Node / ReticulumProjects / MeshChatX.git / files / tests / backend / test_app_security_features.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

Tff7b72import T7ee787secrets

Tff7b72import T7ee787bcrypt

Tff7b72import T7ee787pytest

Tff7b72from T7ee787aiohttp Tff7b72import Te6edf3web

Tff7b72from T7ee787aiohttpT7ee787.T7ee787test_utils Tff7b72import Te6edf3TestClientTb4b4b4, Te6edf3TestServer

Tff7b72from T7ee787aiohttp_session Tff7b72import Te6edf3setup Tff7b72as Te6edf3setup_session

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787app_security_settings Tff7b72import Te6edf3save_app_security_settings

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787ip_allowlist Tff7b72import Tb4b4b4(

Te6edf3client_ip_allowedTb4b4b4,

Te6edf3parse_allowlist_networksTb4b4b4,

Tb4b4b4)

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787privacy_mode Tff7b72import Tb4b4b4(

Te6edf3OutboundHttpBlockedErrorTb4b4b4,

Te6edf3privacy_mode_enabledTb4b4b4,

Tb4b4b4)

Tff7b72from T7ee787testsT7ee787.T7ee787backendT7ee787.T7ee787conftest Tff7b72import Te6edf3extend_meshchat_middlewaresTb4b4b4, Te6edf3fetch_api_csrf_headers

Tff7b72def Td2a8ff_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTb4b4b4: Tffa657boolTb4b4b4)Tb4b4b4:

Te6edf3mock_appTff7b72.Td2a8ffsession_secret_key Tff7b72= Te6edf3secretsTff7b72.Td2a8fftoken_urlsafeTb4b4b4(T79c0ff32Tb4b4b4)

Te6edf3mock_appTff7b72.Td2a8fflisten_host Tff7b72= Ta5d6ff"Ta5d6ff127.0.0.1Ta5d6ff"

Te6edf3mock_appTff7b72.Td2a8fflisten_port Tff7b72= T79c0ff8000

Te6edf3mock_appTff7b72.Td2a8ffuse_https Tff7b72= Te6edf3use_https

Te6edf3mock_appTff7b72.Td2a8fflandlock_active Tff7b72= Tff7b72False

Te6edf3routes Tff7b72= Te6edf3webTff7b72.Td2a8ffRouteTableDefTb4b4b4(Tb4b4b4)

Te6edf3middlewares Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_define_routesTb4b4b4(Te6edf3routesTb4b4b4)

Te6edf3aio_app Tff7b72= Te6edf3webTff7b72.Td2a8ffApplicationTb4b4b4(Tb4b4b4)

Te6edf3setup_sessionTb4b4b4(Te6edf3aio_appTb4b4b4, Te6edf3mock_appTff7b72.Td2a8ff_encrypted_cookie_storageTb4b4b4(Te6edf3use_httpsTb4b4b4)Tb4b4b4)

Te6edf3extend_meshchat_middlewaresTb4b4b4(Te6edf3aio_appTb4b4b4, Te6edf3middlewaresTb4b4b4)

Te6edf3aio_appTff7b72.Td2a8ffadd_routesTb4b4b4(Te6edf3routesTb4b4b4)

Tff7b72return Te6edf3aio_app

Tff7b72def Td2a8fftest_ip_allowlist_parsingTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3nets Tff7b72= Te6edf3parse_allowlist_networksTb4b4b4(Ta5d6ff"Ta5d6ff127.0.0.1/32, 192.168.1.0/24Ta5d6ff"Tb4b4b4)

Tff7b72assert Tffa657lenTb4b4b4(Te6edf3netsTb4b4b4) Tff7b72== T79c0ff2

Tff7b72assert Te6edf3client_ip_allowedTb4b4b4(Ta5d6ff"Ta5d6ff127.0.0.1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff127.0.0.1/32Ta5d6ff"Tb4b4b4)

Tff7b72assert Tff7b72not Te6edf3client_ip_allowedTb4b4b4(Ta5d6ff"Ta5d6ff10.0.0.5Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff127.0.0.1/32Ta5d6ff"Tb4b4b4)

Tff7b72assert Te6edf3client_ip_allowedTb4b4b4(Ta5d6ff"Ta5d6ff192.168.1.50Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff192.168.1.0/24Ta5d6ff"Tb4b4b4)

Tff7b72def Td2a8fftest_ip_allowlist_empty_allows_allTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3client_ip_allowedTb4b4b4(Ta5d6ff"Ta5d6ff203.0.113.1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff"Tb4b4b4)

Tff7b72def Td2a8fftest_app_security_settings_roundtripTb4b4b4(Te6edf3tmp_pathTb4b4b4)Tb4b4b4:

Te6edf3saved Tff7b72= Te6edf3save_app_security_settingsTb4b4b4(

Tffa657strTb4b4b4(Te6edf3tmp_pathTb4b4b4)Tb4b4b4,

Tb4b4b4{Ta5d6ff"Ta5d6ffweb_ui_ip_allowlistTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ff127.0.0.1/32, ::1/128Ta5d6ff"Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72assert Te6edf3savedTb4b4b4[Ta5d6ff"Ta5d6ffweb_ui_ip_allowlistTa5d6ff"Tb4b4b4] Tff7b72== Ta5d6ff"Ta5d6ff127.0.0.1/32, ::1/128Ta5d6ff"

