diff --git a/backend/app/tests/api/routes/test_users.py b/backend/app/tests/api/routes/test_users.py index 115c12a..427b5ed 100644 --- a/backend/app/tests/api/routes/test_users.py +++ b/backend/app/tests/api/routes/test_users.py @@ -437,3 +437,19 @@ def test_delete_user_current_super_user_error( ) assert r.status_code == 403 assert r.json()["detail"] == "Super users are not allowed to delete themselves" + + +def test_delete_user_without_privileges( + client: TestClient, normal_user_token_headers: dict[str, str], db: Session +) -> None: + username = random_email() + password = random_lower_string() + user_in = UserCreate(email=username, password=password) + user = crud.create_user(session=db, user_create=user_in) + + r = client.delete( + f"{settings.API_V1_STR}/users/{user.id}", + headers=normal_user_token_headers, + ) + assert r.status_code == 403 + assert r.json()["detail"] == "The user doesn't have enough privileges"