mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-22 01:52:17 -05:00
Donkie
0f3a3918c1
101 tests covering the authentication system, run against a server with
SPOOLMAN_AUTH_ENABLED as a separate suite from the regression sweep.
Deliberately one SQLite variant rather than a fifth pass of the existing
four-database matrix. Nothing in spoolman/auth is database-specific, so
re-running the whole regression suite with auth on would quadruple the CI
bill to re-prove something none of those tests are about.
The tests live in tests_integration/tests_auth, a sibling of the regression
suite rather than a subdirectory of it, and the compose file mounts that
directory at the path the tester image's fixed entrypoint collects from. So
the auth suite runs exactly when asked and the regression runs can never
pick it up -- no entrypoint override, no collection guard, no way for the
two to interfere.
"sqlite-auth" is accepted by run.py but is not in the default target list,
so `poe itest` keeps meaning what it meant and `poe itest sqlite-auth` is
opt-in. CI gets its own small job for it, and the release gate now depends
on that job alongside the others.
Coverage:
test_unauthenticated every non-public route answers 401 without a
credential -- the black-box counterpart to the
import-time coverage assertion, and the test most
likely to catch a future route added without a gate
test_setup first claim succeeds, second is refused, username
stored lowercased
test_login success, wrong password, unknown user returning an
identical message, lockout with Retry-After, and
remember-me controlling cookie Max-Age
test_csrf cookie-authenticated writes need the header
test_levels the owner reaches read, edit and manage routes
test_anonymous_read the setting opens reads without opening writes, and
leaves the bulk exports closed
test_websocket rejection arrives as close code 4401, not as a failed
handshake -- the regression test for the uvicorn
behaviour that dictated the whole websocket design
test_password change requires the current password and takes effect
One test asserted that using 10 g leaves used_weight at 10. It is a running
total, and the spool was created with remaining_weight below the filament's
net weight, so it already stood at 500. Rewritten to assert the delta.
Verified by running both suites against a live server: 101 auth tests pass
with auth on, and the existing 372 regression tests still pass with auth off
and no test file edited.
136 lines
5.0 KiB
Python
136 lines
5.0 KiB
Python
"""Integration tests: websocket authentication.
|
|
|
|
This file exists for one subtle behaviour. A websocket handler that closes the socket
|
|
*before* accepting the handshake gets translated by uvicorn into an HTTP 403 rejection
|
|
with the close code thrown away, and Starlette routes a WebSocketException raised from a
|
|
dependency down that same path. Neither can deliver 4401 or 4403 to the browser, so the
|
|
client cannot tell "you are signed out, stop retrying" from "the network blipped, back
|
|
off and retry" -- and a client that cannot tell reconnects forever.
|
|
|
|
``ws_authenticated`` therefore accepts first and closes afterwards, which looks wrong at
|
|
a glance and is the reason these assertions check the close code explicitly rather than
|
|
merely checking that the connection failed.
|
|
"""
|
|
|
|
import asyncio
|
|
import json
|
|
|
|
import httpx
|
|
import pytest
|
|
from websockets.asyncio.client import connect
|
|
from websockets.exceptions import ConnectionClosed
|
|
|
|
from .conftest import (
|
|
SESSION_COOKIE,
|
|
WS_API_URL,
|
|
WS_UNAUTHENTICATED,
|
|
assert_code,
|
|
signed_in,
|
|
)
|
|
|
|
# Every websocket route the v1 API serves. All of them subscribe at read level.
|
|
WS_ROUTES = [
|
|
"/",
|
|
"/spool",
|
|
"/spool/1",
|
|
"/filament",
|
|
"/filament/1",
|
|
"/vendor",
|
|
"/vendor/1",
|
|
"/setting",
|
|
"/setting/currency",
|
|
]
|
|
|
|
|
|
async def _close_code(path: str, cookie: str | None = None) -> int | None:
|
|
"""Connect, and report the code the server closed with.
