id"] for m in r.json()["data"]))

 r = c.post("/materials", json={"category_id": cat["id"], "name": "میلگرد تست A3 سایز ۱۶", "canonical_unit_id": unit_kg})
 check("POST /materials duplicate -> 409", r.status_code == 409 and r.json()["error"]["code"] == "CONFLICT", r.text[:200])
@@ -79,21 +101,32 @@ r = c.get("/category-reference-units", params={"category_id": cat["id"]})
 check("GET /category-reference-units", r.status_code == 200 and r.json()["data"][0]["ref_unit"] == "کیلوگرم")

 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
-check("POST /unit-conversions", r.status_code == 201, r.text[:200])
-uc = r.json()["data"]
+if r.status_code == 409:  # rerun — reuse the existing conversion
+    uc = next(x for x in c.get("/unit-conversions", params={"page_size": 100}).json()["data"]
+              if x["from_unit"] == "کیلوگرم" and x["to_unit"] == "متر" and x["category"]["id"] == cat["id"])
+    check("POST /unit-conversions (exists from previous run — 409 tolerated)", True)
+else:
+    check("POST /unit-conversions", r.status_code == 201, r.text[:200])
+    uc = r.json()["data"]
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
 check("POST /unit-conversions duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/unit-conversions/{uc['id']}", json={"factor": 9.5})
 check("PATCH /unit-conversions", r.status_code == 200 and r.json()["data"]["factor"] == 9.5)

 r = c.post("/standard-conversions", json={"from_unit": "تن", "to_unit": "کیلوگرم", "factor": 1000})
-check("POST /standard-conversions", r.status_code == 201, r.text[:200])
-sc_id = r.json()["data"]["id"]
+if r.status_code == 201:
+    sc_id = r.json()["data"]["id"]
+    check("POST /standard-conversions", True)
+else:  # rerun — reuse the existing conversion
+    sc_id = next(x["id"] for x in c.get("/standard-conversions", params={"page_size": 100}).json()["data"]
+                 if x["from_unit"] == "تن" and x["to_unit"] == "کیلوگرم")
+    check("POST /standard-conversions (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 r = c.get("/standard-conversions")
 check("GET /standard-conversions", r.status_code == 200 and r.json()["meta"]["total"] >= 1)

 # ---------- nested quote creation ----------
-material2 = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"}).json()["data"][0]
+_all_materials = c.get("/materials", params={"page_size": 100}).json()["data"]
+material2 = next(m for m in _all_materials if m["id"] != material["id"])
 r = c.post(
    "/quotes",
    json={
@@ -136,7 +169,11 @@ check("DELETE /quotes offered -> OK", r.status_code == 200 and r.json()["data"][
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                            "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
                            "termsheets": [], "item_termsheets": []})
-check("POST /quotes empty termsheets -> 400", r.status_code == 400 and r.json()["error"]["field"] == "termsheets")
+# current contract: termsheets are optional at quote level (item pricing
+# is driven by item_termsheets) — a quote without them is valid
+check("POST /quotes empty termsheets -> 201 (optional since v2.6)", r.status_code == 201, r.text[:200])
+if r.status_code == 201:
+    c.delete(f"/quotes/{r.json()['data']['id']}")

 r = c.post("/quotes", json={"supplier_id": sup["id"],
                            "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
@@ -244,33 +281,49 @@ check("GET receipt of rejected item -> 404", r.status_code == 404)
 r = c.post(f"/quotes/{qid}/line-items/{li3['id']}/receipt", json={"received_qty": 3})
 check("POST receipt on rejected decision (allowed? decision exists)", r.status_code in (201, 409), r.text[:200])

