Spaces:
Sleeping
Sleeping
File size: 2,271 Bytes
59bd3b5 79e6ae5 59bd3b5 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | def test_loader_javascript_is_public_and_isolated(client):
response = client.get("/widget-loader.js")
assert response.status_code == 200
assert response.headers["content-type"].startswith("application/javascript")
script = response.text
assert "document.currentScript" in script
assert "data-db" in script
assert "attachShadow" in script
assert "__AI_CHAT_WIDGETS__" in script
assert "/widget-bootstrap/" in script
assert "addEventListener('click'" in script
assert "onclick=" not in script
def test_widget_bootstrap_returns_stable_route(client, two_tenants):
response = client.get("/widget-bootstrap/a")
assert response.status_code == 200, response.text
payload = response.json()
assert payload["db"] == "a"
assert payload["widget_url"] == "/w/a"
assert payload["primary_color"].startswith("#")
assert "widget_key" not in payload
def test_widget_bootstrap_rejects_missing_database(client):
response = client.get("/widget-bootstrap/not_a_real_database")
assert response.status_code == 404
def test_stable_widget_route_redirects_to_current_key(client, two_tenants):
response = client.get("/w/a", follow_redirects=False)
assert response.status_code == 302, response.text
assert response.headers["location"] == "/widget-chat?key=wk_a"
assert response.headers["content-security-policy"] == "frame-ancestors *"
assert "x-frame-options" not in response.headers
def test_stable_widget_route_rejects_missing_database(client):
response = client.get("/w/not_a_real_database", follow_redirects=False)
assert response.status_code == 404
def test_admin_embed_code_is_one_line_and_does_not_pin_raw_key(client, two_tenants):
response = client.get(
"/admin/embed-code",
headers={"Authorization": "Bearer clientA", "X-Admin-DB": "a"},
)
assert response.status_code == 200, response.text
payload = response.json()
snippet = payload["snippet"]
assert snippet == payload["embed_code"]
assert snippet == '<script src="https://testserver/widget-loader.js" data-db="a" defer></script>'
assert "wk_a" not in snippet
assert "widget-chat?key=" not in snippet
assert payload["install_url"] == "https://testserver/w/a"
|