68 lines
2.3 KiB
Python
68 lines
2.3 KiB
Python
"""Login gate: closed only once a password or Telegram login is configured."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from app.services import auth_service
|
|
|
|
|
|
def test_open_by_default(client):
|
|
assert client.get("/api/settings").status_code == 200
|
|
|
|
|
|
def test_password_hash_round_trips():
|
|
hashed = auth_service.hash_password("correct horse battery staple")
|
|
assert auth_service.verify_password("correct horse battery staple", hashed)
|
|
assert not auth_service.verify_password("wrong", hashed)
|
|
|
|
|
|
def test_login_flow(client):
|
|
from app.db import SessionLocal
|
|
from app.services import settings_service
|
|
|
|
db = SessionLocal()
|
|
try:
|
|
settings = settings_service.load_settings(db)
|
|
settings.auth.password_hash = auth_service.hash_password("s3cret!!")
|
|
settings_service.save_settings(db, settings)
|
|
finally:
|
|
db.close()
|
|
|
|
# Locked out without a session.
|
|
assert client.get("/api/settings").status_code == 401
|
|
assert client.get("/api/auth/me").json()["login_required"] is True
|
|
|
|
bad = client.post("/api/auth/login", json={"username": "timka", "password": "nope"})
|
|
assert bad.status_code == 401
|
|
|
|
ok = client.post("/api/auth/login", json={"username": "timka", "password": "s3cret!!"})
|
|
assert ok.status_code == 200
|
|
assert "kadence_session" in client.cookies
|
|
|
|
assert client.get("/api/settings").status_code == 200
|
|
assert client.get("/api/auth/me").json()["authenticated"] is True
|
|
|
|
client.post("/api/auth/logout")
|
|
assert client.get("/api/settings").status_code == 401
|
|
|
|
|
|
def test_api_token_still_works_once_login_is_configured(client, monkeypatch):
|
|
from app.config import env_settings
|
|
from app.db import SessionLocal
|
|
from app.services import settings_service
|
|
|
|
env_settings.cache_clear()
|
|
monkeypatch.setenv("API_TOKEN", "desktop-secret")
|
|
env_settings.cache_clear()
|
|
|
|
db = SessionLocal()
|
|
try:
|
|
settings = settings_service.load_settings(db)
|
|
settings.auth.password_hash = auth_service.hash_password("s3cret!!")
|
|
settings_service.save_settings(db, settings)
|
|
finally:
|
|
db.close()
|
|
|
|
assert client.get("/api/settings").status_code == 401
|
|
assert client.get("/api/settings", headers={"X-API-Token": "desktop-secret"}).status_code == 200
|
|
env_settings.cache_clear()
|