Donkie 0f3a3918c1 auth: focused integration test suite ...

101 tests covering the authentication system, run against a server with
SPOOLMAN_AUTH_ENABLED as a separate suite from the regression sweep.

Deliberately one SQLite variant rather than a fifth pass of the existing
four-database matrix. Nothing in spoolman/auth is database-specific, so
re-running the whole regression suite with auth on would quadruple the CI
bill to re-prove something none of those tests are about.

The tests live in tests_integration/tests_auth, a sibling of the regression
suite rather than a subdirectory of it, and the compose file mounts that
directory at the path the tester image's fixed entrypoint collects from. So
the auth suite runs exactly when asked and the regression runs can never
pick it up -- no entrypoint override, no collection guard, no way for the
two to interfere.

"sqlite-auth" is accepted by run.py but is not in the default target list,
so `poe itest` keeps meaning what it meant and `poe itest sqlite-auth` is
opt-in. CI gets its own small job for it, and the release gate now depends
on that job alongside the others.

Coverage:
  test_unauthenticated  every non-public route answers 401 without a
                        credential -- the black-box counterpart to the
                        import-time coverage assertion, and the test most
                        likely to catch a future route added without a gate
  test_setup            first claim succeeds, second is refused, username
                        stored lowercased
  test_login            success, wrong password, unknown user returning an
                        identical message, lockout with Retry-After, and
                        remember-me controlling cookie Max-Age
  test_csrf             cookie-authenticated writes need the header
  test_levels           the owner reaches read, edit and manage routes
  test_anonymous_read   the setting opens reads without opening writes, and
                        leaves the bulk exports closed
  test_websocket        rejection arrives as close code 4401, not as a failed
                        handshake -- the regression test for the uvicorn
                        behaviour that dictated the whole websocket design
  test_password         change requires the current password and takes effect

One test asserted that using 10 g leaves used_weight at 10. It is a running
total, and the spool was created with remaining_weight below the filament's
net weight, so it already stood at 500. Rewritten to assert the delta.

Verified by running both suites against a live server: 101 auth tests pass
with auth on, and the existing 372 regression tests still pass with auth off
and no test file edited.

2026-07-28 13:10:55 +02:00

0 lines

0 B

Python

Raw Permalink Blame History

The file is empty.