ocmo-api 0.8.19__py3-none-any.whl

core/tests/test_tree_manager_for_item.py

@@ -0,0 +1,192 @@
+import json
+
+from django.core.exceptions import ValidationError
+from django.db import connection
+from django.test import TestCase
+from django.test.utils import CaptureQueriesContext
+
+from core.managers.tree import TreeManager
+from core.models import Config, TreeItem
+from core.tests.namespace_helpers import create_test_namespace
+
+
+class TreeManagerForItemTests(TestCase):
+    def setUp(self):
+        self.ns = create_test_namespace("for-item-test", description="test")
+        TreeManager(self.ns, "app/cfg1", auth=None).create_item("key: one\n", "config")
+        TreeManager(self.ns, "app/cfg2", auth=None).create_item("key: two\n", "config")
+        self.cfg1 = Config.objects.get(namespace=self.ns, path="app/cfg1")
+        self.folder = TreeItem.objects.get(namespace=self.ns, path="app", node_type="folder")
+
+    def test_for_item_matches_path_based_init(self):
+        by_path = TreeManager(self.ns, "app/cfg1", auth=None)
+        by_item = TreeManager.for_item(self.ns, self.cfg1, auth=None)
+
+        self.assertEqual(by_path.path, by_item.path)
+        self.assertEqual(by_path.item_type, by_item.item_type)
+        self.assertEqual(by_path.item.pk, by_item.item.pk)
+        self.assertEqual(
+            by_path.is_folder_resolvable,
+            by_item.is_folder_resolvable,
+        )
+
+    def test_for_item_accepts_folder_tree_item(self):
+        tm = TreeManager.for_item(self.ns, self.folder, auth=None)
+
+        self.assertEqual(tm.path, "app")
+        self.assertEqual(tm.item_type, "folder")
+        self.assertEqual(tm.item.node_type, "folder")
+
+    def test_for_item_rejects_namespace_mismatch(self):
+        other_ns = create_test_namespace("for-item-other", description="other")
+
+        with self.assertRaises(ValidationError):
+            TreeManager.for_item(other_ns, self.cfg1, auth=None)
+
+    def test_list_configs_under_folder_avoids_treeitem_refetch(self):
+        folder_tm = TreeManager.for_item(self.ns, self.folder, auth=None)
+
+        with CaptureQueriesContext(connection) as ctx:
+            configs = folder_tm.list_configs_under_folder(
+                ignore_configs_with_missing_tags=True,
+                version="latest",
+            )
+
+        self.assertEqual({cfg.path for cfg in configs}, {"app/cfg1", "app/cfg2"})
+        # One bulk config query plus per-config version tag resolution (no TreeManager.for_item N+1).
+        self.assertLessEqual(len(ctx.captured_queries), 3)
+
+    def test_delete_latest_tagged_version_updates_latest_pointer(self):
+        TreeManager(self.ns, "app/cfg1", auth=None).update_item("key: two\n")
+        cfg = Config.objects.get(namespace=self.ns, path="app/cfg1")
+        self.assertEqual(cfg.tags["latest"], 2)
+
+        TreeManager(self.ns, "app/cfg1", auth=None).delete_item(preview=False, version="2")
+
+        cfg.refresh_from_db()
+        self.assertEqual(cfg.tags["latest"], 1)
+        deleted_version = cfg.versions.get(version=2)
+        self.assertIsNotNone(deleted_version.deleted_at)
+
+    def test_delete_item_by_custom_tag(self):
+        TreeManager(self.ns, "app/cfg1", auth=None).update_item("key: two\n")
+        cfg = Config.objects.get(namespace=self.ns, path="app/cfg1")
+        cfg.tags["pinned"] = 2
+        cfg.save(update_fields=["tags"])
+
+        TreeManager(self.ns, "app/cfg1", auth=None).delete_item(preview=False, version="pinned")
+
+        deleted_version = cfg.versions.get(version=2)
+        self.assertIsNotNone(deleted_version.deleted_at)
