DRF API'ni APIClient bilan testlash: status, JSON va ruxsatlar

# apps/todos/models.py
from django.conf import settings
from django.db import models
from django.utils import timezone


class Task(models.Model):
    title = models.CharField(max_length=200)
    is_done = models.BooleanField(default=False)
    due_date = models.DateField(null=True, blank=True)
    owner = models.ForeignKey(
        settings.AUTH_USER_MODEL,
        on_delete=models.CASCADE,
        null=True,
        blank=True,
        related_name="tasks",
    )

    @property
    def is_overdue(self) -> bool:
        # muddat o'tgan va hali bajarilmagan — kechikkan
        if self.due_date is None or self.is_done:
            return False
        return self.due_date < timezone.localdate()

uv add djangorestframework
uv run python manage.py makemigrations todos

# config/urls.py
from django.contrib import admin
from django.urls import include, path
from rest_framework.routers import DefaultRouter

from apps.todos.api import TaskViewSet

router = DefaultRouter()
router.register("tasks", TaskViewSet, basename="task")

urlpatterns = [
    path("admin/", admin.site.urls),
    path("todos/", include("apps.todos.urls")),
    path("api/", include(router.urls)),
]

# apps/todos/serializers.py
from rest_framework import serializers

from apps.todos.models import Task


class TaskSerializer(serializers.ModelSerializer):
    class Meta:
        model = Task
        fields = ["id", "title", "is_done", "due_date"]

# apps/todos/api.py
from rest_framework import viewsets
from rest_framework.permissions import IsAuthenticated

from apps.todos.models import Task
from apps.todos.serializers import TaskSerializer


class TaskViewSet(viewsets.ModelViewSet):
    serializer_class = TaskSerializer
    permission_classes = [IsAuthenticated]  # API faqat kirgan foydalanuvchiga

    def get_queryset(self):
        # har kim faqat o'z vazifalarini ko'radi
        return Task.objects.filter(owner=self.request.user)

    def perform_create(self, serializer):
        serializer.save(owner=self.request.user)

# apps/todos/tests/conftest.py
import pytest
from django.contrib.auth.models import User
from rest_framework.test import APIClient


@pytest.fixture
def user(db):
    return User.objects.create_user("olim", password="sinov12345")


@pytest.fixture
def api(user):
    """Login qilgan holdagi API mijoz — testlar tayyor holda oladi."""
    client = APIClient()
    # sessiya/token bilan ovora bo'lmaymiz: autentifikatsiyani testlash
    # alohida mavzu, bu yerda esa API mantig'ini tekshiryapmiz
    client.force_authenticate(user=user)
    return client

# apps/todos/tests/test_api.py
from django.contrib.auth.models import User
from rest_framework.test import APIClient

from apps.todos.models import Task


def test_vazifa_yaratiladi(api):
    response = api.post("/api/tasks/", {"title": "Maqola yozish"}, format="json")

    assert response.status_code == 201
    data = response.json()
    assert data["title"] == "Maqola yozish"
    assert data["is_done"] is False  # default qiymat ham javobda to'g'ri
    assert Task.objects.count() == 1  # bazaga haqiqatan yozildi


def test_bosh_sarlavha_rad_etiladi(api):
    response = api.post("/api/tasks/", {"title": ""}, format="json")

    assert response.status_code == 400
    # xato aynan qaysi maydonda ekani ham javobda aytilgan bo'lishi kerak —
    # mobil/frontend jamoasi shu maydonga qarab xabar ko'rsatadi
    assert "title" in response.json()
    assert Task.objects.count() == 0


def test_kirmagan_foydalanuvchi_rad_etiladi(db):
    anonim = APIClient()  # force_authenticate YO'Q
    response = anonim.get("/api/tasks/")
    # DRF standart sozlamasida 403; token/JWT autentifikatsiyada 401 bo'ladi
    assert response.status_code == 403


def test_begona_vazifa_royxatda_korinmaydi(api):
    begona = User.objects.create_user("g'ani")
    Task.objects.create(title="Begonaning ishi", owner=begona)

    response = api.get("/api/tasks/")

    assert response.status_code == 200
    assert response.json() == []  # ro'yxat bo'sh — begonaniki chiqmadi


def test_begona_vazifani_ozgartirib_ham_ochirib_ham_bolmaydi(api):
    begona = User.objects.create_user("g'ani")
    task = Task.objects.create(title="Begonaning ishi", owner=begona)

    patch = api.patch(f"/api/tasks/{task.id}/", {"title": "buzildi"}, format="json")
    delete = api.delete(f"/api/tasks/{task.id}/")

    # 404, 403 emas: begona vazifa "taqiqlangan" emas, umuman "yo'q" —
    # uning mavjudligini ham oshkor qilmaymiz
    assert patch.status_code == 404
    assert delete.status_code == 404
    task.refresh_from_db()
    assert task.title == "Begonaning ishi"

    assert response.status_code == 201, response.content