Add test for deleting tasks

Author: tpoliaw

src/blueapi/service/main.py

@@ -152,20 +152,24 @@ def get_app(config: ApplicationConfig):
     return app
 
 
-def access_task_permission(
+async def access_task_permission(
     opa: Annotated[OpaUserClient | None, Depends(opa)],
     task_id: str,
     fedid: Fedid,
     runner: Annotated[WorkerDispatcher, Depends(_runner)],
 ):
     task = runner.run(interface.get_task_by_id, task_id)
 
-    if opa and not opa.admin() and (task and fedid != task.task.metadata.get("user")):
+    if (
+        opa
+        and not await opa.admin()
+        and (task and fedid != task.task.metadata.get("user"))
+    ):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND)
 
 
 # start_task_permission is used when there is WorkerTask
-def start_task_permission(
+async def start_task_permission(
     task: WorkerTask,
     opa: Annotated[OpaUserClient, Depends(opa)],
     fedid: Fedid,
@@ -176,7 +180,7 @@ def start_task_permission(
             status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
             detail="No task id provided",
         )
-    access_task_permission(opa, task.task_id, fedid, runner)
+    await access_task_permission(opa, task.task_id, fedid, runner)
 
 
 async def on_key_error_404(_: Request, __: Exception):

tests/unit_tests/service/test_rest_api.py

@@ -21,7 +21,7 @@
     RestConfig,
 )
 from blueapi.core.bluesky_types import Plan
-from blueapi.service import main
+from blueapi.service import interface, main
 from blueapi.service.authorization import OpaUserClient, opa
 from blueapi.service.interface import (
     cancel_active_task,
@@ -479,6 +479,28 @@ def test_delete_submitted_task(mock_runner: Mock, client: TestClient) -> None:
     assert response.json() == {"task_id": f"{task_id}"}
 
 
+def test_cant_delete_other_users_task(
+    mock_runner: Mock,
+    client_with_opa: TestClient,
+    access_token: str,
+    mock_opa_client: Mock,
+):
+    mock_opa_client.admin.return_value = False
+    mock_runner.run.side_effect = lambda mth, *args: {
+        interface.get_task_by_id: TrackableTask(
+            task_id="bar", task=Task(name="t2", metadata={"user": "jd2"})
+        ),
+    }[mth]
+    client_with_opa.headers["Authorization"] = f"Bearer {access_token}"
+
+    resp = client_with_opa.delete("/tasks/bar")
+
+    # 404 to obfuscate whether task exists when inaccessible
+    assert resp.status_code == 404
+
+    mock_runner.run.assert_called_once()
+
+
 def test_set_active_task(client: TestClient) -> None:
     task_id = str(uuid.uuid4())
     task = WorkerTask(task_id=task_id)