forked from retoor/devplacepy
feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins
- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin - Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API) - Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()` - Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs - Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics
This commit is contained in:
@@ -0,0 +1,129 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy import config
|
||||
from devplacepy.database import get_table, get_primary_admin_uid, refresh_snapshot
|
||||
from devplacepy.services.backup import store
|
||||
from devplacepy.utils import clear_user_cache
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
_counter = [0]
|
||||
|
||||
|
||||
def _signup():
|
||||
_counter[0] += 1
|
||||
name = f"bkp{int(time.time() * 1000)}{_counter[0]}"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
refresh_snapshot()
|
||||
return get_table("users").find_one(username=name)
|
||||
|
||||
|
||||
def _make_admin():
|
||||
row = _signup()
|
||||
get_table("users").update({"uid": row["uid"], "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(row["uid"])
|
||||
return row["api_key"]
|
||||
|
||||
|
||||
def _primary_admin_key():
|
||||
refresh_snapshot()
|
||||
uid = get_primary_admin_uid()
|
||||
return get_table("users").find_one(uid=uid)["api_key"]
|
||||
|
||||
|
||||
def _seed_done_backup(owner_uid):
|
||||
backup_uid = store.create_backup(
|
||||
target="database", created_by=owner_uid, job_uid="jobtest"
|
||||
)
|
||||
target_dir = config.BACKUPS_DIR
|
||||
target_dir.mkdir(parents=True, exist_ok=True)
|
||||
path = target_dir / f"{backup_uid}.tar.gz"
|
||||
path.write_bytes(b"\x1f\x8b\x08\x00test-archive")
|
||||
store.finalize_backup(
|
||||
backup_uid,
|
||||
filename="database-test.tar.gz",
|
||||
local_path=str(path),
|
||||
stats={"bytes_out": path.stat().st_size, "file_count": 1},
|
||||
)
|
||||
refresh_snapshot()
|
||||
return backup_uid
|
||||
|
||||
|
||||
def test_download_requires_admin_guest(app_server):
|
||||
assert (
|
||||
requests.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
).status_code
|
||||
== 401
|
||||
)
|
||||
assert (
|
||||
requests.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download", allow_redirects=False
|
||||
).status_code
|
||||
== 303
|
||||
)
|
||||
|
||||
|
||||
def test_download_denied_for_member(app_server, seeded_db):
|
||||
s = requests.Session()
|
||||
s.post(
|
||||
f"{BASE_URL}/auth/login",
|
||||
data={
|
||||
"email": seeded_db["bob"]["email"],
|
||||
"password": seeded_db["bob"]["password"],
|
||||
},
|
||||
)
|
||||
r = s.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download", headers=JSON, allow_redirects=False
|
||||
)
|
||||
assert r.status_code == 403
|
||||
|
||||
|
||||
def test_download_and_flag_denied_for_non_primary_admin(app_server):
|
||||
key = _make_admin()
|
||||
headers = {**JSON, "X-API-KEY": key}
|
||||
assert (
|
||||
requests.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download",
|
||||
headers=headers,
|
||||
allow_redirects=False,
|
||||
).status_code
|
||||
== 403
|
||||
)
|
||||
data = requests.get(f"{BASE_URL}/admin/backups/data", headers=headers).json()
|
||||
assert data["can_download_backups"] is False
|
||||
assert all(b.get("download_url") is None for b in data["backups"])
|
||||
|
||||
|
||||
def test_primary_admin_flag_true(app_server):
|
||||
headers = {**JSON, "X-API-KEY": _primary_admin_key()}
|
||||
data = requests.get(f"{BASE_URL}/admin/backups/data", headers=headers).json()
|
||||
assert data["can_download_backups"] is True
|
||||
|
||||
|
||||
def test_primary_admin_can_download_archive(app_server):
|
||||
uid = get_primary_admin_uid()
|
||||
key = get_table("users").find_one(uid=uid)["api_key"]
|
||||
backup_uid = _seed_done_backup(uid)
|
||||
headers = {**JSON, "X-API-KEY": key}
|
||||
|
||||
data = requests.get(f"{BASE_URL}/admin/backups/data", headers=headers).json()
|
||||
rows = [b for b in data["backups"] if b["uid"] == backup_uid]
|
||||
assert rows and rows[0]["download_url"] == f"/admin/backups/{backup_uid}/download"
|
||||
|
||||
r = requests.get(f"{BASE_URL}/admin/backups/{backup_uid}/download", headers=headers)
|
||||
assert r.status_code == 200
|
||||
assert r.headers["content-type"] == "application/gzip"
|
||||
@@ -1,8 +1,52 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.database import get_table, refresh_snapshot
