feat: expand platform APIs, sources, and test coverage

tests/apps/registers/test_views.py

@@ -61,6 +61,7 @@ def _extract_results(response_data):
 class RegistersViewsTest(APITestCase):
     def setUp(self):
         self.user = UserFactory.create_user()
+        self.admin = UserFactory.create_user(is_staff=True)
         self.client.force_authenticate(self.user)
 
     def _post_upload(
@@ -72,6 +73,7 @@ class RegistersViewsTest(APITestCase):
         with_kpp: bool = True,
         file_name: str = "registry.xlsx",
     ):
+        self.client.force_authenticate(self.admin)
         content = _build_register_excel_bytes(rows, with_kpp=with_kpp)
         upload = SimpleUploadedFile(
             file_name,
@@ -80,7 +82,7 @@ class RegistersViewsTest(APITestCase):
                 "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
             ),
         )
-        return self.client.post(
+        response = self.client.post(
             reverse("api_v1:registers:register-upload"),
             {
                 "registry": str(registry.id),
@@ -89,6 +91,8 @@ class RegistersViewsTest(APITestCase):
             },
             format="multipart",
         )
+        self.client.force_authenticate(self.user)
+        return response
 
     def test_registries_list_and_retrieve(self):
         registry = RegisterFactory(name="Росатом")
@@ -148,8 +152,12 @@ class RegistersViewsTest(APITestCase):
         organization_old = OrganizationFactory()
         organization_current = OrganizationFactory()
 
-        upload_start = RegisterUploadFactory(registry=registry, actual_date=date(2026, 1, 1))
-        upload_end = RegisterUploadFactory(registry=registry, actual_date=date(2026, 2, 1))
+        upload_start = RegisterUploadFactory(
+            registry=registry, actual_date=date(2026, 1, 1)
+        )
+        upload_end = RegisterUploadFactory(
+            registry=registry, actual_date=date(2026, 2, 1)
+        )
 
         RegistryMembershipPeriodFactory(
             registry=registry,
@@ -260,7 +268,9 @@ class RegistersViewsTest(APITestCase):
         self.assertEqual(third.data["opened_periods"], 1)
         self.assertEqual(third.data["closed_periods"], 1)
 
-        organization_a = Organization.objects.get(mn_ogrn=1027600980990, mn_inn=7601000086)
+        organization_a = Organization.objects.get(
+            mn_ogrn=1027600980990, mn_inn=7601000086
+        )
         periods = list(
             RegistryMembershipPeriod.objects.filter(
                 registry=registry,
@@ -303,10 +313,14 @@ class RegistersViewsTest(APITestCase):
         self.assertEqual(upload_b.status_code, status.HTTP_201_CREATED)
 
         response_a = self.client.get(
-            reverse("api_v1:registers:registry-organizations-list", args=[registry_a.id])
+            reverse(
+                "api_v1:registers:registry-organizations-list", args=[registry_a.id]
+            )
         )
         response_b = self.client.get(
-            reverse("api_v1:registers:registry-organizations-list", args=[registry_b.id])
+            reverse(
+                "api_v1:registers:registry-organizations-list", args=[registry_b.id]
+            )
         )
 
         self.assertEqual(response_a.status_code, status.HTTP_200_OK)
@@ -357,7 +371,9 @@ class RegistersViewsTest(APITestCase):
         )
 
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
-        organization = Organization.objects.get(mn_ogrn=1027600980990, mn_inn=7601000086)
+        organization = Organization.objects.get(
+            mn_ogrn=1027600980990, mn_inn=7601000086
+        )
         self.assertIsNone(organization.in_kpp)
 
     def test_upload_rejects_invalid_okpo(self):
@@ -414,3 +430,37 @@ class RegistersViewsTest(APITestCase):
         )
 
         self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
+
+    def test_upload_forbidden_for_regular_user(self):
+        registry = RegisterFactory(name="Только для админа")
+        content = _build_register_excel_bytes(
+            [
+                {
+                    "pn_name": 'АО "Ограниченный доступ"',
+                    "mn_ogrn": "1027600980990",
+                    "mn_inn": "7601000086",
+                    "in_kpp": "760401001",
+                    "mn_okpo": "07506197",
+                }
+            ]
+        )
+        upload = SimpleUploadedFile(
+            "viewer.xlsx",
+            content,
+            content_type=(
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+            ),
+        )
+
+        self.client.force_authenticate(self.user)
+        response = self.client.post(
+            reverse("api_v1:registers:register-upload"),
+            {
+                "registry": str(registry.id),
+                "actual_date": "2026-01-01",
+                "file": upload,
+            },
+            format="multipart",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)