don't allow users to edit devices of other users

while device ids should be impossible to guess (being as long as oauth
tokens), we should still guard against malicious activity if they should
ever leak.

1 files changed, 11 insertions, 0 deletions

diff --git a/tests/conftest.py b/tests/conftest.py
index bf877e2..487eff9 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -55,6 +55,17 @@ def _account(client, primary, email, mail_server):
 email1 = f"test.account-{os.urandom(8).hex()}@test-auth"
 email2 = f"test.account2-{os.urandom(8).hex()}@test-auth"
 
+@pytest.fixture(scope="class")
+def account_plain(request, mail_server):
+    for a in _account(AuthClient(), True, email1, mail_server):
+        yield a
+        break
+@pytest.fixture(scope="class")
+def account2_plain(request, mail_server):
+    for a in _account(AuthClient(), True, email2, mail_server):
+        yield a
+        break
+
 @pytest.fixture(params=[True, False], ids=["primary", "secondary"], scope="class")
 def account(request, mail_server):
     for a in _account(AuthClient(), request.param, email1, mail_server):