Spaces:
Sleeping
Sleeping
File size: 2,931 Bytes
ce8f04a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 | """Nexus Control admin gate — roles, emails, user ids."""
from __future__ import annotations
import pytest
def test_is_admin_token_role_and_email(monkeypatch):
from endpoints.admin import is_admin_token
monkeypatch.delenv("ADMIN_USER_IDS", raising=False)
monkeypatch.delenv("ADMIN_EMAILS", raising=False)
monkeypatch.setenv("ADMIN_EMAIL", "owner@example.com")
assert is_admin_token({"sub": "u1", "role": "admin"}) is True
assert is_admin_token({"sub": "u1", "public_metadata": {"role": "admin"}}) is True
assert is_admin_token({"sub": "u1", "roles": ["owner"]}) is True
assert is_admin_token({"sub": "u1", "email": "owner@example.com"}) is True
assert is_admin_token({"sub": "u1", "email": "other@example.com", "role": "user"}) is False
def test_is_admin_token_user_id_allowlist(monkeypatch):
from endpoints.admin import is_admin_token
monkeypatch.setenv("ADMIN_USER_IDS", "user_abc,user_xyz")
monkeypatch.delenv("ADMIN_EMAILS", raising=False)
monkeypatch.delenv("ADMIN_EMAIL", raising=False)
assert is_admin_token({"sub": "user_abc"}) is True
assert is_admin_token({"sub": "user_nope"}) is False
def test_is_admin_token_dev_user(monkeypatch):
from endpoints.admin import is_admin_token
from core.subscription.auth_utils import DEV_TEST_USER
monkeypatch.setenv("ENV", "dev")
monkeypatch.setenv("ALLOW_DEV_TOKEN", "true")
assert is_admin_token({"sub": DEV_TEST_USER}) is True
def test_verify_admin_rejects_non_admin(monkeypatch):
from fastapi import HTTPException
from endpoints.admin import is_admin_token, verify_admin
monkeypatch.delenv("ADMIN_USER_IDS", raising=False)
monkeypatch.delenv("ADMIN_CLERK_IDS", raising=False)
monkeypatch.setenv("ADMIN_EMAILS", "only@admin.com")
monkeypatch.delenv("ADMIN_EMAIL", raising=False)
assert is_admin_token({"sub": "x", "email": "nope@x.com"}) is False
# Call dependency implementation with plain dict (no Depends)
with pytest.raises(HTTPException) as ei:
verify_admin({"sub": "x", "email": "nope@x.com"}) # type: ignore[arg-type]
assert ei.value.status_code == 403
def test_flaky_domain_skips_crawl4ai_stack():
"""scrape_url_to_markdown must not invoke crawler for funduszeeuropejskie."""
import asyncio
from unittest.mock import AsyncMock, patch, MagicMock
from core.crawl4ai_client import scrape_url_to_markdown
async def _run():
with patch(
"core.crawl4ai_client._scrape_via_stealth",
new=AsyncMock(return_value=""),
) as stealth:
with patch("core.crawl4ai_client._build_crawler") as build:
md = await scrape_url_to_markdown(
"https://www.funduszeeuropejskie.gov.pl/"
)
assert md == ""
stealth.assert_awaited()
build.assert_not_called()
asyncio.run(_run())
|