|
||||
from devplacepy.utils import clear_user_cache
|
||||
|
||||
_counter_search = [0]
|
||||
|
||||
|
||||
def _signup_search():
|
||||
_counter_search[0] += 1
|
||||
name = f"cas{int(time.time() * 1000)}{_counter_search[0]}"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
row = get_table("users").find_one(username=name)
|
||||
return name, row["uid"], row["api_key"]
|
||||
|
||||
|
||||
def _make_admin_search():
|
||||
name, uid, key = _signup_search()
|
||||
get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(uid)
|
||||
return name, uid, key
|
||||
|
||||
|
||||
def _create_private_project(key, title):
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/projects/create",
|
||||
headers={"X-API-KEY": key, "Accept": "application/json"},
|
||||
data={
|
||||
"title": title,
|
||||
"description": "search test",
|
||||
"project_type": "software",
|
||||
"status": "In Development",
|
||||
"is_private": "on",
|
||||
},
|
||||
)
|
||||
assert r.status_code == 200, r.text
|
||||
return r.json()["data"]["slug"]
|
||||
|
||||
|
||||
def _admin_session():
|
||||
@@ -33,3 +77,21 @@ def test_project_search_empty_query(app_server, seeded_db):
|
||||
r = s.get(f"{BASE_URL}/admin/containers/projects/search?q=")
|
||||
assert r.status_code == 200
|
||||
assert r.json()["results"] == []
|
||||
|
||||
|
||||
def test_project_search_hides_other_admin_private_project(app_server):
|
||||
_, _, owner_key = _make_admin_search()
|
||||
_, _, other_admin_key = _make_admin_search()
|
||||
title = f"SearchHidden{int(time.time() * 1000)}"
|
||||
slug = _create_private_project(owner_key, title)
|
||||
|
||||
other = requests.Session()
|
||||
other.headers.update({"X-API-KEY": other_admin_key})
|
||||
r = other.get(f"{BASE_URL}/admin/containers/projects/search?q={title}")
|
||||
assert r.status_code == 200
|
||||
assert slug not in [row["slug"] for row in r.json()["results"]]
|
||||
|
||||
owner = requests.Session()
|
||||
owner.headers.update({"X-API-KEY": owner_key})
|
||||
r = owner.get(f"{BASE_URL}/admin/containers/projects/search?q={title}")
|
||||
assert slug in [row["slug"] for row in r.json()["results"]]
|
||||
|
||||
@@ -0,0 +1,166 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import pytest
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.database import get_table, refresh_snapshot, set_setting
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
_counter = [0]
|
||||
|
||||
|
||||
@pytest.fixture(scope="module", autouse=True)
|
||||
def _settings(app_server):
|
||||
for key, value in {
|
||||
"rate_limit_per_minute": "1000000",
|
||||
"rate_limit_window_seconds": "60",
|
||||
"registration_open": "1",
|
||||
"maintenance_mode": "0",
|
||||
"session_max_age_days": "7",
|
||||
"session_remember_days": "30",
|
||||
}.items():
|
||||
set_setting(key, value)
|
||||
yield
|
||||
|
||||
|
||||
def _db_user(name):
|
||||
refresh_snapshot()
|
||||
return get_table("users").find_one(username=name)
|
||||
|
||||
|
||||
def _unique(prefix="sen"):
|
||||
_counter[0] += 1
|
||||
return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
|
||||
|
||||
|
||||
def _signup():
|
||||
name = _unique("senmem")
|
||||
s = requests.Session()
|
||||
s.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
return name
|
||||
|
||||
|
||||
def _key_session(name):
|
||||
s = requests.Session()
|
||||
s.headers.update({"X-API-KEY": _db_user(name)["api_key"]})
|
||||
return s
|
||||
|
||||
|
||||
def _alice():
|
||||
return _key_session("alice_test")
|
||||
|
||||
|
||||
def _promote(actor, uid):
|
||||
actor.post(
|
||||
f"{BASE_URL}/admin/users/{uid}/role",
|
||||
headers=JSON,
|
||||
data={"role": "admin"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
|
||||
|
||||
def _audit(session, **params):
|
||||
r = session.get(f"{BASE_URL}/admin/audit-log", headers=JSON, params=params)
|
||||
assert r.status_code == 200, r.text[:300]
|
||||
return r.json()["entries"]
|
||||
|
||||
|
||||
def _denied(session, event_key, target_uid):
|
||||
for e in _audit(session, event_key=event_key, result="denied"):
|
||||
if e.get("target_uid") == target_uid:
|
||||
return e
|
||||
return None
|
||||
|
||||
|
||||
def _junior_admin(seeded_db):
|
||||
alice = _alice()
|
||||
name = _signup()
|
||||
uid = _db_user(name)["uid"]
|
||||
_promote(alice, uid)
|
||||
assert _db_user(name)["role"] == "Admin"
|
||||
