1919DateTimeAdapter  =  TypeAdapter (datetime )
2020
2121ROUTE  =  "validation" 
22+ ADMIN_ROUTE  =  "/admin/validation" 
2223MODEL  =  Validation 
2324TYPE  =  str (ActivityType .validation )
2425
@@ -319,8 +320,8 @@ def _is_deleted(db, model_id):
319320    return  db .get (MODEL , model_id ) is  None 
320321
321322
322- def  test_update_one (client , root_circuit , simulation_result , create_id ):
323-     gen1  =  create_id (
323+ def  test_update_one (client , client_admin ,  root_circuit , simulation_result , create_id ):
324+     entity_id  =  create_id (
324325        used_ids = [str (root_circuit .id )],
325326        generated_ids = [],
326327    )
@@ -332,11 +333,45 @@ def test_update_one(client, root_circuit, simulation_result, create_id):
332333        "generated_ids" : [str (simulation_result .id )],
333334    }
334335
335-     data  =  assert_request (client .patch , url = f"{ ROUTE } { gen1 }  , json = update_json ).json ()
336+     data  =  assert_request (client .patch , url = f"{ ROUTE } { entity_id }  , json = update_json ).json ()
337+     assert  DateTimeAdapter .validate_python (data ["end_time" ]) ==  end_time 
338+     assert  len (data ["generated" ]) ==  1 
339+     assert  data ["generated" ][0 ]["id" ] ==  str (simulation_result .id )
340+ 
341+     # only admin client can hit admin endpoint 
342+     data  =  assert_request (
343+         client .patch ,
344+         url = f"{ ADMIN_ROUTE } { entity_id }  ,
345+         json = update_json ,
346+         expected_status_code = 403 ,
347+     ).json ()
348+     assert  data ["error_code" ] ==  "NOT_AUTHORIZED" 
349+     assert  data ["message" ] ==  "Service admin role required" 
350+ 
351+     entity_id  =  create_id (
352+         used_ids = [str (root_circuit .id )],
353+         generated_ids = [],
354+     )
355+ 
356+     data  =  assert_request (
357+         client_admin .patch ,
358+         url = f"{ ADMIN_ROUTE } { entity_id }  ,
359+         json = update_json ,
360+     ).json ()
361+ 
336362    assert  DateTimeAdapter .validate_python (data ["end_time" ]) ==  end_time 
337363    assert  len (data ["generated" ]) ==  1 
338364    assert  data ["generated" ][0 ]["id" ] ==  str (simulation_result .id )
339365
366+     # admin is treated as regular user for regular route (no project context) 
367+     data  =  assert_request (
368+         client_admin .patch ,
369+         url = f"{ ROUTE } { entity_id }  ,
370+         json = update_json ,
371+         expected_status_code = 403 ,
372+     ).json ()
373+     assert  data ["error_code" ] ==  "NOT_AUTHORIZED" 
374+ 
340375
341376def  test_update_one__fail_if_generated_ids_unauthorized (
342377    client_user_1 , client_user_2 , json_data , species_id , brain_region_id 
0 commit comments