-# ---------- backward transition ----------
+# ---------- backward transition (v2.6 rule: quotes WITH inventory receipts
+# are immutable — they feed the stock ledger) ----------
 r = c.patch(f"/quotes/{qid}", json={"status": "offered", "notes": "بازگشت برای اصلاح"})
-check("PATCH backward accepted->offered", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+check(
+    "PATCH backward accepted->offered blocked after receipts",
+    r.status_code == 409 and "رسید" in r.json()["error"]["message"], r.text[:300],
+)
 r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
 decisions = [li["decision"]["status"] for li in r.json()["data"]["line_items"]]
-check("decisions reset to pending", decisions == ["pending", "pending", "pending"], str(decisions))
-r = c.get(f"/quotes/{qid}/termsheets")
+check("decisions unchanged after blocked revert", decisions == ["chosen", "chosen", "rejected"], str(decisions))
+
+# transition tests need a quote WITHOUT receipts — q3:
+q3 = c.post("/quotes", json={
+    "supplier_id": sup["id"], "project_id": proj["id"],
+    "quote_date": "2026-08-02T10:00:00Z", "expiry_date": "2026-08-20",
+    "line_items": [{"temp_id": "li-x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 2}],
+    "termsheets": [{"temp_id": "ts-x", "label": "نقدی", "schedule_steps": [{"due_date": "2026-08-10", "amount": 5000}]}],
+    "item_termsheets": [{"line_item_temp_id": "li-x", "termsheet_temp_id": "ts-x", "unit_price": 2500}],
+}).json()["data"]
+r = c.patch(f"/quotes/{q3['id']}/accept", json={
+    "accepted_termsheets": [{"id": q3["termsheets"][0]["id"],
+                             "schedule_steps": [{"step_no": 1, "due_date": "2026-08-10", "amount": 5000}]}],
+    "item_decisions": [{"line_item_id": q3["line_items"][0]["id"], "status": "chosen", "accepted_termsheet_index": 0, "adjusted_unit_price": 2500}],
+})
+check("q3 accept", r.status_code == 200, r.text[:300])
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
+check("PATCH backward accepted->offered (no receipts) -> OK", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+r = c.get(f"/quotes/{q3['id']}", params={"expand": "line_items"})
+check("decisions reset to pending", [li["decision"]["status"] for li in r.json()["data"]["line_items"]] == ["pending"], r.text[:200])
+r = c.get(f"/quotes/{q3['id']}/termsheets")
 check("termsheets demoted to offered", all(t["status"] == "offered" for t in r.json()["data"]), r.text[:200])
-r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
-receipts_kept = all(li.get("receipt") is not None for li in r.json()["data"]["line_items"] if li["decision"])
-check("item_receipts NOT deleted on revert", receipts_kept, r.text[:200])
-
-r = c.patch(f"/quotes/{qid}", json={"status": "accepted"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "accepted"})
 check("forward offered->accepted via PATCH -> 409", r.status_code == 409, r.text[:200])
-
-# ---------- reject / expire ----------
-r = c.patch(f"/quotes/{qid}/reject", json={"reason": "قیمت بالا"})
+r = c.patch(f"/quotes/{q3['id']}/reject", json={"reason": "قیمت بالا"})
 check("PATCH reject", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
-r = c.get(f"/quotes/{qid}/events")
+r = c.get(f"/quotes/{q3['id']}/events")
 check("reject reason in event payload", any(e["event_type"] == "rejected" and e["payload"].get("reason") == "قیمت بالا" for e in r.json()["data"]))
-
-r = c.patch(f"/quotes/{qid}", json={"status": "offered"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
 check("rejected->offered reopen", r.status_code == 200 and r.json()["data"]["status"] == "offered", r.text[:200])
-r = c.patch(f"/quotes/{qid}/expire")
+r = c.patch(f"/quotes/{q3['id']}/expire")
 check("PATCH expire", r.status_code == 200 and r.json()["data"]["status"] == "expired", r.text[:200])
-r = c.delete(f"/quotes/{qid}")
-check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 3, r.text[:300])
+r = c.delete(f"/quotes/{q3['id']}")
+check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 1, r.text[:300])

 # ---------- files ----------
 q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
@@ -280,8 +333,13 @@ q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
 files = {"file": ("proforma.pdf", b"%PDF-1.4 test", "application/pdf")}
 r = c.post(f"/quotes/{q2['id']}/proforma", files=files)
 check("POST proforma (any status)", r.status_code == 201 and r.json()["data"]["file_name"] == "proforma.pdf", r.text[:200])
+# current contract: attachments are allowed in EVERY status (files.py) —
+# the invoice can be attached from the edit page at any time
 r = c.post(f"/quotes/{q2['id']}/invoice", files=files)
-check("POST invoice on offered -> 409", r.status_code == 409, r.text[:200])
+check("POST invoice on offered (any-status contract)", r.status_code == 201, r.text[:200])
+inv_id = r.json()["data"]["id"]
+r = c.delete(f"/quotes/{q2['id']}/invoice/{inv_id}")
+check("DELETE test invoice", r.status_code == 200, r.text[:200])
 r = c.get(f"/quotes/{q2['id']}/proforma")
 lst = r.json()["data"]
 check("GET proforma list has 1", r.status_code == 200 and len(lst) == 1, r.text[:200])
@@ -293,8 +351,8 @@ check("DELETE proforma by id", r.status_code == 200 and r.json()["data"]["delete
 r = c.get(f"/quotes/{q2['id']}/proforma")
 check("GET proforma list empty after delete", r.status_code == 200 and r.json()["data"] == [], r.text[:200])

-# cleanup test material + supplier + project
-# q2 still references supplier/project/material -> all deletes must be blocked
+# ---------- cleanup ----------
+# q2 (offered) is deletable; qid is a receipts-protected artifact that stays.
 r = c.delete(f"/suppliers/{sup['id']}")
 check("DELETE supplier with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
@@ -302,14 +360,15 @@ check("DELETE project with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/materials/{material['id']}")
 check("DELETE material with line_items -> 409", r.status_code == 409, r.text[:200])

-r = c.delete(f"/quotes/{q2['id']}")  # q2 still references the test material
+r = c.delete(f"/quotes/{q2['id']}")
 check("cleanup: DELETE q2 quote", r.status_code == 200, r.text[:200])
+# qid (arrived, receipt-protected) still references everything -> protected
 r = c.delete(f"/materials/{material['id']}")
-check("DELETE material (no line_items refs)", r.status_code == 200, r.text[:200])
+check("DELETE material (still referenced by receipt-protected quote) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/suppliers/{sup['id']}")
-check("DELETE supplier (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE supplier (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
-check("DELETE project (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE project (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/unit-conversions/{uc['id']}")
 check("DELETE unit-conversion", r.status_code == 200)
 r = c.delete(f"/standard-conversions/{sc_id}")