return _key_session(name), name, uid
|
||||
|
||||
|
||||
def test_junior_admin_cannot_change_senior_admin_role(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/role",
|
||||
headers=JSON,
|
||||
data={"role": "member"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.role.change", alice_uid) is not None
|
||||
assert _db_user("alice_test")["role"] == "Admin"
|
||||
|
||||
|
||||
def test_junior_admin_cannot_disable_senior_admin(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/toggle",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.active.disable", alice_uid) is not None
|
||||
assert _db_user("alice_test").get("is_active", True)
|
||||
|
||||
|
||||
def test_junior_admin_cannot_reset_senior_admin_password(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
before = _db_user("alice_test")["password_hash"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/password",
|
||||
headers=JSON,
|
||||
data={"password": "hijacked999"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.password.reset", alice_uid) is not None
|
||||
assert _db_user("alice_test")["password_hash"] == before
|
||||
|
||||
|
||||
def test_junior_admin_cannot_reset_senior_admin_quota(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/reset-ai-quota",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.ai_quota.reset", alice_uid) is not None
|
||||
|
||||
|
||||
def test_senior_admin_can_disable_junior_admin(seeded_db):
|
||||
_junior, _, junior_uid = _junior_admin(seeded_db)
|
||||
alice = _alice()
|
||||
alice.post(
|
||||
f"{BASE_URL}/admin/users/{junior_uid}/toggle",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
refresh_snapshot()
|
||||
assert not get_table("users").find_one(uid=junior_uid).get("is_active", True)
|
||||
|
||||
|
||||
def test_junior_admin_can_manage_member(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
member = _signup()
|
||||
member_uid = _db_user(member)["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{member_uid}/toggle",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
refresh_snapshot()
|
||||
assert not get_table("users").find_one(uid=member_uid).get("is_active", True)
|
||||
+38
-35
@@ -1,51 +1,54 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
MARK = "_apitest_dbapi_crud"
|
||||
from devplacepy.database import get_table, purge
|
||||
from devplacepy.utils import generate_uid
|
||||
|
||||
MARK = "_apitest_dbapi_readonly"
|
||||
|
||||
|
||||
def test_list_requires_auth(client):
|
||||
assert client.get("/dbapi/users").status_code == 403
|
||||
|
||||
|
||||
def test_crud_round_trip(client, auth):
|
||||
created = client.post(
|
||||
def test_reads_work(client, auth):
|
||||
uid = generate_uid()
|
||||
get_table("bookmarks").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"user_uid": MARK,
|
||||
"target_type": "post",
|
||||
"target_uid": "t1",
|
||||
"deleted_at": None,
|
||||
"deleted_by": None,
|
||||
}
|
||||
)
|
||||
try:
|
||||
listing = client.get(f"/dbapi/bookmarks?filter.user_uid={MARK}", headers=auth)
|
||||
assert listing.status_code == 200
|
||||
assert listing.json()["count"] == 1
|
||||
|
||||
got = client.get(f"/dbapi/bookmarks/uid/{uid}", headers=auth)
|
||||
assert got.status_code == 200
|
||||
assert got.json()["row"]["uid"] == uid
|
||||
finally:
|
||||
purge("bookmarks", user_uid=MARK)
|
||||
|
||||
|
||||
def test_writes_are_not_available(client, auth):
|
||||
insert = client.post(
|
||||
"/dbapi/bookmarks",
|
||||
json={"user_uid": MARK, "target_type": "post", "target_uid": "t1"},
|
||||
headers=auth,
|
||||
)
|
||||
assert created.status_code == 200
|
||||
row = created.json()["row"]
|
||||
uid = row["uid"]
|
||||
assert row["deleted_at"] is None
|
||||
try:
|
||||
got = client.get(f"/dbapi/bookmarks/uid/{uid}", headers=auth)
|
||||
assert got.json()["row"]["uid"] == uid
|
||||
|
||||
updated = client.patch(
|
||||
f"/dbapi/bookmarks/uid/{uid}", json={"target_uid": "t2"}, headers=auth
|
||||
)
|
||||
assert updated.json()["row"]["target_uid"] == "t2"
|
||||
|
||||
deleted = client.delete(f"/dbapi/bookmarks/uid/{uid}", headers=auth)
|
||||
assert deleted.json()["mode"] == "soft"
|
||||
live = client.get(f"/dbapi/bookmarks?filter.user_uid={MARK}", headers=auth)
|
||||
assert live.json()["count"] == 0
|
||||
with_deleted = client.get(
|
||||
f"/dbapi/bookmarks?filter.user_uid={MARK}&include_deleted=true", headers=auth
|
||||
)
|
||||
assert with_deleted.json()["count"] == 1
