Spaces:
Running
Running
| import pytest | |
| pytest.importorskip("fastapi") | |
| from fastapi.testclient import TestClient # noqa: E402 | |
| from app.server import app # noqa: E402 | |
| def test_no_site_passcode_means_open(monkeypatch): | |
| monkeypatch.delenv("CURATORBOT_SITE_PASSCODE", raising=False) | |
| c = TestClient(app) | |
| assert c.get("/").status_code == 200 | |
| assert c.get("/api/interviews").status_code == 200 | |
| def test_site_passcode_gates_pages_and_api(monkeypatch): | |
| monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame") | |
| c = TestClient(app, follow_redirects=False) | |
| r = c.get("/") | |
| assert r.status_code == 303 and r.headers["location"] == "/login" | |
| r = c.get("/api/interviews/DEMO-0001") | |
| assert r.status_code == 401 and r.headers["x-login-required"] == "1" | |
| assert c.get("/static/app.js").status_code == 303 | |
| assert c.get("/login").status_code == 200 | |
| r = c.post("/login", data={"passcode": "wrong"}) | |
| assert r.status_code == 401 and "not right" in r.text and "set-cookie" not in r.headers | |
| r = c.post("/login", data={"passcode": "open sesame"}) | |
| assert r.status_code == 303 and "HttpOnly" in r.headers["set-cookie"] | |
| assert c.get("/").status_code == 200 | |
| assert c.get("/api/interviews").status_code == 200 | |
| # changing the passcode signs everyone out | |
| monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "new one") | |
| assert c.get("/api/interviews").status_code == 401 | |
| c.get("/logout") | |
| monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame") | |
| assert c.get("/api/interviews").status_code == 401 | |
| def test_site_passcode_header_for_scripts(monkeypatch): | |
| monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame") | |
| c = TestClient(app) | |
| assert c.get("/api/health", headers={"X-Site-Passcode": "open sesame"}).status_code == 200 | |
| assert c.get("/api/health", headers={"X-Site-Passcode": "nope"}).status_code == 401 | |
| def test_https_cookie_works_inside_the_space_frame(monkeypatch): | |
| monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame") | |
| c = TestClient(app, follow_redirects=False) | |
| r = c.post("/login", data={"passcode": "open sesame"}, headers={"X-Forwarded-Proto": "https"}) | |
| cookie = r.headers["set-cookie"] | |
| assert "Secure" in cookie and "SameSite=None" in cookie and "Partitioned" in cookie | |
| def test_tab_icon_is_served_without_signing_in(monkeypatch): | |
| from fastapi.testclient import TestClient | |
| monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "secret") | |
| from app.server import app | |
| c = TestClient(app) | |
| for path in ("/favicon.svg", "/favicon.ico"): | |
| r = c.get(path) | |
| assert r.status_code == 200 and r.headers["content-type"].startswith("image/svg+xml") and b"<svg" in r.content | |
| assert 'rel="icon"' in c.get("/login").text | |