introduces a consistency check in the PUT /{username} route

app/v1/routers/users/users_router.py

@@ -31,6 +31,8 @@ async def list_users(user_manager: UserManager = Depends(get_user_manager)) -> l
 
 @router.put("/{username}")
 async def update_user(username: str, user: User, user_manager: UserManager = Depends(get_user_manager)) -> User:
+    if username != user.username:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Username mismatch")
     try:
         return user_manager.update_user(username, user)
     except ValueError as ex:

tests/v1/routers/test_users.py

@@ -59,28 +59,3 @@ def test_delete_user(client: TestClient) -> None:
     # Verify the user is deleted
     response = client.get("/v1/users/deleteuser")
     assert response.status_code == 404
-
-
-def test_create_duplicate_user(client: TestClient) -> None:
-    user_data = {"username": "duplicate", "email": "duplicate@example.com"}
-    client.post("/v1/users/", json=user_data)
-
-    # Try to create a user with the same username
-    response = client.post("/v1/users/", json=user_data)
-    assert response.status_code == 409
-
-
-def test_get_nonexistent_user(client: TestClient) -> None:
-    response = client.get("/v1/users/nonexistent")
-    assert response.status_code == 404
-
-
-def test_update_nonexistent_user(client: TestClient) -> None:
-    user_data = {"username": "nonexistent", "email": "nonexistent@example.com"}
-    response = client.put("/v1/users/nonexistent", json=user_data)
-    assert response.status_code == 404
-
-
-def test_delete_nonexistent_user(client: TestClient) -> None:
-    response = client.delete("/v1/users/nonexistent")
-    assert response.status_code == 404

tests/v1/routers/test_users_4xx.py

@@ -0,0 +1,39 @@
+from fastapi.testclient import TestClient
+
+
+def test_create_duplicate_user(client: TestClient) -> None:
+    user_data = {"username": "duplicate", "email": "duplicate@example.com"}
+    client.post("/v1/users/", json=user_data)
+
+    # Try to create a user with the same username
+    response = client.post("/v1/users/", json=user_data)
+    assert response.status_code == 409
+
+
+def test_get_nonexistent_user(client: TestClient) -> None:
+    response = client.get("/v1/users/nonexistent")
+    assert response.status_code == 404
+
+
+def test_update_nonexistent_user(client: TestClient) -> None:
+    user_data = {"username": "nonexistent", "email": "nonexistent@example.com"}
+    response = client.put("/v1/users/nonexistent", json=user_data)
+    assert response.status_code == 404
+
+
+def test_delete_nonexistent_user(client: TestClient) -> None:
+    response = client.delete("/v1/users/nonexistent")
+    assert response.status_code == 404
+
+
+def test_create_user_invalid_data(client: TestClient) -> None:
+    response = client.post("/v1/users/", json={"username": "", "email": "not-an-email"})
+    assert response.status_code == 422
+
+
+def test_update_user_username_mismatch(client: TestClient) -> None:
+    user_data = {"username": "u1", "email": "u1@example.com"}
+    client.post("/v1/users/", json=user_data)
+    updated_data = {"username": "u2", "email": "new@example.com"}
+    response = client.put("/v1/users/u1", json=updated_data)
+    assert response.status_code == 400