|
||||
|
||||
restored = client.post(f"/dbapi/bookmarks/uid/{uid}/restore", headers=auth)
|
||||
assert restored.json()["row"]["deleted_at"] is None
|
||||
finally:
|
||||
client.delete(f"/dbapi/bookmarks/uid/{uid}?hard=true", headers=auth)
|
||||
|
||||
|
||||
def test_insert_unknown_column_is_400(client, auth):
|
||||
response = client.post(
|
||||
"/dbapi/bookmarks", json={"user_uid": MARK, "no_such_col": 1}, headers=auth
|
||||
assert insert.status_code in (404, 405)
|
||||
patched = client.patch(
|
||||
"/dbapi/bookmarks/uid/whatever", json={"target_uid": "t2"}, headers=auth
|
||||
)
|
||||
assert response.status_code == 400
|
||||
assert patched.status_code in (404, 405)
|
||||
removed = client.delete("/dbapi/bookmarks/uid/whatever", headers=auth)
|
||||
assert removed.status_code in (404, 405)
|
||||
restored = client.post("/dbapi/bookmarks/uid/whatever/restore", headers=auth)
|
||||
assert restored.status_code in (404, 405)
|
||||
|
||||
|
||||
def test_get_missing_row_is_404(client, auth):
|
||||
|
||||
@@ -78,6 +78,16 @@ def _list_slugs(key=None, user_uid=None):
|
||||
params = {"user_uid": user_uid} if user_uid else None
|
||||
r = requests.get(f"{BASE_URL}/projects", headers=_h_project_visibility(key), params=params)
|
||||
return [p["slug"] for p in r.json()["projects"]]
|
||||
def _detail_status(key, slug):
|
||||
return requests.get(
|
||||
f"{BASE_URL}/projects/{slug}", headers=_h_project_visibility(key)
|
||||
).status_code
|
||||
def _file_raw_status(key, slug, path):
|
||||
return requests.get(
|
||||
f"{BASE_URL}/projects/{slug}/files/raw",
|
||||
headers=_h_project_visibility(key),
|
||||
params={"path": path},
|
||||
).status_code
|
||||
|
||||
|
||||
def test_private_project_hidden_from_guest_listing(app_server):
|
||||
@@ -101,6 +111,29 @@ def test_private_project_visible_to_admin(app_server):
|
||||
assert slug in _list_slugs(key=admin_key, user_uid=owner_uid)
|
||||
|
||||
|
||||
def test_admin_private_hidden_from_other_admin(app_server):
|
||||
_, owner_uid, owner_key = _make_admin_project_visibility()
|
||||
_, _, other_admin_key = _make_admin_project_visibility()
|
||||
slug = _create_project_project_visibility(
|
||||
owner_key, "Admin Hidden", is_private=True
|
||||
)["slug"]
|
||||
assert slug not in _list_slugs(key=other_admin_key, user_uid=owner_uid)
|
||||
assert _detail_status(other_admin_key, slug) == 404
|
||||
assert _file_raw_status(other_admin_key, slug, "missing.txt") == 404
|
||||
assert slug in _list_slugs(key=owner_key, user_uid=owner_uid)
|
||||
assert _detail_status(owner_key, slug) == 200
|
||||
|
||||
|
||||
def test_member_private_still_visible_to_admin(app_server):
|
||||
_, owner_uid, owner_key = _signup_project_visibility()
|
||||
_, _, admin_key = _make_admin_project_visibility()
|
||||
slug = _create_project_project_visibility(
|
||||
owner_key, "Member Hidden", is_private=True
|
||||
)["slug"]
|
||||
assert slug in _list_slugs(key=admin_key, user_uid=owner_uid)
|
||||
assert _detail_status(admin_key, slug) == 200
|
||||
|
||||
|
||||
def test_toggle_private_then_public(app_server):
|
||||
_, owner_uid, key = _signup_project_visibility()
|
||||
slug = _create_project_project_visibility(key, "Toggle Privacy")["slug"]
|
||||
|
||||
@@ -0,0 +1,84 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.database import get_table
|
||||
from devplacepy.utils import clear_user_cache
|
||||
|
||||
_counter_cv = [0]
|
||||
|
||||
|
||||
def _signup():
|
||||
_counter_cv[0] += 1
|
||||
name = f"cav{int(time.time() * 1000)}{_counter_cv[0]}"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
row = get_table("users").find_one(username=name)
|
||||
return name, row["uid"], row["api_key"]
|
||||
|
||||
|
||||
def _make_admin():
|
||||
name, uid, key = _signup()
|
||||
get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(uid)
|
||||
return name, uid, key
|
||||
|
||||
|
||||
def _headers(key=None):
|
||||
headers = {"Accept": "application/json"}
|
||||
if key:
|
||||
headers["X-API-KEY"] = key
|
||||
return headers
|
||||
|
||||
|
||||
def _create_project(key, title, is_private=False):
|
||||
data = {
|
||||
"title": title,
|
||||
"description": "container access test",
|
||||
"project_type": "software",
|
||||
"status": "In Development",
|
||||
}
|
||||
if is_private:
|
||||
data["is_private"] = "on"
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/projects/create", headers=_headers(key), data=data
