Publish curated MobilityOps source snapshot

backend/tests/test_users.py

@@ -0,0 +1,44 @@
+def test_manager_can_create_and_update_user(ops_client):
+    created = ops_client.post(
+        "/api/v1/users",
+        json={
+            "email": "planner@example.test",
+            "display_name": "Fleet Planner",
+            "role": "rental_employee",
+            "password": "a-secure-demo-password",
+        },
+    )
+    assert created.status_code == 201
+    public_ref = created.json()["public_ref"]
+    assert created.json()["active"] is True
+    updated = ops_client.patch(
+        f"/api/v1/users/{public_ref}",
+        json={"display_name": "Senior Fleet Planner", "active": False},
+    )
+    assert updated.status_code == 200
+    assert updated.json()["display_name"] == "Senior Fleet Planner"
+    assert updated.json()["active"] is False
+    assert any(user["public_ref"] == public_ref for user in ops_client.get("/api/v1/users").json())
+
+
+def test_employee_cannot_manage_users(employee_client):
+    assert employee_client.get("/api/v1/users").status_code == 403
+    assert (
+        employee_client.post(
+            "/api/v1/users",
+            json={
+                "email": "unauthorised@example.test",
+                "display_name": "Unauthorised User",
+                "role": "rental_employee",
+                "password": "a-secure-demo-password",
+            },
+        ).status_code
+        == 403
+    )
+    assert (
+        employee_client.patch(
+            "/api/v1/users/USR-OPS",
+            json={"display_name": "Unauthorised Change"},
+        ).status_code
+        == 403
+    )