+
+    def test_resolve_version_treats_deleted_version_as_not_found(self):
+        TreeManager(self.ns, "app/cfg1", auth=None).update_item("key: two\n")
+        TreeManager(self.ns, "app/cfg1", auth=None).delete_item(preview=False, version=2)
+
+        cfg = Config.objects.get(namespace=self.ns, path="app/cfg1")
+        cfg.tags["pinned"] = 2
+        cfg.save(update_fields=["tags"])
+
+        tm = TreeManager(self.ns, "app/cfg1", auth=None)
+
+        from core.exceptions import VersionNotFound
+
+        with self.assertRaises(VersionNotFound):
+            tm.resolve_version(cfg, "2")
+
+        with self.assertRaises(VersionNotFound):
+            tm.resolve_version(cfg, "pinned")
+
+    def test_move_single_config(self):
+        moved = TreeManager(self.ns, "app/cfg1", auth=None).move_item("moved/cfg1")
+
+        self.assertEqual(moved.path, "moved/cfg1")
+        self.assertEqual(moved.name, "cfg1")
+        self.assertTrue(Config.objects.filter(namespace=self.ns, path="moved/cfg1").exists())
+        self.assertFalse(Config.objects.filter(namespace=self.ns, path="app/cfg1").exists())
+        self.assertTrue(
+            TreeItem.objects.filter(namespace=self.ns, path="app", node_type="folder").exists(),
+            "sibling folder should keep parent folder alive",
+        )
+
+    def test_move_rename_in_same_folder_updates_name(self):
+        moved = TreeManager(self.ns, "app/cfg1", auth=None).move_item("app/cfg1-renamed")
+
+        self.assertEqual(moved.path, "app/cfg1-renamed")
+        self.assertEqual(moved.name, "cfg1-renamed")
+
+    def test_move_to_namespace_root_clears_parent(self):
+        moved = TreeManager(self.ns, "app/cfg1", auth=None).move_item("cfg1")
+
+        self.assertEqual(moved.path, "cfg1")
+        self.assertEqual(moved.name, "cfg1")
+        self.assertIsNone(moved.parent)
+
+    def test_move_folder_allows_destination_with_matching_suffix_segment(self):
+        TreeManager(self.ns, "tagtest/cfg", auth=None).create_item("key: x\n", "config")
+
+        moved = TreeManager(self.ns, "tagtest", auth=None).move_item("test/tagtest")
+
+        self.assertEqual(moved.path, "test/tagtest")
+        self.assertEqual(moved.name, "tagtest")
+        self.assertTrue(Config.objects.filter(namespace=self.ns, path="test/tagtest/cfg").exists())
+        self.assertFalse(TreeItem.objects.filter(namespace=self.ns, path="tagtest").exists())
+
+    def test_move_folder_rejects_move_into_descendant_path(self):
+        from core.exceptions import WrongMoveTargetException
+
+        with self.assertRaises(WrongMoveTargetException):
+            TreeManager(self.ns, "app", auth=None).move_item("app/sub")
+
+    def test_copy_config_to_full_destination_path(self):
+        result = TreeManager(self.ns, "app/cfg1", auth=None).copy_item("moved/cfg1")
+
+        self.assertIn("moved/cfg1", result["created"])
+        self.assertTrue(Config.objects.filter(namespace=self.ns, path="moved/cfg1").exists())
+        self.assertTrue(Config.objects.filter(namespace=self.ns, path="app/cfg1").exists())
+
+    def test_copy_folder_subtree(self):
+        result = TreeManager(self.ns, "app", auth=None).copy_item("moved/app")
+
+        self.assertIn("moved/app/cfg1", result["created"])
+        self.assertIn("moved/app/cfg2", result["created"])
+        self.assertTrue(Config.objects.filter(namespace=self.ns, path="moved/app/cfg1").exists())
+        self.assertTrue(Config.objects.filter(namespace=self.ns, path="moved/app/cfg2").exists())
+
+    def test_copy_resolver_to_new_path(self):
+        from core.models import Resolver
