feat: Implement logic to prevent deletion of system tasks and rewards; update APIs and tests accordingly

backend/tests/test_task_api.py

@@ -1,16 +1,46 @@
 import pytest
 import os
+
 from flask import Flask
 from api.task_api import task_api
-from db.db import task_db, child_db
+from api.auth_api import auth_api
+from db.db import task_db, child_db, users_db
 from tinydb import Query
+import jwt
+
+
+# Test user credentials
+TEST_EMAIL = "testuser@example.com"
+TEST_PASSWORD = "testpass"
+
+def add_test_user():
+    users_db.remove(Query().email == TEST_EMAIL)
+    users_db.insert({
+        "id": "testuserid",
+        "first_name": "Test",
+        "last_name": "User",
+        "email": TEST_EMAIL,
+        "password": TEST_PASSWORD,
+        "verified": True,
+        "image_id": "boy01"
+    })
+
+def login_and_set_cookie(client):
+    resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
+    assert resp.status_code == 200
+    token = resp.headers.get("Set-Cookie")
+    assert token and "token=" in token
 
 @pytest.fixture
 def client():
     app = Flask(__name__)
     app.register_blueprint(task_api)
+    app.register_blueprint(auth_api)
     app.config['TESTING'] = True
+    app.config['SECRET_KEY'] = 'supersecretkey'
     with app.test_client() as client:
+        add_test_user()
+        login_and_set_cookie(client)
         yield client
 
 @pytest.fixture(scope="session", autouse=True)
@@ -39,8 +69,9 @@ def test_add_task(client):
 
 def test_list_tasks(client):
     task_db.truncate()
-    task_db.insert({'id': 't1', 'name': 'Task1', 'points': 5, 'is_good': True})
-    task_db.insert({'id': 't2', 'name': 'Task2', 'points': 15, 'is_good': False, 'image_id': 'meal'})
+    # Insert user-owned tasks
+    task_db.insert({'id': 't1', 'name': 'Task1', 'points': 5, 'is_good': True, 'user_id': 'testuserid'})
+    task_db.insert({'id': 't2', 'name': 'Task2', 'points': 15, 'is_good': False, 'image_id': 'meal', 'user_id': 'testuserid'})
     response = client.get('/task/list')
     assert response.status_code == 200
     assert b'tasks' in response.data
@@ -59,8 +90,8 @@ def test_delete_task_not_found(client):
     assert b'Task not found' in response.data
 
 def test_delete_assigned_task_removes_from_child(client):
-    # create task and child with the task already assigned
-    task_db.insert({'id': 't_delete_assigned', 'name': 'Temp Task', 'points': 5, 'is_good': True})
+    # create user-owned task and child with the task already assigned
+    task_db.insert({'id': 't_delete_assigned', 'name': 'Temp Task', 'points': 5, 'is_good': True, 'user_id': 'testuserid'})
     child_db.insert({
         'id': 'child_for_task_delete',
         'name': 'Frank',
@@ -69,15 +100,16 @@ def test_delete_assigned_task_removes_from_child(client):
         'tasks': ['t_delete_assigned'],
         'rewards': []
     })
-
     ChildQuery = Query()
-    # precondition: child has the task
+    # Ensure child has the user-owned task
+    child2 = child_db.search(ChildQuery.id == 'child_for_task_delete')[0]
+    if 't_delete_assigned' not in child2.get('tasks', []):
+        child2['tasks'] = ['t_delete_assigned']
+        child_db.update({'tasks': ['t_delete_assigned']}, ChildQuery.id == 'child_for_task_delete')
     assert 't_delete_assigned' in child_db.search(ChildQuery.id == 'child_for_task_delete')[0].get('tasks', [])
-
     # call the delete endpoint
     resp = client.delete('/task/t_delete_assigned')
     assert resp.status_code == 200
-
     # verify the task id is no longer in the child's tasks
     child = child_db.search(ChildQuery.id == 'child_for_task_delete')[0]
     assert 't_delete_assigned' not in child.get('tasks', [])