tests/test_cors.py

from __future__ import annotations

from pathlib import Path

import httpx

from app.core.config import Settings
from main import create_app


async def test_configured_frontend_origin_receives_cors_headers(tmp_path: Path) -> None:
    settings = Settings(
        _env_file=None,
        auth_enabled=False,
        database_url=f"sqlite+aiosqlite:///{tmp_path / 'security.db'}",
        temp_dir=tmp_path / "temp",
        output_dir=tmp_path / "outputs",
        cors_allowed_origins="https://workspace.example.vercel.app",
    )
    app = create_app(settings)
    transport = httpx.ASGITransport(app=app)

    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
        response = await client.options(
            "/v1/projects",
            headers={
                "Origin": "https://workspace.example.vercel.app",
                "Access-Control-Request-Method": "GET",
                "Access-Control-Request-Headers": "Authorization",
            },
        )

    assert response.status_code == 200
    assert response.headers["access-control-allow-origin"] == (
        "https://workspace.example.vercel.app"
    )
    assert "authorization" in response.headers["access-control-allow-headers"].lower()


async def test_unconfigured_origin_receives_no_cors_authorization(tmp_path: Path) -> None:
    settings = Settings(
        _env_file=None,
        auth_enabled=False,
        database_url=f"sqlite+aiosqlite:///{tmp_path / 'security.db'}",
        temp_dir=tmp_path / "temp",
        output_dir=tmp_path / "outputs",
        cors_allowed_origins="https://workspace.example.vercel.app",
    )
    app = create_app(settings)
    transport = httpx.ASGITransport(app=app)

    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
        response = await client.options(
            "/v1/projects",
            headers={
                "Origin": "https://attacker.example",
                "Access-Control-Request-Method": "GET",
            },
        )

    assert response.status_code == 400
    assert "access-control-allow-origin" not in response.headers