+
+        TreeManager(self.ns, "app/svc", auth=None).create_item('{"scope":"app"}', "resolver")
+        source = Resolver.objects.get(namespace=self.ns, path="app/svc")
+
+        result = TreeManager(self.ns, "app/svc", auth=None).copy_item("other/svc")
+
+        self.assertIn("other/svc", result["created"])
+        copied = Resolver.objects.get(namespace=self.ns, path="other/svc")
+        self.assertEqual(copied.configuration, source.configuration)
+        self.assertTrue(Resolver.objects.filter(namespace=self.ns, path="app/svc").exists())
+        self.assertIsNotNone(copied.token1_lookup)
+        self.assertNotEqual(copied.token1_lookup, source.token1_lookup)
+
+    def test_delete_custom_config_tag(self):
+        from core.schemas.requests import TagPayload
+
+        TreeManager(self.ns, "app/cfg1", auth=None).set_item_tag(
+            TagPayload(tag="demo", version=1),
+        )
+        TreeManager(self.ns, "app/cfg1", auth=None).delete_config_tag("demo")
+
+        cfg = Config.objects.get(namespace=self.ns, path="app/cfg1")
+        self.assertNotIn("demo", cfg.tags)
+
+    def test_update_resolver_configuration(self):
+        TreeManager(self.ns, "app/svc", auth=None).create_item("{}", "resolver")
+
+        updated = TreeManager(self.ns, "app/svc", auth=None).update_item(
+            '{"cast": {"format": "raw"}}',
+        )
+
+        self.assertEqual(
+            json.loads(updated.configuration),
+            {"cast": {"format": "raw"}},
+        )

core/tests/test_two_layer_cache.py

@@ -0,0 +1,334 @@
+"""Unit tests for the two-layer resolve cache.
+
+Covers:
+- L1 hit when only the cast format differs (no pipeline run).
+- L1 hit writes L2 so the next identical-cast request is a pure L2 hit.
+- Secret-bearing resolutions skip L1 (different cast forces a full pipeline run).
+- _cache_status returns correct tier string.
+"""
+
+from unittest.mock import patch
+
+from django.core.cache import caches
+from django.test import Client, TestCase, override_settings
+
+from core.managers.resolution import ResolutionManager
+from core.managers.tree import TreeManager
+from core.tests.namespace_helpers import create_test_namespace
+from core.utils.permissions_compiler import PermissionsCompiler
+
+_TEST_MASTER_KEY = "ZDPuvW6Hx/1UxDK7K/CydLouVKtJl24nbHyb2EkvTzs="
+
+_CACHE_HEADER = "X-Ocmo-Resolve-Cache"
+
+
+class TwoLayerCacheApiTests(TestCase):
+    """Integration-style tests exercising the cache via the HTTP API."""
+
+    def setUp(self):
+        caches["resolve"].clear()
+        self.client = Client()
+        self.ns = create_test_namespace("twolayer-test", description="test")
+        self._create_config("app/cfg", "key: value\nnum: 1\n")
+
+    def _create_config(self, path: str, body: str):
+        r = self.client.post(
+            f"/api/v1/ns/{self.ns.name}/~config/~create/{path}",
+            data=body.encode(),
+            content_type="application/yaml",
+        )
+        self.assertEqual(r.status_code, 201, r.content)
+
+    def _resolve(self, path: str, **params):
+        from urllib.parse import urlencode
+
+        qs = urlencode(params)
+        url = f"/api/v1/ns/{self.ns.name}/~resolve/{path}"
+        if qs:
+            url += f"?{qs}"
+        return self.client.get(url)
+
+    def _cache_header(self, response) -> str | None:
+        return response.get(_CACHE_HEADER)
+
+    # ------------------------------------------------------------------
+
+    def test_second_resolve_same_cast_is_l2_hit(self):
+        """Baseline: two identical resolves → second is a full L2 hit."""
