Flatten budget-app contents into repo root

backend/tests/test_v6.py

@@ -0,0 +1,42 @@
+from tests.test_mail import configure, fake_mail  # noqa: F401  (fixture)
+from tests.test_v5 import approve, user
+
+
+def test_upper_management_views_downloads_and_emails_every_department(client, imported, fake_mail):
+    fb = client.post("/api/departments", json={"name": "F&B", "categories_from": "defaults"}).json()
+    other = client.post("/api/years", json={"department_id": fb["id"], "year": 2027}).json()["id"]
+    boss = user(client, "boss@t.local", "management", dept=None)
+    assert boss.get("/api/auth/me").json()["role"] == "management"
+    years = boss.get("/api/years").json()
+    assert {y["department_id"] for y in years} == {1, fb["id"]}
+    assert [y["id"] for y in boss.get(f"/api/years?department_id={fb['id']}").json()] == [other]
+    for year_id in (imported, other):
+        y = boss.get(f"/api/years/{year_id}").json()
+        assert not any(y["actions"].values()), y["actions"]
+        assert boss.get(f"/api/years/{year_id}/workbook.xlsx").status_code == 200
+        assert boss.get(f"/api/years/{year_id}/reports/cost-report.pdf").status_code == 200
+    configure(client)
+    r = boss.post(f"/api/years/{other}/email", json={"to": ["cfo@example.com"], "reports": [{"kind": "cost-report", "fmt": "pdf"}]})
+    assert r.status_code == 200, r.text
+
+
+def test_upper_management_changes_nothing(client, imported):
+    boss = user(client, "boss@t.local", "management", dept=1)  # even with a department
+    line = client.get(f"/api/years/{imported}").json()["categories"][0]["lines"][0]
+    assert boss.put(f"/api/lines/{line['id']}", json={"name": "x"}).status_code == 403
+    assert boss.post("/api/years", json={"year": 2032}).status_code == 403
+    assert boss.post(f"/api/years/{imported}/status", json={"action": "submit"}).status_code == 403
+    assert boss.delete(f"/api/years/{imported}").status_code == 403
+    assert boss.post("/api/categories", json={"department_id": 1, "name_en": "X"}).status_code == 403
+    assert boss.get("/api/users").status_code == 403 and boss.get("/api/activity").status_code == 403
+    # never an approver, even when named in a workflow step
+    me = boss.get("/api/auth/me").json()["id"]
+    client.put("/api/departments/1/workflow", json={"steps": [{"name": "Board", "approver_mode": "users", "approver_ids": [me]}]})
+    y = boss.get(f"/api/years/{imported}").json()
+    assert not y["actions"]["approve"]
+    # and does not ask for reopening: that is for the people who work on budgets
+    client.put("/api/departments/1/workflow", json={"steps": []})
+    approve(client, imported)
+    y = boss.get(f"/api/years/{imported}").json()
+    assert y["status"] == "approved" and not y["actions"]["request_reopen"]
+    assert boss.post(f"/api/years/{imported}/reopen-requests", json={"reason": "Quero rever"}).status_code == 403