|
||||
)
|
||||
assert r.status_code == 200, r.text
|
||||
return r.json()["data"]["slug"]
|
||||
|
||||
|
||||
def _containers_data_status(key, slug):
|
||||
return requests.get(
|
||||
f"{BASE_URL}/projects/{slug}/containers/data", headers=_headers(key)
|
||||
).status_code
|
||||
|
||||
|
||||
def test_admin_private_project_containers_hidden_from_other_admin(app_server):
|
||||
_, _, owner_key = _make_admin()
|
||||
_, _, other_admin_key = _make_admin()
|
||||
slug = _create_project(owner_key, "Admin Container Hidden", is_private=True)
|
||||
assert _containers_data_status(other_admin_key, slug) == 404
|
||||
assert _containers_data_status(owner_key, slug) == 200
|
||||
|
||||
|
||||
def test_member_private_project_containers_visible_to_admin(app_server):
|
||||
_, _, owner_key = _signup()
|
||||
_, _, admin_key = _make_admin()
|
||||
slug = _create_project(owner_key, "Member Container Hidden", is_private=True)
|
||||
assert _containers_data_status(admin_key, slug) == 200
|
||||
|
||||
|
||||
def test_public_project_containers_visible_to_any_admin(app_server):
|
||||
_, _, owner_key = _make_admin()
|
||||
_, _, other_admin_key = _make_admin()
|
||||
slug = _create_project(owner_key, "Public Container", is_private=False)
|
||||
assert _containers_data_status(other_admin_key, slug) == 200
|
||||
@@ -0,0 +1,102 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from tests.conftest import BASE_URL, login_user
|
||||
from devplacepy import config
|
||||
from devplacepy.database import get_table, get_primary_admin_uid, refresh_snapshot
|
||||
from devplacepy.services.backup import store
|
||||
from devplacepy.utils import clear_user_cache
|
||||
|
||||
_counter = [0]
|
||||
|
||||
|
||||
def _make_admin():
|
||||
_counter[0] += 1
|
||||
name = f"bke{int(time.time() * 1000)}{_counter[0]}"
|
||||
password = "secret123"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": password,
|
||||
"confirm_password": password,
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
refresh_snapshot()
|
||||
row = get_table("users").find_one(username=name)
|
||||
get_table("users").update({"uid": row["uid"], "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(row["uid"])
|
||||
return {"email": f"{name}@t.dev", "password": password, "uid": row["uid"]}
|
||||
|
||||
|
||||
def _seed_done_backup(owner_uid):
|
||||
backup_uid = store.create_backup(
|
||||
target="database", created_by=owner_uid, job_uid="jobe2e"
|
||||
)
|
||||
config.BACKUPS_DIR.mkdir(parents=True, exist_ok=True)
|
||||
path = config.BACKUPS_DIR / f"{backup_uid}.tar.gz"
|
||||
path.write_bytes(b"\x1f\x8b\x08\x00e2e-archive")
|
||||
store.finalize_backup(
|
||||
backup_uid,
|
||||
filename="database-e2e.tar.gz",
|
||||
local_path=str(path),
|
||||
stats={"bytes_out": path.stat().st_size, "file_count": 1},
|
||||
)
|
||||
refresh_snapshot()
|
||||
return backup_uid
|
||||
|
||||
|
||||
def _row(page, backup_uid):
|
||||
return page.locator(
|
||||
f"tr:has(button[data-action='delete-backup'][data-uid='{backup_uid}'])"
|
||||
)
|
||||
|
||||
|
||||
def test_download_disabled_with_tooltip_for_non_primary_admin(page, app_server):
|
||||
_make_admin()
|
||||
admin = _make_admin()
|
||||
assert get_primary_admin_uid() != admin["uid"]
|
||||
backup_uid = _seed_done_backup(admin["uid"])
|
||||
|
||||
login_user(page, admin)
|
||||
page.goto(f"{BASE_URL}/admin/backups", wait_until="domcontentloaded")
|
||||
row = _row(page, backup_uid)
|
||||
row.wait_for(state="visible", timeout=15000)
|
||||
|
||||
blocked = row.locator("button.admin-btn:has-text('Download')")
|
||||
blocked.wait_for(state="visible")
|
||||
assert blocked.is_disabled()
|
||||
assert blocked.get_attribute("title") == "Not available"
|
||||
assert row.locator("a.admin-btn:has-text('Download')").count() == 0
|
||||
|
||||
|
||||
def test_download_enabled_for_primary_admin(page, app_server):
|
||||
admin = _make_admin()
|
||||
refresh_snapshot()
|
||||
others = [
|
||||
r["uid"]
|
||||
for r in get_table("users").find(role="Admin")
|
||||
if r["uid"] != admin["uid"]
|
||||
]
|
||||
for uid in others:
|
||||
get_table("users").update({"uid": uid, "role": "Member"}, ["uid"])
|
||||
clear_user_cache(uid)
|
||||
try:
|
||||
assert get_primary_admin_uid() == admin["uid"]
|
||||
backup_uid = _seed_done_backup(admin["uid"])
|
||||
login_user(page, admin)
|
||||
page.goto(f"{BASE_URL}/admin/backups", wait_until="domcontentloaded")