Tff7b72def Td2a8fftest_privacy_mode_default_offTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3privacy_mode_enabledTb4b4b4(Te6edf3mock_appTff7b72.Td2a8ffconfigTb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_privacy_mode_blocks_outboundTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:

Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffprivacy_mode_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)

Tff7b72with Te6edf3pytestTff7b72.Td2a8ffraisesTb4b4b4(Te6edf3OutboundHttpBlockedErrorTb4b4b4)Tb4b4b4:

Te6edf3mock_appTff7b72.Td2a8ff_require_outbound_httpTb4b4b4(Ta5d6ff"Ta5d6fftestTa5d6ff"Tb4b4b4)

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)

Tff7b72async Tff7b72def Td2a8fftest_ip_allowlist_middleware_blocks_apiTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:

Te6edf3save_app_security_settingsTb4b4b4(

Te6edf3mock_appTff7b72.Td2a8ffstorage_dirTb4b4b4,

Tb4b4b4{Ta5d6ff"Ta5d6ffweb_ui_ip_allowlistTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ff192.168.50.0/24Ta5d6ff"Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:

Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/configTa5d6ff"Tb4b4b4)

Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff403

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)

Tff7b72async Tff7b72def Td2a8fftest_csrf_required_for_config_patchTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_DISABLE_CSRFTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)

Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:

Te6edf3blocked Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpatchTb4b4b4(

Ta5d6ff"Ta5d6ff/api/v1/server/securityTa5d6ff"Tb4b4b4,

Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffweb_ui_ip_allowlistTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ff"Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72assert Te6edf3blockedTff7b72.Td2a8ffstatus Tff7b72== T79c0ff403

Te6edf3headers Tff7b72= Tff7b72await Te6edf3fetch_api_csrf_headersTb4b4b4(Te6edf3clientTb4b4b4)

Te6edf3ok Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpatchTb4b4b4(

Ta5d6ff"Ta5d6ff/api/v1/server/securityTa5d6ff"Tb4b4b4,

Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffweb_ui_ip_allowlistTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ff"Tb4b4b4}Tb4b4b4,

Te6edf3headersTff7b72=Te6edf3headersTb4b4b4,

Tb4b4b4)

Tff7b72assert Te6edf3okTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)

Tff7b72async Tff7b72def Td2a8fftest_login_requires_csrfTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_DISABLE_CSRFTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)

Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)

Te6edf3pw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6ffcsrf-login-passwordTa5d6ff"

Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(

Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Te6edf3pwTb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:

Te6edf3denied Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(

Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,

Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Te6edf3pwTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72assert Te6edf3deniedTff7b72.Td2a8ffstatus Tff7b72== T79c0ff403

Te6edf3headers Tff7b72= Tff7b72await Te6edf3fetch_api_csrf_headersTb4b4b4(Te6edf3clientTb4b4b4)

Te6edf3login Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(

Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,

Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Te6edf3pwTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4}Tb4b4b4,

Te6edf3headersTff7b72=Te6edf3headersTb4b4b4,

Tb4b4b4)

Tff7b72assert Te6edf3loginTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)

Tff7b72async Tff7b72def Td2a8fftest_server_security_endpointTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:

Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:

Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/server/securityTa5d6ff"Tb4b4b4)

Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200

Te6edf3body Tff7b72= Tff7b72await Te6edf3rTff7b72.Td2a8ffjsonTb4b4b4(Tb4b4b4)

Tff7b72assert Te6edf3bodyTb4b4b4[Ta5d6ff"Ta5d6fflisten_hostTa5d6ff"Tb4b4b4] Tff7b72== Ta5d6ff"Ta5d6ff127.0.0.1Ta5d6ff"

Tff7b72assert Te6edf3bodyTb4b4b4[Ta5d6ff"Ta5d6ffis_loopback_bindTa5d6ff"Tb4b4b4] Tff7b72is Tff7b72True

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)

Tff7b72async Tff7b72def Td2a8fftest_privacy_mode_blocks_map_exportTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:

Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffprivacy_mode_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)

Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:

Te6edf3headers Tff7b72= Tff7b72await Te6edf3fetch_api_csrf_headersTb4b4b4(Te6edf3clientTb4b4b4)

Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(

Ta5d6ff"Ta5d6ff/api/v1/map/exportTa5d6ff"Tb4b4b4,

Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffbboxTa5d6ff"Tb4b4b4: Tb4b4b4[T79c0ff0Tb4b4b4, T79c0ff0Tb4b4b4, T79c0ff1Tb4b4b4, T79c0ff1Tb4b4b4]Tb4b4b4, Ta5d6ff"Ta5d6ffmin_zoomTa5d6ff"Tb4b4b4: T79c0ff0Tb4b4b4, Ta5d6ff"Ta5d6ffmax_zoomTa5d6ff"Tb4b4b4: T79c0ff1Tb4b4b4}Tb4b4b4,

Te6edf3headersTff7b72=Te6edf3headersTb4b4b4,

Tb4b4b4)

Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff403