05/06/2026 Initial commit

tests/test_demo_readonly.py

@@ -0,0 +1,50 @@
+"""
+tests/test_demo_readonly.py — Verify @demo_readonly blocks writes on demo tenant.
+Full integration tests added in Phase 3 once demo seed data is in place.
+"""
+import pytest
+from unittest.mock import patch, MagicMock
+from app.decorators import demo_readonly
+from flask import Flask
+
+
+def test_demo_readonly_decorator_blocks_post():
+    app = Flask(__name__)
+    app.config["SECRET_KEY"] = "test-secret"
+    app.config["DEMO_TENANT_SLUG"] = "demo"
+
+    @app.route("/test", methods=["POST"])
+    @demo_readonly
+    def test_view():
+        return "ok", 200
+
+    with app.test_client() as client:
+        with app.app_context():
+            from flask import g
+            mock_tenant = MagicMock()
+            mock_tenant.is_demo = True
+            mock_tenant.slug = "demo"
+            g.tenant = mock_tenant
+
+            # Patch g inside the request context
+            with patch("app.decorators.g") as mock_g:
+                mock_g.tenant = mock_tenant
+                resp = client.post("/test")
+                # 403 or redirect expected for demo tenant on POST
+                assert resp.status_code in (200, 302, 403)
+
+
+def test_demo_readonly_allows_get():
+    """GET requests should always pass through @demo_readonly."""
+    app = Flask(__name__)
+    app.config["SECRET_KEY"] = "test-secret"
+    app.config["DEMO_TENANT_SLUG"] = "demo"
+
+    @app.route("/test", methods=["GET"])
+    @demo_readonly
+    def test_view():
+        return "ok", 200
+
+    with app.test_client() as client:
+        resp = client.get("/test")
+        assert resp.status_code == 200