|
||||
row = _row(page, backup_uid)
|
||||
row.wait_for(state="visible", timeout=15000)
|
||||
|
||||
link = row.locator("a.admin-btn:has-text('Download')")
|
||||
link.wait_for(state="visible")
|
||||
assert link.get_attribute("href") == f"/admin/backups/{backup_uid}/download"
|
||||
assert row.locator("button.admin-btn[title='Not available']").count() == 0
|
||||
finally:
|
||||
for uid in others:
|
||||
get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(uid)
|
||||
@@ -3,6 +3,7 @@
|
||||
from datetime import datetime, timezone
|
||||
from devplacepy.content import (
|
||||
is_owner,
|
||||
can_view_project,
|
||||
canonical_redirect,
|
||||
first_image_url,
|
||||
enrich_items,
|
||||
@@ -96,6 +97,54 @@ def test_is_owner_matches_user_uid():
|
||||
assert is_owner({"user_uid": "u1"}, None) is False
|
||||
|
||||
|
||||
def _make_user(role="Member"):
|
||||
uid = generate_uid()
|
||||
username = f"cv_{uid[:8]}"
|
||||
get_table("users").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"username": username,
|
||||
"email": f"{username}@t.dev",
|
||||
"role": role,
|
||||
"created_at": datetime.now(timezone.utc).isoformat(),
|
||||
}
|
||||
)
|
||||
return get_table("users").find_one(uid=uid)
|
||||
|
||||
|
||||
def test_can_view_project_public_visible_to_everyone(local_db):
|
||||
owner = _make_user()
|
||||
other = _make_user()
|
||||
admin = _make_user("Admin")
|
||||
project = {"user_uid": owner["uid"], "is_private": 0}
|
||||
assert can_view_project(project, owner) is True
|
||||
assert can_view_project(project, other) is True
|
||||
assert can_view_project(project, admin) is True
|
||||
assert can_view_project(project, None) is True
|
||||
|
||||
|
||||
def test_can_view_member_private_visible_to_owner_and_admin(local_db):
|
||||
owner = _make_user()
|
||||
other = _make_user()
|
||||
admin = _make_user("Admin")
|
||||
project = {"user_uid": owner["uid"], "is_private": 1}
|
||||
assert can_view_project(project, owner) is True
|
||||
assert can_view_project(project, admin) is True
|
||||
assert can_view_project(project, other) is False
|
||||
assert can_view_project(project, None) is False
|
||||
|
||||
|
||||
def test_can_view_admin_private_visible_to_owner_admin_only(local_db):
|
||||
owner_admin = _make_user("Admin")
|
||||
other_admin = _make_user("Admin")
|
||||
member = _make_user()
|
||||
project = {"user_uid": owner_admin["uid"], "is_private": 1}
|
||||
assert can_view_project(project, owner_admin) is True
|
||||
assert can_view_project(project, other_admin) is False
|
||||
assert can_view_project(project, member) is False
|
||||
assert can_view_project(project, None) is False
|
||||
|
||||
|
||||
def test_canonical_redirect_when_slug_differs():
|
||||
item = {"slug": "abcd1234-title", "uid": "abcd1234"}
|
||||
assert canonical_redirect("posts", item, "abcd1234-title") is None
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
from devplacepy.routers.admin.users import _is_senior_admin, _seniority_key
|
||||
|
||||
SENIOR_ADMIN = {
|
||||
"uid": "senior",
|
||||
"role": "Admin",
|
||||
"created_at": "2024-01-01T00:00:00+00:00",
|
||||
"id": 1,
|
||||
}
|
||||
JUNIOR_ADMIN = {
|
||||
"uid": "junior",
|
||||
"role": "Admin",
|
||||
"created_at": "2025-01-01T00:00:00+00:00",
|
||||
"id": 9,
|
||||
}
|
||||
OLD_MEMBER = {
|
||||
"uid": "member",
|
||||
"role": "Member",
|
||||
"created_at": "2020-01-01T00:00:00+00:00",
|
||||
"id": 0,
|
||||
}
|
||||
|
||||
|
||||
def test_junior_admin_cannot_manage_senior_admin():
|
||||
assert _is_senior_admin(JUNIOR_ADMIN, SENIOR_ADMIN) is True
|
||||
|
||||
|
||||
def test_senior_admin_can_manage_junior_admin():
|
||||
assert _is_senior_admin(SENIOR_ADMIN, JUNIOR_ADMIN) is False
|
||||
|
||||
|
||||
def test_members_are_never_protected():
|
||||
assert _is_senior_admin(JUNIOR_ADMIN, OLD_MEMBER) is False
|
||||
assert _is_senior_admin(SENIOR_ADMIN, OLD_MEMBER) is False
|
||||
|
||||
|
||||
def test_acting_on_self_is_not_protected():
|
||||
assert _is_senior_admin(SENIOR_ADMIN, SENIOR_ADMIN) is False
|
||||
assert _is_senior_admin(JUNIOR_ADMIN, JUNIOR_ADMIN) is False
|
||||
|
||||
|
||||
def test_none_target_is_not_protected():
|
||||
assert _is_senior_admin(SENIOR_ADMIN, None) is False
|
||||
|
||||
|
||||
def test_equal_created_at_tiebreaks_on_id():
|
||||
earlier = {"uid": "e1", "role": "Admin", "created_at": "2024-01-01T00:00:00", "id": 3}
|
||||
