This commit is contained in:
2026-07-19 18:57:43 +02:00
parent 48bb6c2ec2
commit c53e2a3319
179 changed files with 9307 additions and 897 deletions
+110
View File
@@ -0,0 +1,110 @@
# retoor <retoor@molodetz.nl>
import io
import requests
from datetime import datetime, timezone
from PIL import Image
from tests.conftest import BASE_URL
from devplacepy.attachments import store_attachment
from devplacepy.db_client import get_table
from devplacepy.utils import generate_uid, make_combined_slug
JSON = {"Accept": "application/json"}
def _login(seeded_db, who):
s = requests.Session()
creds = seeded_db[who]
s.post(
f"{BASE_URL}/auth/login",
data={"email": creds["email"], "password": creds["password"]},
allow_redirects=True,
)
return s
def _png():
buf = io.BytesIO()
Image.new("RGBA", (24, 24), (5, 5, 5, 255)).save(buf, format="PNG")
return buf.getvalue()
def _seed_published(receiver_username, giver_username):
receiver = get_table("users").find_one(username=receiver_username)
giver = get_table("users").find_one(username=giver_username)
uid = generate_uid()
slug = make_combined_slug("Admin revoke", uid)
now = datetime.now(timezone.utc).isoformat()
att512 = store_attachment(_png(), "award-512.png", receiver["uid"])
att256 = store_attachment(_png(), "award-256.png", giver["uid"])
att64 = store_attachment(_png(), "award-64.png", giver["uid"])
get_table("awards").insert(
{
"uid": uid,
"slug": slug,
"description": "Admin revoke",
"giver_uid": giver["uid"],
"receiver_uid": receiver["uid"],
"attachment_uid_512": att512["uid"],
"attachment_uid_256": att256["uid"],
"attachment_uid_64": att64["uid"],
"generated_at": now,
"created_at": now,
"job_uid": "",
"deleted_at": None,
"deleted_by": None,
}
)
get_table("users").update(
{
"uid": receiver["uid"],
"award_count": 1,
"last_award_at": now,
"last_award_slug": slug,
"last_award_uid": uid,
},
["uid"],
)
return uid, slug, att512["uid"]
def test_member_cannot_revoke_award(seeded_db):
uid, _, _ = _seed_published("bob_test", "alice_test")
bob = _login(seeded_db, "bob")
r = bob.post(f"{BASE_URL}/admin/awards/{uid}/revoke", allow_redirects=False)
assert r.status_code in (302, 303)
admin = _login(seeded_db, "alice")
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
def test_admin_revoke_soft_deletes_and_recomputes(seeded_db):
uid, slug, att512 = _seed_published("bob_test", "alice_test")
admin = _login(seeded_db, "alice")
r = admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
assert r.status_code == 200
row = get_table("awards").find_one(uid=uid)
assert row.get("deleted_at")
assert get_table("attachments").find_one(uid=att512).get("deleted_at")
bob = get_table("users").find_one(username="bob_test")
assert bob.get("award_count") == 0
assert requests.get(f"{BASE_URL}/awards/{slug}/64").status_code == 404
def test_media_gallery_hides_revoked_attachment(seeded_db):
uid, _, att512 = _seed_published("bob_test", "alice_test")
admin = _login(seeded_db, "alice")
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=media", headers=JSON)
assert r.status_code == 200
media = r.json().get("media", [])
assert all(item.get("uid") != att512 for item in media)
def test_admin_revoke_audit_recorded(seeded_db):
uid, _, _ = _seed_published("bob_test", "alice_test")
admin = _login(seeded_db, "alice")
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
data = admin.get(
f"{BASE_URL}/admin/audit-log", headers=JSON, params={"event_key": "award.revoke"}
).json()
assert any(entry.get("target_uid") == uid for entry in data["entries"])
+116
View File
@@ -0,0 +1,116 @@
# retoor <retoor@molodetz.nl>
import io
import requests
from datetime import datetime, timezone
from PIL import Image
from tests.conftest import BASE_URL
from devplacepy.attachments import store_attachment
from devplacepy.db_client import get_table
from devplacepy.utils import generate_uid, make_combined_slug
def _png():
buf = io.BytesIO()
Image.new("RGBA", (32, 32), (20, 40, 60, 255)).save(buf, format="PNG")
return buf.getvalue()
def _seed_published(receiver_uid, giver_uid, description="Published award"):
uid = generate_uid()
