mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-22 10:02:17 -05:00
Donkie
0f3a3918c1
101 tests covering the authentication system, run against a server with
SPOOLMAN_AUTH_ENABLED as a separate suite from the regression sweep.
Deliberately one SQLite variant rather than a fifth pass of the existing
four-database matrix. Nothing in spoolman/auth is database-specific, so
re-running the whole regression suite with auth on would quadruple the CI
bill to re-prove something none of those tests are about.
The tests live in tests_integration/tests_auth, a sibling of the regression
suite rather than a subdirectory of it, and the compose file mounts that
directory at the path the tester image's fixed entrypoint collects from. So
the auth suite runs exactly when asked and the regression runs can never
pick it up -- no entrypoint override, no collection guard, no way for the
two to interfere.
"sqlite-auth" is accepted by run.py but is not in the default target list,
so `poe itest` keeps meaning what it meant and `poe itest sqlite-auth` is
opt-in. CI gets its own small job for it, and the release gate now depends
on that job alongside the others.
Coverage:
test_unauthenticated every non-public route answers 401 without a
credential -- the black-box counterpart to the
import-time coverage assertion, and the test most
likely to catch a future route added without a gate
test_setup first claim succeeds, second is refused, username
stored lowercased
test_login success, wrong password, unknown user returning an
identical message, lockout with Retry-After, and
remember-me controlling cookie Max-Age
test_csrf cookie-authenticated writes need the header
test_levels the owner reaches read, edit and manage routes
test_anonymous_read the setting opens reads without opening writes, and
leaves the bulk exports closed
test_websocket rejection arrives as close code 4401, not as a failed
handshake -- the regression test for the uvicorn
behaviour that dictated the whole websocket design
test_password change requires the current password and takes effect
One test asserted that using 10 g leaves used_weight at 10. It is a running
total, and the spool was created with remaining_weight below the filament's
net weight, so it already stood at 500. Rewritten to assert the delta.
Verified by running both suites against a live server: 101 auth tests pass
with auth on, and the existing 372 regression tests still pass with auth off
and no test file edited.
111 lines
3.8 KiB
Python
111 lines
3.8 KiB
Python
"""Integration tests: changing one's own password.
|
|
|
|
The endpoint takes the current password as well as the new one, so that a borrowed
|
|
session -- an unlocked laptop, a stolen cookie -- cannot be turned into permanent
|
|
ownership of the account.
|
|
|
|
Every test here restores the original password before finishing. The owner account is
|
|
shared with the rest of the suite, and a stale password would strand every later sign-in.
|
|
"""
|
|
|
|
import httpx
|
|
import pytest
|
|
|
|
from .conftest import (
|
|
OWNER_PASSWORD,
|
|
OWNER_USERNAME,
|
|
assert_code,
|
|
signed_in,
|
|
)
|
|
|
|
NEW_PASSWORD = "an-entirely-different-password"
|
|
|
|
|
|
@pytest.fixture
|
|
def restore_password(owner: httpx.Client):
|
|
"""Put the owner's password back however the test ends."""
|
|
yield
|
|
# Whichever password is current, one of these two puts it back.
|
|
for current in (NEW_PASSWORD, OWNER_PASSWORD):
|
|
result = owner.post(
|
|
"/auth/password",
|
|
json={"current_password": current, "new_password": OWNER_PASSWORD},
|
|
)
|
|
if result.status_code == 200:
|
|
break
|
|
else:
|
|
pytest.fail("Could not restore the owner password; later tests will not be able to sign in.")
|
|
|
|
|
|
def test_wrong_current_password_is_refused(owner: httpx.Client) -> None:
|
|
"""A caller who cannot produce the current password cannot replace it."""
|
|
result = owner.post(
|
|
"/auth/password",
|
|
json={"current_password": "not-the-current-password", "new_password": NEW_PASSWORD},
|
|
)
|
|
assert_code(result, 400)
|
|
assert "current password" in result.json()["message"].lower()
|
|
|
|
# The old password still works, so nothing was changed on the way to the refusal.
|
|
with signed_in() as (_, response):
|
|
assert_code(response, 200)
|
|
|
|
|
|
def test_password_change_requires_a_session(anonymous: httpx.Client) -> None:
|
|
"""Unlike the other auth endpoints, this one is gated."""
|
|
result = anonymous.post(
|
|
"/auth/password",
|
|
json={"current_password": OWNER_PASSWORD, "new_password": NEW_PASSWORD},
|
|
)
|
|
assert_code(result, 401)
|
|
|
|
|
|
def test_password_change_succeeds_and_takes_effect(
|
|
owner: httpx.Client,
|
|
restore_password: None, # noqa: ARG001
|
|
) -> None:
|
|
"""The new password works on the next sign-in, and the old one stops working."""
|
|
result = owner.post(
|
|
"/auth/password",
|
|
json={"current_password": OWNER_PASSWORD, "new_password": NEW_PASSWORD},
|
|
)
|
|
assert_code(result, 200)
|
|
|
|
with signed_in(password=NEW_PASSWORD) as (_, with_new):
|
|
assert_code(with_new, 200)
|
|
assert with_new.json()["is_owner"] is True
|
|
|
|
with signed_in(password=OWNER_PASSWORD) as (_, with_old):
|
|
assert_code(with_old, 401)
|
|
|
|
|
|
def test_changing_the_password_keeps_the_current_session_alive(
|
|
owner: httpx.Client,
|
|
restore_password: None, # noqa: ARG001
|
|
) -> None:
|
|
"""The session that made the change is not signed out by it.
|
|
|
|
Phase 1 does not revoke any session on a password change. Asserting the current
|
|
behaviour here means that if revocation is added later, this test is the thing that
|
|
says so out loud rather than users being silently signed out.
|
|
"""
|
|
assert_code(
|
|
owner.post("/auth/password", json={"current_password": OWNER_PASSWORD, "new_password": NEW_PASSWORD}),
|
|
200,
|
|
)
|
|
assert_code(owner.get("/spool"), 200)
|
|
assert_code(owner.get("/auth/session"), 200)
|
|
|
|
|
|
def test_new_password_works_for_any_username_casing(
|
|
owner: httpx.Client,
|
|
restore_password: None, # noqa: ARG001
|
|
) -> None:
|
|
"""The changed password belongs to the account, whichever casing signs in with it."""
|
|
assert_code(
|
|
owner.post("/auth/password", json={"current_password": OWNER_PASSWORD, "new_password": NEW_PASSWORD}),
|
|
200,
|
|
)
|
|
with signed_in(username=OWNER_USERNAME.upper(), password=NEW_PASSWORD) as (_, response):
|
|
assert_code(response, 200)
|