|
|
|
|
Args:
|
|
path: The websocket path, relative to the v1 API.
|
|
cookie: A session cookie header value, or None to connect with no credentials.
|
|
|
|
Returns:
|
|
Optional[int]: The close code, or None if the socket stayed open.
|
|
|
|
"""
|
|
headers = {"Cookie": f"{SESSION_COOKIE}={cookie}"} if cookie else None
|
|
try:
|
|
async with connect(WS_API_URL + path, additional_headers=headers) as websocket:
|
|
try:
|
|
await asyncio.wait_for(websocket.recv(), timeout=2)
|
|
except TimeoutError:
|
|
# Still open and idle, which is what a healthy subscription looks like.
|
|
return None
|
|
except ConnectionClosed as exc:
|
|
return exc.code
|
|
return None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
@pytest.mark.parametrize("path", WS_ROUTES)
|
|
async def test_unauthenticated_websocket_is_closed_with_4401(
|
|
setup_response: httpx.Response, # noqa: ARG001
|
|
path: str,
|
|
) -> None:
|
|
"""The handshake is accepted, then closed with 4401 -- not rejected with HTTP 403.
|
|
|
|
Asserting the exact code is the regression test. If someone "simplifies"
|
|
ws_authenticated into raising a WebSocketException or closing before accept, the
|
|
handshake starts failing with an HTTP 403 instead and this assertion catches it.
|
|
"""
|
|
assert await _close_code(path) == WS_UNAUTHENTICATED
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_authenticated_websocket_stays_open(setup_response: httpx.Response) -> None: # noqa: ARG001
|
|
"""A session cookie on the handshake gets a working subscription."""
|
|
with signed_in() as (client, response):
|
|
assert_code(response, 200)
|
|
token = client.cookies.get(SESSION_COOKIE)
|
|
|
|
assert await _close_code("/spool", cookie=token) is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_authenticated_websocket_receives_events(setup_response: httpx.Response) -> None: # noqa: ARG001
|
|
"""The subscription is a real one, not merely a socket that was left open."""
|
|
with signed_in() as (client, response):
|
|
assert_code(response, 200)
|
|
token = client.cookies.get(SESSION_COOKIE)
|
|
|
|
async with connect(
|
|
f"{WS_API_URL}/vendor",
|
|
additional_headers={"Cookie": f"{SESSION_COOKIE}={token}"},
|
|
) as websocket:
|
|
# The subscription registers right after the handshake; give the server a
|
|
# beat before triggering the event.
|
|
await asyncio.sleep(0.2)
|
|
|
|
created = client.post("/vendor", json={"name": "Websocket test vendor"})
|
|
assert_code(created, 200)
|
|
vendor_id = created.json()["id"]
|
|
try:
|
|
event = json.loads(await asyncio.wait_for(websocket.recv(), timeout=10))
|
|
assert event["type"] == "added"
|
|
assert event["resource"] == "vendor"
|
|
assert event["payload"]["id"] == vendor_id
|
|
finally:
|
|
assert_code(client.delete(f"/vendor/{vendor_id}"), 200)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_revoked_session_cannot_open_a_websocket(setup_response: httpx.Response) -> None: # noqa: ARG001
|
|
"""A signed-out cookie is refused at the handshake, same as no cookie at all."""
|
|
with signed_in() as (client, response):
|
|
assert_code(response, 200)
|
|
token = client.cookies.get(SESSION_COOKIE)
|
|
assert_code(client.post("/auth/logout"), 200)
|
|
|
|
assert await _close_code("/spool", cookie=token) == WS_UNAUTHENTICATED
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_garbage_cookie_cannot_open_a_websocket(setup_response: httpx.Response) -> None: # noqa: ARG001
|
|
"""A made-up token is not a credential over websockets either."""
|
|
assert await _close_code("/spool", cookie="not-a-real-token") == WS_UNAUTHENTICATED
|