slug = make_combined_slug(description, uid)
now = datetime.now(timezone.utc).isoformat()
att = store_attachment(_png(), "award-256.png", receiver_uid)
get_table("awards").insert(
{
"uid": uid,
"slug": slug,
"description": description,
"giver_uid": giver_uid,
"receiver_uid": receiver_uid,
"attachment_uid_512": att["uid"],
"attachment_uid_256": att["uid"],
"attachment_uid_64": att["uid"],
"generated_at": now,
"created_at": now,
"job_uid": "",
"deleted_at": None,
"deleted_by": None,
}
)
return uid, slug, att["url"]
def _user():
uid = generate_uid()
get_table("users").insert(
{
"uid": uid,
"username": f"aw_{uid[:8]}",
"email": f"{uid[:8]}@t.dev",
"created_at": datetime.now(timezone.utc).isoformat(),
}
)
return uid
def test_published_award_redirects(app_server):
giver = _user()
receiver = _user()
_, slug, url = _seed_published(receiver, giver)
r = requests.get(f"{BASE_URL}/awards/{slug}/256", allow_redirects=False)
assert r.status_code == 302
assert r.headers["Location"] == url
assert "immutable" in r.headers.get("Cache-Control", "")
def test_pending_award_returns_404(app_server):
uid = generate_uid()
slug = make_combined_slug("pending", uid)
now = datetime.now(timezone.utc).isoformat()
get_table("awards").insert(
{
"uid": uid,
"slug": slug,
"description": "pending",
"giver_uid": _user(),
"receiver_uid": _user(),
"attachment_uid_512": "",
"attachment_uid_256": "",
"attachment_uid_64": "",
"generated_at": None,
"created_at": now,
"job_uid": "",
"deleted_at": None,
"deleted_by": None,
}
)
assert requests.get(f"{BASE_URL}/awards/{slug}/256").status_code == 404
def test_revoked_award_returns_404(app_server):
giver = _user()
receiver = _user()
uid, slug, _ = _seed_published(receiver, giver, "revoked")
get_table("awards").update(
{"uid": uid, "deleted_at": datetime.now(timezone.utc).isoformat(), "deleted_by": giver},
["uid"],
)
assert requests.get(f"{BASE_URL}/awards/{slug}/64").status_code == 404
def test_lookup_by_bare_uid_works(app_server):
giver = _user()
receiver = _user()
uid, slug, url = _seed_published(receiver, giver, "uid lookup")
r = requests.get(f"{BASE_URL}/awards/{uid}/256", allow_redirects=False)
assert r.status_code == 302
assert r.headers["Location"] == url
assert slug
def test_invalid_size_returns_404(app_server):
giver = _user()
receiver = _user()
_, slug, _ = _seed_published(receiver, giver)
assert requests.get(f"{BASE_URL}/awards/{slug}/128").status_code == 404
+190
View File
@@ -0,0 +1,190 @@
# retoor <retoor@molodetz.nl>
import time
import requests
from datetime import datetime, timezone
from tests.conftest import BASE_URL
from devplacepy.db_client import get_table
from devplacepy.utils import generate_uid, make_combined_slug
JSON = {"Accept": "application/json"}
_counter = [0]
def _signup():
_counter[0] += 1
name = f"award{int(time.time() * 1000)}{_counter[0]}"
session = requests.Session()
session.post(
f"{BASE_URL}/auth/signup",
data={
"username": name,
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
},
allow_redirects=True,
)
return session, name
def _login(seeded_db, who):
s = requests.Session()
creds = seeded_db[who]
s.post(
f"{BASE_URL}/auth/login",
data={"email": creds["email"], "password": creds["password"]},
allow_redirects=True,
)
return s
def _uid(username):
return get_table("users").find_one(username=username)["uid"]
def _audit_find(admin, event_key, target_uid):
data = admin.get(
f"{BASE_URL}/admin/audit-log", headers=JSON, params={"event_key": event_key}
).json()
for entry in data["entries"]:
if entry.get("target_uid") == target_uid:
return entry
return None
def test_give_award_json_shape(app_server):
giver, _ = _signup()
_, receiver_name = _signup()
r = giver.post(
f"{BASE_URL}/profile/{receiver_name}/award",
headers=JSON,
json={"description": "Great debugging"},
)
assert r.status_code == 200, r.text
data = r.json()
assert data["ok"] is True
assert data["data"]["award_uid"]
assert data["data"]["award_slug"]
def test_guest_cannot_give_award(seeded_db):
r = requests.post(
f"{BASE_URL}/profile/bob_test/award",
headers=JSON,
json={"description": "Nope"},
