fix all pylint warnings, add tests (wip) fix recap

backend/src/users/service.py

@@ -1,7 +1,6 @@
-import src.messages as messages
 import src.users.exceptions as exceptions
 from sqlmodel import Session, select
-from src import models
+from src import messages, models
 
 
 def get_all(
@@ -48,7 +47,8 @@ def get_or_create_user(session: Session, user_create: models.UserCreate):
     user = session.exec(statement).first()
     if user:
         user_role_names = [r.name for r in user.roles]
-        if user_role_names != user_create.role_names or user.name != user_create.name:
+        if (user_role_names != user_create.role_names or
+            user.name != user_create.name):
             user = update_one(session, user.id, user_create)
         return user
     user = create_one(session, user_create)
@@ -119,3 +119,9 @@ def delete_one(session: Session, _id: int) -> models.UserPublic:
     session.delete(user)
     session.commit()
     return result
+
+
+def is_allowed(
+    logged_user: models.User,
+):
+    return len(logged_user.roles) >= 5

backend/src/users/users.py

@@ -1,9 +1,8 @@
-import src.messages as messages
 import src.users.exceptions as exceptions
 import src.users.service as service
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlmodel import Session
-from src import models
+from src import messages, models
 from src.auth.auth import get_current_user
 from src.database import get_session
 
@@ -13,7 +12,7 @@ router = APIRouter(prefix='/users')
 @router.get('', response_model=list[models.UserPublic])
 def get_users(
     session: Session = Depends(get_session),
-    user: models.User = Depends(get_current_user),
+    _: models.User = Depends(get_current_user),
     names: list[str] = Query([]),
     emails: list[str] = Query([]),
 ):
@@ -29,6 +28,11 @@ def get_roles(
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
+    if not service.is_allowed(user):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('roles', 'get all')
+        )
     return service.get_roles(session)
 
 
@@ -38,6 +42,11 @@ def get_user(
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
+    if not service.is_allowed(user):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('user', 'get')
+        )
     result = service.get_one(session, _id)
     if result is None:
         raise HTTPException(
@@ -53,11 +62,16 @@ def create_user(
     logged_user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
+    if not service.is_allowed(logged_user):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('user', 'create')
+        )
     try:
         user = service.create_one(session, user)
     except exceptions.UserCreateError as error:
         raise HTTPException(
-            status_code=400, 
+            status_code=400,
             detail=str(error)
         ) from error
     return user
@@ -70,6 +84,11 @@ def update_user(
     logged_user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
+    if not service.is_allowed(logged_user):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('user', 'update')
+        )
     try:
         result = service.update_one(session, _id, user)
     except exceptions.UserNotFoundError as error:
@@ -80,14 +99,19 @@ def update_user(
     return result
 
 
-@router.delete('/{id}', response_model=models.UserPublic)
+@router.delete('/{_id}', response_model=models.UserPublic)
 def delete_user(
-    id: int,
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
+    if not service.is_allowed(user):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('user', 'delete')
+        )
     try:
-        result = service.delete_one(session, id)
+        result = service.delete_one(session, _id)
     except exceptions.UserNotFoundError as error:
         raise HTTPException(
             status_code=404,