prvi kod za live uporabu

backend/core/users/tests/test_permissions.py

@@ -0,0 +1,37 @@
+# backend/core/users/tests/test_permissions.py
+
+import pytest
+from rest_framework import status
+from rest_framework.test import APIClient
+from django.contrib.auth import get_user_model
+
+User = get_user_model()
+
+@pytest.mark.django_db
+class TestUserPermissions:
+
+    def setup_method(self):
+        self.client = APIClient()
+        # Kreiramo dva korisnika
+        self.user1 = User.objects.create_user(email="user1@erp.hr", password="password123")
+        self.user2 = User.objects.create_user(email="user2@erp.hr", password="password123")
+
+    def test_user_cannot_edit_other_user(self):
+        """Osigurava da user1 ne može mijenjati podatke od user2."""
+        self.client.force_authenticate(user=self.user1)
+        
+        # Pokušavamo patchati user2 (pretpostavljamo URL /api/users/{id}/)
+        response = self.client.patch(f'/api/users/{self.user2.id}/', {"first_name": "Haker"})
+        
+        # Trebali bismo dobiti 403 Forbidden ili 404 (ovisno kako skrivaš postojanje drugih)
+        assert response.status_code in [status.HTTP_403_FORBIDDEN, status.HTTP_404_NOT_FOUND]
+
+    def test_authenticated_user_can_edit_self(self):
+        """Osigurava da user1 može mijenjati svoje podatke."""
+        self.client.force_authenticate(user=self.user1)
+        
+        response = self.client.patch(f'/api/users/{self.user1.id}/', {"first_name": "Ime"})
+        
+        assert response.status_code == status.HTTP_200_OK
+        self.user1.refresh_from_db()
+        assert self.user1.first_name == "Ime"