allow_redirects=False,
)
assert r.status_code in (302, 303, 401, 403)
def test_self_award_rejected(seeded_db):
bob = _login(seeded_db, "bob")
r = bob.post(
f"{BASE_URL}/profile/bob_test/award",
headers=JSON,
json={"description": "Self"},
)
assert r.status_code == 400
def test_blocked_pair_rejects_award(seeded_db):
alice = _login(seeded_db, "alice")
bob = _login(seeded_db, "bob")
alice.post(f"{BASE_URL}/block/bob_test", allow_redirects=False)
try:
r = alice.post(
f"{BASE_URL}/profile/bob_test/award",
headers=JSON,
json={"description": "Blocked"},
)
assert r.status_code == 400
r2 = bob.post(
f"{BASE_URL}/profile/alice_test/award",
headers=JSON,
json={"description": "Reverse blocked"},
)
assert r2.status_code == 400
finally:
alice.post(f"{BASE_URL}/block/unblock/bob_test", allow_redirects=False)
def test_giver_cooldown_rejects_second_award(app_server):
giver, giver_name = _signup()
_, target_a = _signup()
_, target_b = _signup()
first = giver.post(
f"{BASE_URL}/profile/{target_a}/award",
headers=JSON,
json={"description": "First award"},
)
assert first.status_code == 200
second = giver.post(
f"{BASE_URL}/profile/{target_b}/award",
headers=JSON,
json={"description": "Second award"},
)
assert second.status_code == 400
assert giver_name
def test_receiver_cooldown_rejects_second_award(app_server):
giver_a, _ = _signup()
giver_b, _ = _signup()
_, receiver = _signup()
first = giver_a.post(
f"{BASE_URL}/profile/{receiver}/award",
headers=JSON,
json={"description": "From giver a"},
)
assert first.status_code == 200
second = giver_b.post(
f"{BASE_URL}/profile/{receiver}/award",
headers=JSON,
json={"description": "From giver b"},
)
assert second.status_code == 400
def test_muted_receiver_still_accepts_award(app_server):
giver, giver_name = _signup()
receiver_session, receiver_name = _signup()
receiver_session.post(f"{BASE_URL}/mute/{giver_name}", allow_redirects=False)
try:
r = giver.post(
f"{BASE_URL}/profile/{receiver_name}/award",
headers=JSON,
json={"description": "Muted ok"},
)
assert r.status_code == 200
finally:
receiver_session.post(f"{BASE_URL}/mute/unmute/{giver_name}", allow_redirects=False)
def test_valid_post_creates_pending_row_and_job(app_server):
giver, _ = _signup()
_, receiver_name = _signup()
r = giver.post(
f"{BASE_URL}/profile/{receiver_name}/award",
headers=JSON,
json={"description": "Fresh pending"},
)
assert r.status_code == 200
award_uid = r.json()["data"]["award_uid"]
row = get_table("awards").find_one(uid=award_uid)
assert row.get("generated_at") is None
job = get_table("jobs").find_one(uid=row.get("job_uid"))
assert job and job.get("kind") == "award"
def test_award_give_audit_recorded(app_server):
giver, _ = _signup()
_, receiver_name = _signup()
r = giver.post(
f"{BASE_URL}/profile/{receiver_name}/award",
headers=JSON,
json={"description": "Audit me"},
)
assert r.status_code == 200
entry = _audit_find(giver, "award.give", _uid(receiver_name))
assert entry is not None
+93
View File
@@ -0,0 +1,93 @@
# retoor <retoor@molodetz.nl>
import io
import requests
from datetime import datetime, timezone
from PIL import Image
from tests.conftest import BASE_URL
from devplacepy.attachments import store_attachment
from devplacepy.db_client import get_table
from devplacepy.utils import generate_uid, make_combined_slug
JSON = {"Accept": "application/json"}
def _png():
buf = io.BytesIO()
Image.new("RGBA", (16, 16), (90, 10, 10, 255)).save(buf, format="PNG")
return buf.getvalue()
def _seed_published(receiver_username, giver_username, description):
receiver = get_table("users").find_one(username=receiver_username)
giver = get_table("users").find_one(username=giver_username)
uid = generate_uid()
slug = make_combined_slug(description, uid)
now = datetime.now(timezone.utc).isoformat()
att = store_attachment(_png(), "award-256.png", receiver["uid"])
get_table("awards").insert(
{
"uid": uid,
"slug": slug,
"description": description,
"giver_uid": giver["uid"],
"receiver_uid": receiver["uid"],
"attachment_uid_512": att["uid"],
"attachment_uid_256": att["uid"],
"attachment_uid_64": att["uid"],
"generated_at": now,