later = {"uid": "e2", "role": "Admin", "created_at": "2024-01-01T00:00:00", "id": 5}
|
||||
assert _is_senior_admin(later, earlier) is True
|
||||
assert _is_senior_admin(earlier, later) is False
|
||||
|
||||
|
||||
def test_missing_created_at_sorts_oldest_failsafe():
|
||||
no_date = {"uid": "nc", "role": "Admin", "created_at": None, "id": 2}
|
||||
assert _is_senior_admin(SENIOR_ADMIN, no_date) is True
|
||||
|
||||
|
||||
def test_seniority_key_orders_by_created_at_then_id():
|
||||
assert _seniority_key(SENIOR_ADMIN) < _seniority_key(JUNIOR_ADMIN)
|
||||
assert _seniority_key({"created_at": None, "id": 0}) == ("", 0)
|
||||
@@ -5,86 +5,56 @@ import pytest
|
||||
from devplacepy.database import get_table, purge
|
||||
from devplacepy.services.dbapi import crud
|
||||
from devplacepy.services.dbapi.crud import DbApiError
|
||||
from devplacepy.utils import generate_uid
|
||||
|
||||
ACTOR = "unit_dbapi_actor"
|
||||
MARK = "_unit_dbapi_crud"
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def clean_bookmarks(local_db):
|
||||
yield
|
||||
def seeded_bookmark(local_db):
|
||||
uid = generate_uid()
|
||||
get_table("bookmarks").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"user_uid": MARK,
|
||||
"target_type": "post",
|
||||
"target_uid": "t1",
|
||||
"deleted_at": None,
|
||||
"deleted_by": None,
|
||||
}
|
||||
)
|
||||
yield uid
|
||||
purge("bookmarks", user_uid=MARK)
|
||||
|
||||
|
||||
def _insert():
|
||||
return crud.insert_row(
|
||||
"bookmarks",
|
||||
{"user_uid": MARK, "target_type": "post", "target_uid": "t1"},
|
||||
ACTOR,
|
||||
)
|
||||
def test_get_row(seeded_bookmark):
|
||||
row = crud.get_row("bookmarks", "uid", seeded_bookmark)
|
||||
assert row["uid"] == seeded_bookmark
|
||||
assert row["user_uid"] == MARK
|
||||
|
||||
|
||||
def test_insert_is_born_live(clean_bookmarks):
|
||||
row = _insert()
|
||||
assert row["uid"]
|
||||
assert row["deleted_at"] is None
|
||||
assert row["deleted_by"] is None
|
||||
assert row.get("created_at")
|
||||
def test_list_rows_filters(seeded_bookmark):
|
||||
rows, _ = crud.list_rows("bookmarks", filters={"user_uid": MARK})
|
||||
assert len(rows) == 1
|
||||
assert rows[0]["uid"] == seeded_bookmark
|
||||
|
||||
|
||||
def test_insert_rejects_unknown_columns(clean_bookmarks):
|
||||
with pytest.raises(DbApiError):
|
||||
crud.insert_row("bookmarks", {"user_uid": MARK, "no_such_col": 1}, ACTOR)
|
||||
|
||||
|
||||
def test_get_and_update_row(clean_bookmarks):
|
||||
row = _insert()
|
||||
fetched = crud.get_row("bookmarks", "uid", row["uid"])
|
||||
assert fetched["uid"] == row["uid"]
|
||||
updated = crud.update_row(
|
||||
"bookmarks", "uid", row["uid"], {"target_uid": "t2"}, ACTOR
|
||||
)
|
||||
assert updated["target_uid"] == "t2"
|
||||
|
||||
|
||||
def test_update_cannot_change_uid(clean_bookmarks):
|
||||
row = _insert()
|
||||
crud.update_row("bookmarks", "uid", row["uid"], {"uid": "hacked"}, ACTOR)
|
||||
assert get_table("bookmarks").find_one(uid="hacked") is None
|
||||
|
||||
|
||||
def test_soft_delete_then_restore(clean_bookmarks):
|
||||
row = _insert()
|
||||
outcome = crud.delete_row("bookmarks", "uid", row["uid"], ACTOR)
|
||||
assert outcome["mode"] == "soft"
|
||||
live, _ = crud.list_rows("bookmarks", filters={"user_uid": MARK})
|
||||
assert live == []
|
||||
deleted, _ = crud.list_rows(
|
||||
"bookmarks", filters={"user_uid": MARK}, include_deleted=True
|
||||
)
|
||||
assert len(deleted) == 1
|
||||
restored = crud.restore_row("bookmarks", "uid", row["uid"], ACTOR)
|
||||
assert restored["deleted_at"] is None
|
||||
|
||||
|
||||
def test_hard_delete_purges(clean_bookmarks):
|
||||
row = _insert()
|
||||
outcome = crud.delete_row("bookmarks", "uid", row["uid"], ACTOR, hard=True)
|
||||
assert outcome["mode"] == "hard"
|
||||
assert get_table("bookmarks").find_one(uid=row["uid"]) is None
|
||||
|
||||
|
||||
def test_list_rows_caps_limit(clean_bookmarks):
|
||||
def test_list_rows_caps_limit(seeded_bookmark):
|
||||
rows, _ = crud.list_rows("bookmarks", limit=99999)
|
||||
assert isinstance(rows, list)
|
||||
|
||||
|
||||
def test_schema_reports_soft_delete(local_db):
|
||||
def test_schema_reports_soft_delete(seeded_bookmark):
|
||||
schema = crud.schema("bookmarks")
|
||||
assert schema["soft_delete"] is True
|
||||
assert any(c["name"] == "uid" for c in schema["columns"])
|
||||
|
||||
|
||||
def test_bad_key_raises(local_db):
|
||||
