FlexMeasures / flexmeasures / 25801739746

80%

main: 81%

Build Type

Pull #2163

github

Committed by web-flow

Commit Message

fix: block non-admins from creating public assets; add regression tests

When account_id is absent from a POST /assets request body, Marshmallow
does not invoke the @validates("account_id") field validator, so the
inline `if account_id is not None:` guard silently skipped the permission
check. Any authenticated user could create a public (account-less) asset.

Fix: raise Forbidden when account_id is None and the caller is neither a
site admin nor CLI.

Add tests:
- test_regular_user_cannot_create_public_asset
- test_regular_user_cannot_create_child_of_public_asset

Update AGENTS.md: auth concerns must be covered by tests, not code
inspection alone.

Agent-Logs-Url: https://github.com/FlexMeasures/flexmeasures/sessions/b55c75f0-c9c5-4d45-9f17-4477d6cb4760

Co-authored-by: Flix6x <30658763+Flix6x@users.noreply.github.com>

Pull Request Pull Request #2163: Fix auth issues: child asset creation, account page access

Coverage Stats

18 of 20 new or added lines in 2 files covered. (90.0%)

4 existing lines in 2 files now uncovered.

12548 of 15624 relevant lines covered (80.31%)

0.8 hits per line