--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
tests/backend/test_demo_mode_http_oracle.py master (b89dc9e6) Text, 2.21 KB
T8b949e# SPDX-License-Identifier: 0BSD
T8b949e"""Oracle: demo mode blocks HTTP mutations outside the allowlist."""
Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations
Tff7b72import T7ee787pytest
Tff7b72from T7ee787aiohttpT7ee787.T7ee787test_utils Tff7b72import Te6edf3TestClientTb4b4b4, Te6edf3TestServer
Tff7b72from T7ee787hypothesis Tff7b72import Te6edf3givenTb4b4b4, Te6edf3settings
Tff7b72from T7ee787hypothesis Tff7b72import Te6edf3strategies Tff7b72as Te6edf3st
Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787demo_mode Tff7b72import Tb4b4b4(
Te6edf3DEMO_HTTP_MUTATION_ALLOWLISTTb4b4b4,
Te6edf3DEMO_READONLY_CODETb4b4b4,
Te6edf3demo_http_mutation_allowedTb4b4b4,
Tb4b4b4)
Tff7b72from T7ee787testsT7ee787.T7ee787backendT7ee787.T7ee787demo_http_support Tff7b72import Te6edf3build_test_aio_app
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffparametrizeTb4b4b4(
Tb4b4b4(Ta5d6ff"Ta5d6ffmethodTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffpathTa5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4[
Tb4b4b4(Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/api/v1/lxmf-messages/sendTa5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4(Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/api/v1/identities/createTa5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4(Ta5d6ff"Ta5d6ffDELETETa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/api/v1/lxmf-messages/aaTa5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4(Ta5d6ff"Ta5d6ffPATCHTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/api/v1/server/securityTa5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4]Tb4b4b4,
Tb4b4b4)
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tff7b72async Tff7b72def Td2a8fftest_demo_mode_blocks_disallowed_mutationsTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3methodTb4b4b4, Te6edf3pathTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffdemo_mode Tff7b72= Tff7b72True
Te6edf3mock_appTff7b72.Td2a8ffcurrent_contextTff7b72.Td2a8ffrunning Tff7b72= Tff7b72True
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72FalseTb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3build_test_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3response Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffrequestTb4b4b4(Te6edf3methodTb4b4b4, Te6edf3pathTb4b4b4, Te6edf3jsonTff7b72=Tb4b4b4{Tb4b4b4}Tb4b4b4)
Tff7b72assert Te6edf3responseTff7b72.Td2a8ffstatus Tff7b72== T79c0ff403
Te6edf3body Tff7b72= Tff7b72await Te6edf3responseTff7b72.Td2a8ffjsonTb4b4b4(Tb4b4b4)
Tff7b72assert Te6edf3bodyTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffcodeTa5d6ff"Tb4b4b4) Tff7b72== Te6edf3DEMO_READONLY_CODE
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tff7b72async Tff7b72def Td2a8fftest_demo_mode_status_includes_flagsTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffdemo_mode Tff7b72= Tff7b72True
Te6edf3mock_appTff7b72.Td2a8ffaltcha_enabled Tff7b72= Tff7b72True
Te6edf3mock_appTff7b72.Td2a8ffcurrent_contextTff7b72.Td2a8ffrunning Tff7b72= Tff7b72True
Te6edf3mock_appTff7b72.Td2a8ff_network_ready Tff7b72= Tff7b72True
Te6edf3payload Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_startup_status_payloadTb4b4b4(Tb4b4b4)
Tff7b72assert Te6edf3payloadTb4b4b4[Ta5d6ff"Ta5d6ffdemo_modeTa5d6ff"Tb4b4b4] Tff7b72is Tff7b72True
Tff7b72assert Te6edf3payloadTb4b4b4[Ta5d6ff"Ta5d6ffaltcha_enabledTa5d6ff"Tb4b4b4] Tff7b72is Tff7b72True
Tf0883e@givenTb4b4b4(
Te6edf3suffixTff7b72=Te6edf3stTff7b72.Td2a8fftextTb4b4b4(
Te6edf3alphabetTff7b72=Te6edf3stTff7b72.Td2a8ffcharactersTb4b4b4(Te6edf3blacklist_categoriesTff7b72=Tb4b4b4(Ta5d6ff"Ta5d6ffCsTa5d6ff"Tb4b4b4,Tb4b4b4)Tb4b4b4)Tb4b4b4,
Te6edf3min_sizeTff7b72=T79c0ff0Tb4b4b4,
Te6edf3max_sizeTff7b72=T79c0ff24Tb4b4b4,
Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Tf0883e@settingsTb4b4b4(Te6edf3max_examplesTff7b72=T79c0ff40Tb4b4b4, Te6edf3deadlineTff7b72=Tff7b72NoneTb4b4b4)
Tff7b72def Td2a8fftest_demo_http_mutation_fuzz_rejects_unknown_pathsTb4b4b4(Te6edf3suffixTb4b4b4)Tb4b4b4:
Te6edf3path Tff7b72= Ta5d6fffTa5d6ff"Ta5d6ff/api/v1/lxmf-messages/sendTffd700{Te6edf3suffixTffd700}Ta5d6ff"
Tff7b72if Te6edf3path Tff7b72in Te6edf3DEMO_HTTP_MUTATION_ALLOWLISTTb4b4b4:
Tff7b72return
Tff7b72assert Te6edf3demo_http_mutation_allowedTb4b4b4(Ta5d6ff"Ta5d6ffPOSTTa5d6ff"Tb4b4b4, Te6edf3pathTb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8fftest_allowlist_is_explicit_setTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72assert Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff" Tff7b72in Te6edf3DEMO_HTTP_MUTATION_ALLOWLIST
Tff7b72assert Ta5d6ff"Ta5d6ff/api/v1/lxmf-messages/sendTa5d6ff" Tff7b72not Tff7b72in Te6edf3DEMO_HTTP_MUTATION_ALLOWLIST
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────