Test a FastAPI resource-ownership boundary

• Create two users and at least one private document.
• Exercise the HTTP route, not the policy function alone.
• Override the principal dependency per test identity.
• Keep repository filtering and response serialization real.
• Clear overrides after every test.

1. Seed users A and B and a document owned by A.
2. Create a helper override returning the selected principal.
3. Assert the anonymous path before installing an override.
4. Run owner and cross-owner requests through the same client.
5. Assert both status and absence of private response data.

import pytest
from fastapi.testclient import TestClient

@pytest.fixture(autouse=True)
def clear_overrides(app):
    yield
    app.dependency_overrides.clear()

def as_user(app, user):
    app.dependency_overrides[current_principal] = lambda: Principal(user_id=user.id)

def test_document_ownership(app, client: TestClient, users, document):
    anonymous = client.get(f"/documents/{document.id}")
    assert anonymous.status_code == 401

    as_user(app, users.owner)
    own = client.get(f"/documents/{document.id}")
    assert own.status_code == 200
    assert own.json()["id"] == str(document.id)

    as_user(app, users.other)
    denied = client.get(f"/documents/{document.id}")
    assert denied.status_code == 404
    assert document.title not in denied.text

Each request should use one owner-scoped indexed lookup. The test cost is dominated by application and database fixture setup.

• A globally missing ID should follow the same privacy policy.
• Admin or support bypasses require separate explicit tests.
• Nested and list routes need the same owner scope.
• Cached responses must not cross user boundaries.

• Guess another valid document ID.
• Exercise a list endpoint and nested child route.
• Verify an override from one test cannot leak into another.
• Inspect response headers and body for resource existence leaks.

• Mocking the repository to return 404 proves nothing about real query scoping.
• Testing only the policy function misses route and dependency wiring.
• A 403 response may reveal existence when the stated policy is 404.
• Forgetting to clear dependency overrides creates order-dependent tests.