56 lines
1.9 KiB
Python
56 lines
1.9 KiB
Python
"""Focused regression checks for authentication and proxy hardening."""
|
|
import os
|
|
import tempfile
|
|
|
|
tmp_dir = tempfile.mkdtemp(prefix="steelstatista-security-")
|
|
os.environ["DB_PATH"] = os.path.join(tmp_dir, "security-test.db")
|
|
os.environ["REPORTS_DIR"] = os.path.join(tmp_dir, "reports")
|
|
os.environ["SEED_ADMIN"] = "0"
|
|
os.environ["COOKIE_SECURE"] = "0"
|
|
os.environ["ALLOWED_ORIGINS"] = "http://localhost:5174,https://web.didvan.com"
|
|
os.environ["API_TOKEN"] = "didvan-regression-token"
|
|
|
|
from fastapi.testclient import TestClient
|
|
import main
|
|
from db import get_conn
|
|
|
|
client = TestClient(main.app)
|
|
|
|
for path in (
|
|
"/api/latest",
|
|
"/api/currency",
|
|
"/api/reports",
|
|
"/api/reports/file?folder=x&name=x.pdf",
|
|
):
|
|
response = client.get(path)
|
|
assert response.status_code == 401, (path, response.status_code, response.text)
|
|
|
|
legacy = client.get("/api/sso?t=credential-must-not-be-read", follow_redirects=False)
|
|
assert legacy.status_code == 303, legacy.text
|
|
assert legacy.headers["location"] == "/login"
|
|
|
|
partner = client.get(
|
|
"/api/v1/prices/latest",
|
|
headers={"Authorization": "Bearer didvan-regression-token"},
|
|
)
|
|
assert partner.status_code == 200, partner.text
|
|
|
|
partner_preflight = client.options(
|
|
"/api/v1/prices/latest",
|
|
headers={
|
|
"Origin": "https://web.didvan.com",
|
|
"Access-Control-Request-Method": "GET",
|
|
"Access-Control-Request-Headers": "authorization",
|
|
},
|
|
)
|
|
assert partner_preflight.status_code == 200, partner_preflight.text
|
|
assert partner_preflight.headers["access-control-allow-origin"] == "https://web.didvan.com"
|
|
|
|
assert main._resolved_client_ip("203.0.113.8", "1.2.3.4", None) == "203.0.113.8"
|
|
assert main._resolved_client_ip("127.0.0.1", "1.2.3.4", None) == "1.2.3.4"
|
|
|
|
with get_conn() as conn:
|
|
assert not conn.execute("SELECT 1 FROM users WHERE lower(username)='admin'").fetchone()
|
|
|
|
print("security smoke tests passed")
|