+        r1 = self._resolve("app/cfg", cast="json")
+        self.assertEqual(r1.status_code, 200, r1.content)
+
+        r2 = self._resolve("app/cfg", cast="json")
+        self.assertEqual(r2.status_code, 200, r2.content)
+
+        self.assertEqual(self._cache_header(r1), "miss")
+        self.assertEqual(self._cache_header(r2), "hit")
+
+    def test_different_cast_uses_l1_no_pipeline(self):
+        """After warm with cast=yaml, requesting cast=json skips the pipeline (L1 hit)."""
+        # Warm cache with default (yaml) cast.
+        r1 = self._resolve("app/cfg")
+        self.assertEqual(r1.status_code, 200, r1.content)
+        self.assertEqual(self._cache_header(r1), "miss")
+
+        # Request a different cast format — should hit L1, not run the pipeline.
+        with patch(
+            "core.managers.resolution.ResolvePipelineManager.resolve",
+            wraps=None,
+        ) as mock_pipeline:
+            mock_pipeline.side_effect = AssertionError("Pipeline should not have been called on an L1 hit")
+            r2 = self._resolve("app/cfg", cast="json")
+
+        self.assertEqual(r2.status_code, 200, r2.content)
+        self.assertEqual(self._cache_header(r2), "cast")
+
+    def test_l1_hit_writes_l2_so_third_call_is_hit(self):
+        """L1 hit populates L2; the next identical request is a pure L2 hit."""
+        # 1st call: full pipeline, warms L1.
+        r1 = self._resolve("app/cfg")
+        self.assertEqual(self._cache_header(r1), "miss")
+
+        # 2nd call: different cast → L1 hit, writes L2.
+        r2 = self._resolve("app/cfg", cast="json")
+        self.assertEqual(self._cache_header(r2), "cast")
+
+        # 3rd call: same cast as 2nd → L2 hit.
+        r3 = self._resolve("app/cfg", cast="json")
+        self.assertEqual(self._cache_header(r3), "hit")
+
+    def test_different_cast_produces_different_content(self):
+        """Resolving the same config with different casts yields different content."""
+        r_yaml = self._resolve("app/cfg", cast="yaml")
+        self.assertEqual(r_yaml.status_code, 200)
+
+        r_json = self._resolve("app/cfg", cast="json")
+        self.assertEqual(r_json.status_code, 200)
+
+        checksum_yaml = r_yaml.json()["items"][0]["checksum"]
+        checksum_json = r_json.json()["items"][0]["checksum"]
+        self.assertNotEqual(checksum_yaml, checksum_json)
+
+
+_EXTEND_YAML = """\
+_ocmo:
+  extend:
+    mode: accumulate
+    configs:
+      - ../shared/base@latest
+key: child
+"""
+
+
+@override_settings(OCMO_MASTER_KEY=_TEST_MASTER_KEY)
+class CacheHitParticipantPermissionTests(TestCase):
+    """L1/L2 cache hits re-check permissions on all participants."""
+
+    def setUp(self):
+        caches["resolve"].clear()
+        PermissionsCompiler._policy_cache.clear()
+        self.client = Client()
+        self.ns = create_test_namespace("cache-participant-perm", description="test")
+        TreeManager(self.ns, "shared/base", auth=None).create_item("base: true\n", "config")
+        TreeManager(self.ns, "app/cfg", auth=None).create_item(_EXTEND_YAML, "config")
+
+    def _resolve(self, path: str, **params):
+        from urllib.parse import urlencode
+
+        qs = urlencode(params)
+        url = f"/api/v1/ns/{self.ns.name}/~resolve/{path}"
+        if qs:
+            url += f"?{qs}"
+        return self.client.get(url)
+
+    def test_l1_cast_hit_denies_when_nested_permission_revoked(self):
+        """L1 hit still enforces config:resolve on extend participants."""
+        r1 = self._resolve("app/cfg")
+        self.assertEqual(r1.status_code, 200, r1.content)
+        self.assertEqual(r1.get(_CACHE_HEADER), "miss")
+
+        r2 = self._resolve("app/cfg", cast="json")
+        self.assertEqual(r2.status_code, 200, r2.content)
+        self.assertEqual(r2.get(_CACHE_HEADER), "cast")
+
+        TreeManager(self.ns, "_permissions", auth=None).update_item(
+            """\
+policies:
+  - effect: Allow
+    actors:
+      - kind: User
+        claims:
+          email: "*"
+    actions:
+      - config:resolve
+    resources:
+      - app/**
+"""
+        )
+        PermissionsCompiler._policy_cache.clear()
+
+        r3 = self._resolve("app/cfg", cast="json")
+        self.assertEqual(r3.status_code, 403, r3.content)
+
+
+@override_settings(OCMO_MASTER_KEY=_TEST_MASTER_KEY)
+class SecretBearingCacheTests(TestCase):
+    """Secret-bearing resolutions must not be stored at Layer 1."""
+
+    def setUp(self):
+        caches["resolve"].clear()
+        self.client = Client()
+        self.ns = create_test_namespace("secret-cache-test", description="test")
+        # Create a secret with a version.
+        r = self.client.post(
+            f"/api/v1/ns/{self.ns.name}/~secret/~create/creds/db",
+            data=b"password: hunter2\n",
+            content_type="application/yaml",
+        )
+        self.assertEqual(r.status_code, 201, r.content)
+        # Config references the secret via a parameter.
+        cfg_body = (
+            "_ocmo:\n"
+            "  parameters:\n"
+            "    db_password:\n"
+            "      type: secret\n"
+            "      value: creds/db@latest\n"
+            "      description: Database password\n"
+            "db_pass: '{!db_password}'\n"
+        )
+        r2 = self.client.post(
+            f"/api/v1/ns/{self.ns.name}/~config/~create/app/secret-cfg",
+            data=cfg_body.encode(),
+            content_type="application/yaml",
+        )
+        self.assertEqual(r2.status_code, 201, r2.content)
+
+    def _resolve(self, cast: str | None = None):
+        url = f"/api/v1/ns/{self.ns.name}/~resolve/app/secret-cfg"
+        if cast:
+            url += f"?cast={cast}"
+        return self.client.get(url)
+
+    def test_secret_config_different_cast_reruns_pipeline(self):
+        """Secret-bearing config: changing cast must run the full pipeline (no L1)."""
+        r1 = self._resolve()
+        self.assertEqual(r1.status_code, 200, r1.content)
+        self.assertEqual(r1.get(_CACHE_HEADER), "miss")
+
+        # Different cast should be a miss, not 'cast', because L1 was skipped.
+        r2 = self._resolve(cast="json")
+        self.assertEqual(r2.status_code, 200, r2.content)
+        self.assertEqual(r2.get(_CACHE_HEADER), "miss")
+
+
+@override_settings(OCMO_MASTER_KEY=_TEST_MASTER_KEY)
+class NoCredsCacheTests(TestCase):
+    """no-creds resolutions skip secret participants and may use Layer 1."""
