1
80%
main: 81%

Ran 13 May 2026 01:56PM UTC

Files 163

Run time 5s

Badge

Embed ▾

Committed 13 May 2026 01:20PM UTC coverage: 80.312% (+0.04%) from 80.273%

Job # 25801739746.1

Build Type

Pull #2163

github

Committed by

web-flow

Commit Message

fix: block non-admins from creating public assets; add regression tests

When account_id is absent from a POST /assets request body, Marshmallow
does not invoke the @validates("account_id") field validator, so the
inline `if account_id is not None:` guard silently skipped the permission
check. Any authenticated user could create a public (account-less) asset.

Fix: raise Forbidden when account_id is None and the caller is neither a
site admin nor CLI.

Add tests:
- test_regular_user_cannot_create_public_asset
- test_regular_user_cannot_create_child_of_public_asset

Update AGENTS.md: auth concerns must be covered by tests, not code
inspection alone.

Agent-Logs-Url: https://github.com/FlexMeasures/flexmeasures/sessions/b55c75f0-c9c5-4d45-9f17-4477d6cb4760

Co-authored-by: Flix6x <30658763+Flix6x@users.noreply.github.com>

Pull Request Pull Request #2163: Fix auth issues: child asset creation, account page access

Coverage Stats

12548 of 15624 relevant lines covered (80.31%)

0.8 hits per line

FlexMeasures / flexmeasures / 25801739746 / 1
80%
main: 81%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 25801739746.1

FlexMeasures / flexmeasures / 25801739746 / 1 80% main: 81%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 25801739746.1

FlexMeasures / flexmeasures / 25801739746 / 1
80%
main: 81%

README BADGES
x