docs: document server-side rendering pipeline, response timing middleware, and Telegram pairing API

- Add comprehensive documentation for backend content rendering in AGENTS.md, detailing the new `render_content` and `render_title` Jinja globals built on mistune with media processing, emoji shortcodes, and XSS protection - Document the `X-Response-Time` header and bottom-left render time indicator in README.md - Update bot token pricing documentation to clarify fallback vs gateway cost headers - Add `email_accounts` to soft-delete tables and `idx_users_role` composite index in database schema - Implement `telegram_pairings` and `telegram_links` table creation with column migration and indexes - Add `/profile/{username}/telegram` endpoint to docs API with request/unpair actions - Register `TelegramService` in main.py lifespan and add `response_timing` middleware emitting `X-Response-Time` header - Introduce `TelegramPairForm` model and `guard_public_host_sync` synchronous host validation function
2026-06-18 22:09:34 +00:00
parent 95dca73291
commit 6ceca3d0d4
146 changed files with 6079 additions and 392 deletions
@@ -0,0 +1,86 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import requests
+
+from tests.conftest import BASE_URL
+
+_counter = [0]
+JSON = {"Accept": "application/json"}
+
+
+def _signup(password="secret123"):
+    _counter[0] += 1
+    name = f"tgpair{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": password,
+            "confirm_password": password,
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def test_owner_requests_pairing_code(app_server):
+    session, name = _signup()
+    resp = session.post(
+        f"{BASE_URL}/profile/{name}/telegram",
+        data={"action": "request"},
+        headers=JSON,
+    )
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["ok"] is True
+    assert body["code"].isdigit() and len(body["code"]) == 4
+    assert body["ttl_minutes"] >= 1
+
+
+def test_unpair_returns_ok(app_server):
+    session, name = _signup()
+    resp = session.post(
+        f"{BASE_URL}/profile/{name}/telegram",
+        data={"action": "unpair"},
+        headers=JSON,
+    )
+    assert resp.status_code == 200
+    assert resp.json()["paired"] is False
+
+
+def test_other_user_cannot_request_code(app_server):
+    _, target = _signup()
+    attacker, _ = _signup()
+    resp = attacker.post(
+        f"{BASE_URL}/profile/{target}/telegram",
+        data={"action": "request"},
+        headers=JSON,
+        allow_redirects=False,
+    )
+    assert resp.status_code == 403
+
+
+def test_request_without_json_redirects_to_profile(app_server):
+    session, name = _signup()
+    resp = session.post(
+        f"{BASE_URL}/profile/{name}/telegram",
+        data={"action": "request"},
+        allow_redirects=False,
+    )
+    assert resp.status_code == 302
+    assert resp.headers["location"] == f"/profile/{name}"
+
+
+def test_unpair_without_json_redirects_to_profile(app_server):
+    session, name = _signup()
+    resp = session.post(
+        f"{BASE_URL}/profile/{name}/telegram",
+        data={"action": "unpair"},
+        allow_redirects=False,
+    )
+    assert resp.status_code == 302
+    assert resp.headers["location"] == f"/profile/{name}"