42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
|
|
META_ROOT = Path(__file__).resolve().parents[1]
|
|
RELEASE_ROOT = META_ROOT / "tools" / "release"
|
|
if str(RELEASE_ROOT) not in sys.path:
|
|
sys.path.insert(0, str(RELEASE_ROOT))
|
|
|
|
from server.app import create_app # noqa: E402
|
|
|
|
|
|
class ReleaseConsoleSecurityTests(unittest.TestCase):
|
|
def test_api_token_is_accepted_only_from_header(self) -> None:
|
|
with TestClient(create_app(workspace_root=META_ROOT, token="test-console-token")) as client:
|
|
query_response = client.get("/api/health?token=test-console-token")
|
|
header_response = client.get(
|
|
"/api/health",
|
|
headers={"X-Release-Console-Token": "test-console-token"},
|
|
)
|
|
|
|
self.assertEqual(query_response.status_code, 401)
|
|
self.assertEqual(header_response.status_code, 200)
|
|
|
|
def test_bootstrap_token_uses_and_clears_url_fragment(self) -> None:
|
|
launcher = (RELEASE_ROOT / "release-console.py").read_text(encoding="utf-8")
|
|
webui = (RELEASE_ROOT / "webui" / "index.html").read_text(encoding="utf-8")
|
|
|
|
self.assertIn("#token={token}", launcher)
|
|
self.assertNotIn("?token={token}", launcher)
|
|
self.assertIn("window.location.hash.slice(1)", webui)
|
|
self.assertIn("history.replaceState", webui)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|