31 lines
1.2 KiB
Python
31 lines
1.2 KiB
Python
def test_api_requires_key(client):
|
|
assert client.get("/api/accounts").status_code == 401
|
|
r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
|
|
assert r.status_code == 200
|
|
|
|
|
|
def test_login_flow(client):
|
|
r = client.post("/login", data={"username": "admin", "password": "falsch"},
|
|
follow_redirects=False)
|
|
assert r.status_code == 401
|
|
r = client.post("/login", data={"username": "admin", "password": "geheim"},
|
|
follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert client.get("/api/accounts").status_code == 200 # Cookie reicht
|
|
|
|
|
|
def test_logout_flow(client):
|
|
r = client.post("/login", data={"username": "admin", "password": "geheim"},
|
|
follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert client.get("/api/accounts").status_code == 200
|
|
|
|
r = client.post("/logout", follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert client.get("/api/accounts").status_code == 401
|
|
|
|
|
|
def test_tampered_session_cookie_rejected(client):
|
|
client.cookies.set("fb_session", "gui.invalid-signature")
|
|
assert client.get("/api/accounts").status_code == 401
|