+
+    def setUp(self):
+        caches["resolve"].clear()
+        self.client = Client()
+        self.ns = create_test_namespace("nocreds-cache-test", description="test")
+        r = self.client.post(
+            f"/api/v1/ns/{self.ns.name}/~secret/~create/creds/db",
+            data=b"password: hunter2\n",
+            content_type="application/yaml",
+        )
+        self.assertEqual(r.status_code, 201, r.content)
+        cfg_body = (
+            "_ocmo:\n"
+            "  parameters:\n"
+            "    db_password:\n"
+            "      type: secret\n"
+            "      value: creds/db@latest\n"
+            "      description: Database password\n"
+            "db_pass: '{!db_password}'\n"
+        )
+        r2 = self.client.post(
+            f"/api/v1/ns/{self.ns.name}/~config/~create/app/secret-cfg",
+            data=cfg_body.encode(),
+            content_type="application/yaml",
+        )
+        self.assertEqual(r2.status_code, 201, r2.content)
+
+    def _resolve(self, **params):
+        from urllib.parse import urlencode
+
+        qs = urlencode(params)
+        url = f"/api/v1/ns/{self.ns.name}/~resolve/app/secret-cfg"
+        if qs:
+            url += f"?{qs}"
+        return self.client.get(url)
+
+    def test_no_creds_secret_config_uses_l1_cache(self):
+        """no-creds: changing cast hits L1 (cast header), unlike full secret resolve."""
+        r1 = self._resolve(**{"no-creds": "true"})
+        self.assertEqual(r1.status_code, 200, r1.content)
+        self.assertEqual(r1.get(_CACHE_HEADER), "miss")
+
+        r2 = self._resolve(**{"no-creds": "true", "cast": "json"})
+        self.assertEqual(r2.status_code, 200, r2.content)
+        self.assertEqual(r2.get(_CACHE_HEADER), "cast")
+
+    def test_no_creds_cache_key_separate_from_full_resolve(self):
+        r_full = self._resolve()
+        self.assertEqual(r_full.status_code, 200, r_full.content)
+        checksum_full = r_full.json()["items"][0]["checksum"]
+
+        r_nocreds = self._resolve(**{"no-creds": "true"})
+        self.assertEqual(r_nocreds.status_code, 200, r_nocreds.content)
+        checksum_nocreds = r_nocreds.json()["items"][0]["checksum"]
+        self.assertNotEqual(checksum_full, checksum_nocreds)
+
+        r_nocreds2 = self._resolve(**{"no-creds": "true"})
+        self.assertEqual(r_nocreds2.get(_CACHE_HEADER), "hit")
+        self.assertEqual(
+            r_nocreds2.json()["items"][0]["checksum"],
+            checksum_nocreds,
+        )
+
+
+from django.test import SimpleTestCase
+
+
+class CacheKeyUnitTests(SimpleTestCase):
+    def test_no_creds_changes_resolution_key(self):
+        from core.managers.resolve_cache import ResolveCacheManager
+
+        k_false = ResolveCacheManager.make_resolution_key("ns", "path", "latest", {}, no_creds=False)
+        k_true = ResolveCacheManager.make_resolution_key("ns", "path", "latest", {}, no_creds=True)
+        self.assertNotEqual(k_false, k_true)
+
+    def test_no_creds_changes_artifact_key(self):
+        from core.managers.resolve_cache import ResolveCacheManager
+
+        k_false = ResolveCacheManager.make_artifact_key("ns", "path", "latest", "yaml", {}, {}, no_creds=False)
+        k_true = ResolveCacheManager.make_artifact_key("ns", "path", "latest", "yaml", {}, {}, no_creds=True)
+        self.assertNotEqual(k_false, k_true)
+
+
+class CacheStatusUnitTests(SimpleTestCase):
+    """Unit tests for ResolutionManager._cache_status (no DB required)."""
+
+    def _status(self, cache_values: list[str]) -> str:
+        items = [{"_cache": v} for v in cache_values]
+        return ResolutionManager._cache_status(items)
+
+    def test_empty_is_miss(self):
+        self.assertEqual(ResolutionManager._cache_status([]), "miss")
+
+    def test_all_hit(self):
+        self.assertEqual(self._status(["hit", "hit"]), "hit")
+
+    def test_all_cast(self):
+        self.assertEqual(self._status(["cast", "cast"]), "cast")
+
+    def test_all_miss(self):
+        self.assertEqual(self._status(["miss"]), "miss")
+
+    def test_mixed_hit_and_cast_is_cast(self):
+        # All served from cache (no pipeline), but some re-cast → 'cast'.
