Spaces:
Paused
Paused
| """The sign-in flow, exercised without ever reaching Hugging Face. | |
| Everything here is about refusing bad input. The happy path needs a real | |
| provider and a real Space, and is verified against the deployment rather than | |
| faked here — a mocked token exchange would only assert that the mock works. | |
| """ | |
| from __future__ import annotations | |
| import pytest | |
| from fastapi.testclient import TestClient | |
| from server import oauth | |
| from server.main import app | |
| def clean_env(monkeypatch): | |
| for var in ("OAUTH_CLIENT_ID", "OAUTH_CLIENT_SECRET", "OAUTH_SCOPES", | |
| "OPENID_PROVIDER_URL", "SPACE_ID", "SPACE_HOST", | |
| "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN", "ASE_ALLOW_SPACE_CREDITS"): | |
| monkeypatch.delenv(var, raising=False) | |
| monkeypatch.setenv("ASE_KEY_FILE", "/nonexistent/ase-glm-test-key") | |
| def client(): | |
| return TestClient(app) | |
| def test_not_configured_without_a_space(client): | |
| assert oauth.configured() is False | |
| r = client.get("/api/auth/login", follow_redirects=False) | |
| assert r.status_code == 503 | |
| assert "Space" in r.json()["error"] | |
| def test_config_says_sign_in_is_unavailable(client): | |
| auth = client.get("/api/config").json()["auth"] | |
| assert auth["canSignIn"] is False | |
| assert auth["profile"] is None | |
| def test_login_redirects_to_the_provider_with_the_billing_scope(client, monkeypatch): | |
| monkeypatch.setenv("OAUTH_CLIENT_ID", "cid") | |
| monkeypatch.setenv("OAUTH_CLIENT_SECRET", "shh") | |
| monkeypatch.setenv("SPACE_HOST", "example.hf.space") | |
| r = client.get("/api/auth/login", follow_redirects=False) | |
| assert r.status_code == 302 | |
| url = r.headers["location"] | |
| assert url.startswith("https://huggingface.co/oauth/authorize?") | |
| # inference-api is the whole point: without it we learn who someone is and | |
| # still cannot bill them. | |
| assert "inference-api" in url | |
| assert "example.hf.space%2Fauth%2Fcallback" in url | |
| assert "state=" in url | |
| assert "shh" not in url | |
| def start_login(client) -> str: | |
| """Begin a sign-in and return the state we were issued.""" | |
| r = client.get("/api/auth/login", follow_redirects=False) | |
| query = r.headers["location"].split("?", 1)[1] | |
| return dict(p.split("=", 1) for p in query.split("&"))["state"] | |
| def test_the_callback_refuses_a_state_it_did_not_issue(client, monkeypatch): | |
| monkeypatch.setenv("OAUTH_CLIENT_ID", "cid") | |
| monkeypatch.setenv("OAUTH_CLIENT_SECRET", "shh") | |
| # A real session, so the rejection is about the state and not the cookie. | |
| start_login(client) | |
| r = client.get("/auth/callback", params={"code": "abc", "state": "forged"}, | |
| follow_redirects=False) | |
| assert r.status_code == 200 | |
| assert "state did not match" in r.text | |
| # And nothing was stored. | |
| assert client.get("/api/config").json()["auth"]["mode"] == "none" | |
| def test_the_callback_refuses_a_missing_state(client): | |
| r = client.get("/auth/callback", params={"code": "abc"}, follow_redirects=False) | |
| # No session came back at all: reported as a cookie problem, because that | |
| # is what it almost always is and it has a different fix from a forgery. | |
| assert "not returned by your browser" in r.text | |
| def test_the_session_cookie_crosses_sites_on_a_space(monkeypatch): | |
| # A Space is viewed inside an iframe on huggingface.co, so this cookie is | |
| # third-party. Under SameSite=Lax the browser withholds it on the way back | |
| # from the provider and every sign-in fails as a state mismatch. | |
| monkeypatch.setenv("SPACE_ID", "someone/ase-glm") | |
| monkeypatch.setenv("OAUTH_CLIENT_ID", "cid") | |
| monkeypatch.setenv("OAUTH_CLIENT_SECRET", "shh") | |
| import importlib | |
| from server import main as main_mod | |
| importlib.reload(main_mod) | |
| r = TestClient(main_mod.app).get("/api/auth/login", follow_redirects=False) | |
| cookie = r.headers.get("set-cookie", "").lower() | |
| assert "samesite=none" in cookie | |
| # SameSite=None is only honoured on a Secure cookie. | |
| assert "secure" in cookie | |
| importlib.reload(main_mod) | |
| def test_the_callback_reports_a_provider_error(client): | |
| r = client.get("/auth/callback", params={"error": "access_denied"}) | |
| assert "access_denied" in r.text | |
| def test_a_state_cannot_be_replayed(client, monkeypatch): | |
| monkeypatch.setenv("OAUTH_CLIENT_ID", "cid") | |
| monkeypatch.setenv("OAUTH_CLIENT_SECRET", "shh") | |
| monkeypatch.setenv("SPACE_HOST", "example.hf.space") | |
| state = start_login(client) | |
| # The first use consumes it (and then fails at the token exchange, which is | |
| # fine — what matters is that a second attempt cannot reuse the same state). | |
| client.get("/auth/callback", params={"code": "abc", "state": state}) | |
| again = client.get("/auth/callback", params={"code": "abc", "state": state}) | |
| assert "Signed in" not in again.text | |
| assert client.get("/api/config").json()["auth"]["mode"] == "none" | |
| def test_logout_is_a_post_and_clears_the_session(client): | |
| assert client.get("/auth/callback", params={"error": "x"}).status_code == 200 | |
| assert client.post("/api/auth/logout").json() == {"ok": True} | |
| # GET must not log anyone out: a prefetched link would sign them out. | |
| assert client.get("/api/auth/logout").status_code in (404, 405) | |
| def test_the_session_cookie_is_not_readable_by_script(client, monkeypatch): | |
| monkeypatch.setenv("OAUTH_CLIENT_ID", "cid") | |
| monkeypatch.setenv("OAUTH_CLIENT_SECRET", "shh") | |
| r = client.get("/api/auth/login", follow_redirects=False) | |
| cookie = r.headers.get("set-cookie", "") | |
| assert "httponly" in cookie.lower() | |
| assert "samesite=lax" in cookie.lower() | |