"created_at": now,
"job_uid": "",
"deleted_at": None,
"deleted_by": None,
}
)
get_table("users").update(
{
"uid": receiver["uid"],
"award_count": 1,
"last_award_at": now,
"last_award_slug": slug,
"last_award_uid": uid,
},
["uid"],
)
return slug
def test_awards_tab_html_contains_grid_and_slug(seeded_db):
slug = _seed_published("bob_test", "alice_test", "Tab award")
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=awards")
assert r.status_code == 200
assert "awards-grid" in r.text
assert slug in r.text
def test_guest_can_read_awards_tab(seeded_db):
_seed_published("bob_test", "alice_test", "Guest read")
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=awards")
assert r.status_code == 200
assert "Give Award" not in r.text
def test_awards_tab_json_includes_list(seeded_db):
slug = _seed_published("bob_test", "alice_test", "JSON tab")
r = requests.get(
f"{BASE_URL}/profile/bob_test?tab=awards",
headers=JSON,
)
assert r.status_code == 200
data = r.json()
assert data["awards_count"] >= 1
assert any(item.get("slug") == slug for item in data.get("awards", []))
def test_awards_tab_absent_when_count_zero(seeded_db):
bob = get_table("users").find_one(username="bob_test")
get_table("users").update(
{"uid": bob["uid"], "award_count": 0, "last_award_uid": None, "last_award_slug": None},
["uid"],
)
r = requests.get(f"{BASE_URL}/profile/bob_test")
assert r.status_code == 200
assert "tab=awards" not in r.text
+109
View File
@@ -0,0 +1,109 @@
# retoor <retoor@molodetz.nl>
import time
import pytest
import requests
from tests.conftest import BASE_URL
from devplacepy.database import get_table, refresh_snapshot, set_setting
JSON = {"Accept": "application/json"}
_counter = [0]
@pytest.fixture(scope="module", autouse=True)
def _settings(app_server):
set_setting("rate_limit_per_minute", "1000000")
set_setting("registration_open", "1")
set_setting("devii_interactions_default", "1")
yield
def _member():
_counter[0] += 1
name = f"ixp{int(time.time() * 1000)}{_counter[0]}"
requests.post(
f"{BASE_URL}/auth/signup",
data={
"username": name,
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
},
allow_redirects=True,
)
refresh_snapshot()
user = get_table("users").find_one(username=name)
return name, user["uid"], user["api_key"]
def _admin_key(seeded_db):
refresh_snapshot()
return get_table("users").find_one(username="alice_test")["api_key"]
def test_owner_disables_interactions(app_server):
name, uid, key = _member()
r = requests.post(
f"{BASE_URL}/profile/{name}/interactions",
headers={"X-API-KEY": key, **JSON},
data={"enabled": "false"},
)
assert r.status_code == 200, r.text[:200]
body = r.json()["data"]
assert body["enabled"] is False
assert body["source"] == "user"
refresh_snapshot()
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
def test_owner_resets_to_default(app_server):
name, uid, key = _member()
requests.post(
f"{BASE_URL}/profile/{name}/interactions",
headers={"X-API-KEY": key, **JSON},
data={"enabled": "false"},
)
r = requests.post(
f"{BASE_URL}/profile/{name}/interactions",
headers={"X-API-KEY": key, **JSON},
data={"reset": "true"},
)
assert r.status_code == 200
body = r.json()["data"]
assert body["source"] == "default"
refresh_snapshot()
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == -1
def test_admin_sets_for_other_user(seeded_db):
name, uid, key = _member()
r = requests.post(
f"{BASE_URL}/profile/{name}/interactions",
headers={"X-API-KEY": _admin_key(seeded_db), **JSON},
data={"enabled": "false"},
)
assert r.status_code == 200
refresh_snapshot()
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
def test_non_owner_forbidden(app_server):
name, uid, key = _member()
_, _, other_key = _member()
r = requests.post(
f"{BASE_URL}/profile/{name}/interactions",
headers={"X-API-KEY": other_key, **JSON},
data={"enabled": "false"},
)
assert r.status_code == 403
def test_guest_rejected(app_server):
name, uid, key = _member()
r = requests.post(
f"{BASE_URL}/profile/{name}/interactions",
headers=JSON,
data={"enabled": "false"},
allow_redirects=False,
)
assert r.status_code in (401, 303)