Repository: aipotheosis-labs/aci
File: aipolabs/server/tests/routes/projects/test_projects_agents.py (Python)

Code before:
    }


def test_create_custom_instructions_nonexistent_agent(
    test_client: TestClient,
    db_session: Session,
    dummy_app_google: App,
    dummy_user_bearer_token: str,
) -> None:
    """Test that attempting to create custom instructions for a nonexistent agent returns 404"""
    # Generate a random UUID that doesn't exist in the database
    nonexistent_agent_id = uuid4()

    response = test_client.patch(
        f"{config.ROUTER_PREFIX_PROJECTS}/agents/{nonexistent_agent_id}",
        json={
            "custom_instructions": {
                str(dummy_app_google.id): "Custom instructions for nonexistent agent"
            }
        },
        headers={"Authorization": f"Bearer {dummy_user_bearer_token}"},
    )
    assert response.status_code == status.HTTP_404_NOT_FOUND


def test_create_custom_instructions_unauthorized_user(
    test_client: TestClient,
    db_session: Session,
    dummy_agent_1: Agent,
    dummy_app_google: App,
    dummy_user_2_bearer_token: str,  # Need to add this fixture
) -> None:
    """Test that unauthorized users cannot update custom instructions"""
    response = test_client.patch(
        f"{config.ROUTER_PREFIX_PROJECTS}/agents/{dummy_agent_1.id}",
        json={
            "custom_instructions": {
                str(dummy_app_google.id): "Custom instructions from unauthorized user"
            }
        },
        headers={"Authorization": f"Bearer {dummy_user_2_bearer_token}"},
    )
    assert response.status_code == status.HTTP_403_FORBIDDEN


def test_custom_instructions_restrictions(
    test_client: TestClient,
    db_session: Session,
    dummy_agent_1: Agent,
    dummy_app_google: App,
    dummy_user_bearer_token: str,

Review comment (security):
same as above, This shouldn't be a testcase on its own. access control checks apply to all updates to agent, either include this in your update agent test case or renaming this to test_update_agent_unauthorized_user

Code after:
    )
    response = test_client.patch(
        f"{config.ROUTER_PREFIX_PROJECTS}/{dummy_project_1.id}/agents/{nonexistent_agent_id}",
        json=body.model_dump(mode="json"),
        headers={"Authorization": f"Bearer {dummy_user_bearer_token}"},
    )
    assert response.status_code == status.HTTP_404_NOT_FOUND


def test_update_agent_unauthorized_user(
    test_client: TestClient,
    db_session: Session,
    dummy_project_1: Project,
    dummy_agent_1: Agent,
    dummy_app_google: App,
    dummy_user_2_bearer_token: str,  # Need to add this fixture
) -> None:
    """Test that unauthorized users cannot update custom instructions"""
    body = AgentUpdate(
        custom_instructions={dummy_app_google.id: "Custom Google instructions"},
    )
    response = test_client.patch(
        f"{config.ROUTER_PREFIX_PROJECTS}/{dummy_project_1.id}/agents/{dummy_agent_1.id}",
        json=body.model_dump(mode="json"),
        headers={"Authorization": f"Bearer {dummy_user_2_bearer_token}"},
    )
    assert response.status_code == status.HTTP_403_FORBIDDEN


def test_update_agent_custom_instructions_restrictions(
    test_client: TestClient,
    db_session: Session,
    dummy_project_1: Project,
    dummy_agent_1: Agent,
    dummy_app_google: App,
    dummy_user_bearer_token: str,
) -> None:
    """Test that custom instructions cannot be empty strings"""
    response = test_client.patch(
        f"{config.ROUTER_PREFIX_PROJECTS}/{dummy_project_1.id}/agents/{dummy_agent_1.id}",
        json={"custom_instructions": {str(dummy_app_google.id): ""}},
        headers={"Authorization": f"Bearer {dummy_user_bearer_token}"},
    )
    assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
    # Verify valid instructions still work
    body = AgentUpdate(
        custom_instructions={dummy_app_google.id: "Valid instructions"},
    )
    response = test_client.patch(
        f"{config.ROUTER_PREFIX_PROJECTS}/{dummy_project_1.id}/agents/{dummy_agent_1.id}",
        json=body.model_dump(mode="json"),