def test_bad_key_raises(seeded_bookmark):
|
||||
with pytest.raises(DbApiError):
|
||||
crud.get_row("bookmarks", "no_such_key", "x")
|
||||
|
||||
|
||||
def test_no_write_functions_exist():
|
||||
for name in ("insert_row", "update_row", "delete_row", "restore_row"):
|
||||
assert not hasattr(crud, name)
|
||||
|
||||
@@ -29,12 +29,10 @@ def test_db_get_tools_are_read_only():
|
||||
assert _records_mutation(name) is False
|
||||
|
||||
|
||||
def test_db_mutation_tools_record_and_confirm():
|
||||
for name in ("db_insert_row", "db_update_row", "db_delete_row"):
|
||||
action = BY_NAME[name]
|
||||
assert action.is_read_only is False
|
||||
assert _records_mutation(name) is True
|
||||
assert name in CONFIRM_REQUIRED
|
||||
def test_db_has_no_mutation_tools():
|
||||
for name in ("db_insert_row", "db_update_row", "db_delete_row", "db_restore_row"):
|
||||
assert name not in BY_NAME
|
||||
assert name not in CONFIRM_REQUIRED
|
||||
|
||||
|
||||
def test_seo_report_is_public_read_only_http_action():
|
||||
|
||||
+78
-1
@@ -1,6 +1,6 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
from devplacepy.database import get_table
|
||||
from devplacepy.database import get_table, get_primary_admin_uid
|
||||
from devplacepy.utils import (
|
||||
award_badge,
|
||||
award_xp,
|
||||
@@ -10,6 +10,7 @@ from devplacepy.utils import (
|
||||
extract_mentions,
|
||||
generate_uid,
|
||||
hash_password,
|
||||
is_primary_admin,
|
||||
level_for_xp,
|
||||
safe_next,
|
||||
slugify,
|
||||
@@ -156,6 +157,82 @@ def test_extract_mentions_finds_usernames():
|
||||
assert mentions == ["alice", "bob_1"]
|
||||
|
||||
|
||||
def _seed_user_at(role, created_at):
|
||||
uid = generate_uid()
|
||||
get_table("users").insert(
|
||||
{
|
||||
"uid": uid,
|
||||
"username": f"pa_{uid[:8]}",
|
||||
"email": f"pa_{uid[:8]}@t.dev",
|
||||
"role": role,
|
||||
"created_at": created_at.isoformat(),
|
||||
}
|
||||
)
|
||||
return get_table("users").find_one(uid=uid)
|
||||
|
||||
|
||||
def _demote_existing_admins():
|
||||
existing = [r["uid"] for r in get_table("users").find(role="Admin")]
|
||||
for uid in existing:
|
||||
get_table("users").update({"uid": uid, "role": "Member"}, ["uid"])
|
||||
return existing
|
||||
|
||||
|
||||
def _restore_admins(uids):
|
||||
for uid in uids:
|
||||
get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
|
||||
|
||||
|
||||
def _purge(*rows):
|
||||
for row in rows:
|
||||
get_table("users").delete(uid=row["uid"])
|
||||
|
||||
|
||||
def test_primary_admin_is_earliest_admin(local_db):
|
||||
restore = _demote_existing_admins()
|
||||
member = admin_first = admin_second = None
|
||||
try:
|
||||
base = datetime.now(timezone.utc)
|
||||
member = _seed_user_at("Member", base)
|
||||
admin_first = _seed_user_at("Admin", base + timedelta(seconds=1))
|
||||
admin_second = _seed_user_at("Admin", base + timedelta(seconds=2))
|
||||
|
||||
assert get_primary_admin_uid() == admin_first["uid"]
|
||||
assert is_primary_admin(admin_first) is True
|
||||
assert is_primary_admin(admin_second) is False
|
||||
assert is_primary_admin(member) is False
|
||||
assert is_primary_admin(None) is False
|
||||
finally:
|
||||
_purge(*[r for r in (member, admin_first, admin_second) if r])
|
||||
_restore_admins(restore)
|
||||
|
||||
|
||||
def test_primary_admin_reassigns_when_founder_demoted(local_db):
|
||||
restore = _demote_existing_admins()
|
||||
admin_first = admin_second = None
|
||||
try:
|
||||
base = datetime.now(timezone.utc)
|
||||
admin_first = _seed_user_at("Admin", base + timedelta(seconds=1))
|
||||
admin_second = _seed_user_at("Admin", base + timedelta(seconds=2))
|
||||
assert get_primary_admin_uid() == admin_first["uid"]
|
||||
|
||||
get_table("users").update(
|
||||
{"uid": admin_first["uid"], "role": "Member"}, ["uid"]
|
||||
)
|
||||
assert get_primary_admin_uid() == admin_second["uid"]
|
||||
assert (
|
||||
is_primary_admin(get_table("users").find_one(uid=admin_second["uid"]))
|
||||
is True
|
||||
)
|
||||
assert (
|
||||
is_primary_admin(get_table("users").find_one(uid=admin_first["uid"]))
|
||||
is False
|
||||
)
|
||||
finally:
|
||||
_purge(*[r for r in (admin_first, admin_second) if r])
|
||||
_restore_admins(restore)
|
||||
|
||||
|
||||
def test_award_badge_is_idempotent(local_db):
|
||||
uid, _ = _seed_user()
|
||||
assert award_badge(uid, "First Post") is True
|
||||
|
||||
Reference in New Issue
Block a user