63 lines
2.4 KiB
Python
63 lines
2.4 KiB
Python
def test_api_requires_key(client):
|
|
assert client.get("/api/accounts").status_code == 401
|
|
r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
|
|
assert r.status_code == 200
|
|
|
|
|
|
def test_login_flow(client):
|
|
r = client.post("/login", data={"username": "admin", "password": "falsch"},
|
|
follow_redirects=False)
|
|
assert r.status_code == 401
|
|
r = client.post("/login", data={"username": "admin", "password": "geheim"},
|
|
follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert client.get("/api/accounts").status_code == 200 # Cookie reicht
|
|
|
|
|
|
def test_logout_flow(client):
|
|
r = client.post("/login", data={"username": "admin", "password": "geheim"},
|
|
follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert client.get("/api/accounts").status_code == 200
|
|
|
|
r = client.post("/logout", follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert client.get("/api/accounts").status_code == 401
|
|
|
|
|
|
def test_tampered_session_cookie_rejected(client):
|
|
client.cookies.set("fb_session", "gui.invalid-signature")
|
|
assert client.get("/api/accounts").status_code == 401
|
|
|
|
|
|
def test_current_password_hash_falls_back_to_env_when_no_env_file(client, monkeypatch):
|
|
# `client`-Fixture setzt FB_GUI_PASSWORD_HASH direkt und keine FB_ENV_FILE,
|
|
# der Default-Pfad /data/.env existiert im Testlauf nicht -> Fallback.
|
|
from app.auth import current_password_hash
|
|
from app.config import get_settings
|
|
assert current_password_hash() == get_settings().gui_password_hash
|
|
|
|
|
|
def test_current_password_hash_reads_from_env_file_when_present(
|
|
client_with_env_file,
|
|
):
|
|
from app.auth import current_password_hash, verify_password
|
|
_client, password = client_with_env_file
|
|
assert verify_password(password, current_password_hash())
|
|
|
|
|
|
def test_current_password_hash_cache_invalidates_on_file_change(
|
|
client_with_env_file, env_file,
|
|
):
|
|
from app.auth import current_password_hash, hash_password, verify_password
|
|
path, password = env_file
|
|
first = current_password_hash()
|
|
assert verify_password(password, first)
|
|
|
|
new_hash = hash_password("andereswort999")
|
|
path.write_text(f"FB_PASSWORD='andereswort999'\nFB_GUI_PASSWORD_HASH='{new_hash}'\n")
|
|
|
|
second = current_password_hash()
|
|
assert second == new_hash
|
|
assert verify_password("andereswort999", second)
|