From 22d72f82f53e041f6a3a11ed44d00f0a88f8d7db Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Wed, 22 Jul 2026 08:45:00 +0200 Subject: [PATCH] test(campaign): require export authority for report email --- tests/test_report_email_security.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/test_report_email_security.py b/tests/test_report_email_security.py index 1f73b34..141bf0d 100644 --- a/tests/test_report_email_security.py +++ b/tests/test_report_email_security.py @@ -74,7 +74,10 @@ def test_report_jobs_csv_attachment_requires_recipient_export_permission() -> No def test_report_email_requires_permission_to_use_selected_mail_profile() -> None: payload = ReportEmailRequest(to=["recipient@example.test"]) - principal = SimpleNamespace(tenant_id="tenant-1") + principal = SimpleNamespace( + tenant_id="tenant-1", + has=lambda scope: scope == "campaigns:recipient:export", + ) campaign = SimpleNamespace(id="campaign-1", current_version_id="version-1") version = SimpleNamespace( id="version-1", @@ -106,7 +109,10 @@ def test_report_email_requires_permission_to_use_selected_mail_profile() -> None def test_unexpected_report_failure_does_not_leak_internal_details() -> None: payload = ReportEmailRequest(to=["recipient@example.test"]) - principal = SimpleNamespace(tenant_id="tenant-1") + principal = SimpleNamespace( + tenant_id="tenant-1", + has=lambda scope: scope == "campaigns:recipient:export", + ) with ( patch.object( router,