harden telegram webapp production readiness

tests/test_entries.py

@@ -0,0 +1,89 @@
+import pytest
+
+
+@pytest.mark.asyncio
+async def test_user_cannot_add_fuel_to_foreign_car(client, auth_headers, other_auth_headers) -> None:
+    created = await client.post("/api/cars", headers=auth_headers, json={"name": "Owner car"})
+    car_id = created.json()["id"]
+
+    response = await client.post(
+        "/api/fuel",
+        headers=other_auth_headers,
+        json={
+            "car_id": car_id,
+            "entry_date": "2026-05-12",
+            "odometer": 1000,
+            "liters": 30,
+            "price_per_liter": 2,
+        },
+    )
+
+    assert response.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_fuel_crud(client, auth_headers) -> None:
+    car = (await client.post("/api/cars", headers=auth_headers, json={"name": "Fuel car"})).json()
+    created = await client.post(
+        "/api/fuel",
+        headers=auth_headers,
+        json={
+            "car_id": car["id"],
+            "entry_date": "2026-05-12",
+            "odometer": 1000,
+            "liters": 30,
+            "price_per_liter": 2,
+        },
+    )
+    assert created.status_code == 201
+    entry_id = created.json()["id"]
+
+    patched = await client.patch(
+        f"/api/fuel/{entry_id}",
+        headers=auth_headers,
+        json={"liters": 35, "price_per_liter": 3},
+    )
+
+    assert patched.status_code == 200
+    assert patched.json()["total_cost"] == "105.00"
+    deleted = await client.delete(f"/api/fuel/{entry_id}", headers=auth_headers)
+    assert deleted.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_service_crud(client, auth_headers) -> None:
+    car = (await client.post("/api/cars", headers=auth_headers, json={"name": "Service car"})).json()
+    created = await client.post(
+        "/api/service",
+        headers=auth_headers,
+        json={
+            "car_id": car["id"],
+            "entry_date": "2026-05-12",
+            "service_type": "maintenance",
+            "title": "Oil",
+            "total_cost": 100,
+        },
+    )
+    assert created.status_code == 201
+    entry_id = created.json()["id"]
+
+    patched = await client.patch(
+        f"/api/service/{entry_id}",
+        headers=auth_headers,
+        json={"title": "Oil and filter", "next_due_odometer": 2000},
+    )
+
+    assert patched.status_code == 200
+    assert patched.json()["title"] == "Oil and filter"
+    deleted = await client.delete(f"/api/service/{entry_id}", headers=auth_headers)
+    assert deleted.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_stats_do_not_fail_with_insufficient_data(client, auth_headers) -> None:
+    car = (await client.post("/api/cars", headers=auth_headers, json={"name": "Stats car"})).json()
+
+    response = await client.get(f"/api/cars/{car['id']}/stats", headers=auth_headers)
+
+    assert response.status_code == 200
+    assert response.json()["avg_consumption_l_per_100km"] is None