41 lines
2.6 KiB
Python
41 lines
2.6 KiB
Python
from starlette.testclient import TestClient
|
|
from viano_bug_analysis.api.app import create_app
|
|
from viano_bug_analysis.api.config import APIConfig,Project
|
|
from viano_bug_analysis.api.keys import Keys
|
|
|
|
|
|
def test_web_keys_reveal_auth_scope_revoke_and_restart(tmp_path):
|
|
config=APIConfig(tmp_path,(Project('one','wow','vcore'),Project('two','wow','vcore')),())
|
|
app=create_app(config);app.state.sessions.users.manage('create_user','alice','password')
|
|
client=TestClient(app)
|
|
assert client.get('/v1/integration-keys').status_code==401
|
|
login=client.post('/v1/auth/login',json={'username':'alice','password':'password'}).json()
|
|
headers={'X-CSRF-Token':login['csrf']}
|
|
payload={'name':'Capture worker','projects':['one']}
|
|
assert client.post('/v1/integration-keys',json=payload).status_code==403
|
|
assert client.post('/v1/integration-keys',headers=headers,json={**payload,'projects':['unknown']}).status_code==422
|
|
result=client.post('/v1/integration-keys',headers=headers,json=payload)
|
|
assert result.status_code==200
|
|
identifier=result.json()['id'];base='/v1/integration-keys/'+identifier
|
|
assert client.post(base+'/reveal').status_code==403
|
|
response=client.post(base+'/reveal',headers=headers)
|
|
assert response.headers['cache-control']=='no-store'
|
|
key=response.json()['key']
|
|
assert client.post(base+'/reveal',headers=headers).json()['key']==key
|
|
listing=client.get('/v1/integration-keys').json()
|
|
assert key not in str(listing)
|
|
assert key.encode() not in (tmp_path/'runtime/integrations/keys.sqlite3').read_bytes()
|
|
machine=TestClient(create_app(config));bearer={'Authorization':'Bearer '+key}
|
|
assert machine.get('/v1/profiles',headers=bearer).json()['projects']==[{'project_id':'one','profile_id':'vcore','adapter':'vcore'}]
|
|
assert machine.get('/v1/integration-keys',headers=bearer).status_code==403
|
|
assert machine.post(base+'/reveal',headers=bearer).status_code==403
|
|
assert machine.post('/v1/operations',headers=bearer,json={'action':'pause','project_id':'one'}).status_code==403
|
|
assert Keys(config).reveal(identifier)['key']==key
|
|
(tmp_path/'runtime/integration-secrets/master.key').unlink()
|
|
assert client.post(base+'/reveal',headers=headers).status_code==503
|
|
# Missing master must not silently generate a replacement; authentication can still use digest.
|
|
assert not (tmp_path/'runtime/integration-secrets/master.key').exists()
|
|
assert client.post(base+'/revoke',headers=headers).status_code==200
|
|
assert machine.get('/v1/profiles',headers=bearer).status_code==401
|
|
assert client.post(base+'/reveal',headers=headers).status_code==404
|