From 74c0672845eaeee3d61dc46d2304c48d5ae4186d Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Wed, 22 Jul 2026 18:06:32 +0530 Subject: [PATCH] [WEB-8333] test: exercise ROLE.MEMBER path in positive controls (Copilot #9461) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The positive-control tests authenticate as create_user, who was an ADMIN (role 20) member of project_b — so they exercised the ADMIN path, not MEMBER, despite the "member" docstrings. Make create_user a project MEMBER (role 15) so the positive controls validate the ROLE.MEMBER branch of @allow_permission on the newly-guarded handlers (all allow [ADMIN, MEMBER]; admin is covered elsewhere). Co-authored-by: Plane AI --- .../app/test_undecorated_route_project_scope_app.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/apps/api/plane/tests/contract/app/test_undecorated_route_project_scope_app.py b/apps/api/plane/tests/contract/app/test_undecorated_route_project_scope_app.py index 1dd3d70362..25a93e7981 100644 --- a/apps/api/plane/tests/contract/app/test_undecorated_route_project_scope_app.py +++ b/apps/api/plane/tests/contract/app/test_undecorated_route_project_scope_app.py @@ -66,7 +66,12 @@ def _make_user(email): @pytest.fixture def project_b(db, workspace, create_user): - """The victim project. ``create_user`` (workspace owner) is an active ADMIN member.""" + """The victim project. ``create_user`` is an active project MEMBER (role 15). + + Deliberately MEMBER, not ADMIN, so the positive-control tests exercise the + ROLE.MEMBER branch of @allow_permission on the newly-guarded handlers (admin + behavior is covered elsewhere). All the fixed decorators allow [ADMIN, MEMBER]. + """ project = Project.objects.create( name="Project B", identifier="PB", @@ -74,7 +79,7 @@ def project_b(db, workspace, create_user): created_by=create_user, ) ProjectMember.objects.create( - workspace=workspace, project=project, member=create_user, role=20, is_active=True + workspace=workspace, project=project, member=create_user, role=15, is_active=True ) return project