+        self.assertEqual(self._status(["hit", "cast"]), "cast")
+
+    def test_any_miss_dominates(self):
+        self.assertEqual(self._status(["hit", "miss"]), "miss")
+        self.assertEqual(self._status(["cast", "miss"]), "miss")

core/tests/test_url_trailing_slashes.py

@@ -0,0 +1,53 @@
+"""Static audit: API route paths follow the trailing-slash URL convention."""
+
+import pathlib
+import re
+
+from django.test import SimpleTestCase
+
+_API_DIR = pathlib.Path(__file__).resolve().parent.parent / "api"
+_ROUTE_DECORATOR = re.compile(r'@router\.(get|post|put|patch|delete)\(\s*(?:\n\s*)?["\']([^"\']+)["\']')
+
+
+def _iter_registered_route_paths():
+    for path in sorted(_API_DIR.glob("*.py")):
+        if path.name.startswith("_"):
+            continue
+        for match in _ROUTE_DECORATOR.finditer(path.read_text()):
+            yield match.group(2)
+
+
+def _ends_in_path_param(route_path: str) -> bool:
+    last_segment = route_path.rstrip("/").split("/")[-1]
+    return last_segment.startswith("{") and last_segment.endswith("}")
+
+
+_NO_TRAILING_SLASH_ROUTES = frozenset(
+    {
+        "/health",
+        "/version",
+        "/~config-metadata-schema",
+        "/~resolver-configuration-schema",
+    }
+)
+
+
+def _should_have_trailing_slash(route_path: str) -> bool:
+    if route_path in _NO_TRAILING_SLASH_ROUTES:
+        return False
+    return not _ends_in_path_param(route_path)
+
+
+class ApiTrailingSlashConventionTests(SimpleTestCase):
+    def test_all_routes_follow_trailing_slash_rule(self):
+        violations = []
+        for route_path in _iter_registered_route_paths():
+            should_have_slash = _should_have_trailing_slash(route_path)
+            has_slash = route_path.endswith("/")
+            if has_slash != should_have_slash:
+                violations.append(f"{route_path!r}: has_trailing_slash={has_slash}, expected={should_have_slash}")
+        self.assertEqual(
+            violations,
+            [],
+            "Route paths must end with '/' for collections/actions only:\n" + "\n".join(violations),
+        )

core/tests/test_validation_error_responses.py

@@ -0,0 +1,43 @@
+"""Integration tests for API validation error responses."""
+
+import json
+
+from django.test import TestCase
+
+from core.tests.auth_helpers import authenticated_as
+
+
+class TestValidationErrorResponses(TestCase):
+    def test_namespace_create_returns_field_specific_messages(self) -> None:
+        with authenticated_as():
+            response = self.client.post(
+                "/api/v1/ns/",
+                data=json.dumps({"name": "bad name!", "description": ""}),
+                content_type="application/json",
+            )
+
+        self.assertEqual(response.status_code, 422, response.content)
+        payload = response.json()
+        self.assertIn("error", payload)
+        self.assertIsInstance(payload["error"], list)
+        self.assertEqual(payload["errors"], payload["error"])
+        self.assertTrue(
+            any("name:" in message for message in payload["error"]),
+            payload["error"],
+        )
+
+    def test_can_i_rejects_invalid_operation_with_field_message(self) -> None:
+        with authenticated_as():
+            response = self.client.post(
+                "/api/v1/auth/can-i/",
+                data=json.dumps({"operations": ["not-an-operation"]}),
+                content_type="application/json",
+            )
+
+        self.assertEqual(response.status_code, 422, response.content)
+        payload = response.json()
+        self.assertIsInstance(payload["error"], list)
+        self.assertTrue(
+            any("operations" in message for message in payload["error"]),
+            payload["error"],
+        )