devplacepy/tests/api/zips/download.py

# retoor <retoor@molodetz.nl>

import asyncio
import io
import json
import time
import zipfile
from pathlib import Path
import pytest
import requests
from playwright.sync_api import expect
from tests.conftest import BASE_URL, CACHE_VERSION_PROPAGATION_SECONDS
from devplacepy.database import get_table, refresh_snapshot, set_setting
from devplacepy.services.jobs import queue
from devplacepy.services.jobs.zip_service import ZipService
from tests.conftest import run_async
_counter_zip_download = [0]


@pytest.fixture(scope="module", autouse=True)
def _disable_happy_404(app_server):
    set_setting("happy_404_enabled", "0")
    time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
    yield
    set_setting("happy_404_enabled", "1")
    time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
def _signup_zip_download():
    _counter_zip_download[0] += 1
    name = f"zd{int(time.time() * 1000)}{_counter_zip_download[0]}"
    session = requests.Session()
    session.post(
        f"{BASE_URL}/auth/signup",
        data={
            "username": name,
            "email": f"{name}@t.dev",
            "password": "secret123",
            "confirm_password": "secret123",
            "birth_date": "1990-01-01",
            "accept_terms": "1",
        },
        allow_redirects=True,
    )
    refresh_snapshot()
    key = get_table("users").find_one(username=name)["api_key"]
    return name, key
def _h_zip_download(key):
    return {"X-API-KEY": key, "Accept": "application/json"}
def _create_project_zip_download(key, title):
    r = requests.post(
        f"{BASE_URL}/projects/create",
        headers=_h_zip_download(key),
        data={
            "title": title,
            "description": "zip download test",
            "project_type": "software",
            "status": "In Development",
        },
    )
    assert r.status_code == 200, r.text
    return r.json()["data"]
def _write_zip_download(key, slug, path, content):
    r = requests.post(
        f"{BASE_URL}/projects/{slug}/files/write",
        headers=_h_zip_download(key),
        data={"path": path, "content": content},
        allow_redirects=False,
    )
    assert r.status_code in (200, 302), r.text
def _process_uid(uid):
    async def drive():
        svc = ZipService()
        for _ in range(400):
            await svc.run_once()
            refresh_snapshot()
            job = queue.get_job(uid)
            if job and job["status"] in ("done", "failed"):
                return
            await asyncio.sleep(0.05)

    run_async(drive())
def _drain_pending():
    async def drive():
        svc = ZipService()
        appeared = False
        for _ in range(600):
            refresh_snapshot()
            pending = [
                r
                for r in get_table("jobs").find(kind="zip")
                if r["status"] in ("pending", "running")
            ]
            if pending:
                appeared = True
            await svc.run_once()
            refresh_snapshot()
            pending = [
                r
                for r in get_table("jobs").find(kind="zip")
                if r["status"] in ("pending", "running")
            ]
            if appeared and not pending and not svc._inflight:
                return
            await asyncio.sleep(0.05)

    run_async(drive())
def _cleanup_archives():
    refresh_snapshot()
    jobs = get_table("jobs")
    for row in list(jobs.find(kind="zip")):
        result = json.loads(row.get("result") or "{}")
        local_path = result.get("local_path")
        if local_path:
            Path(local_path).unlink(missing_ok=True)
        jobs.delete(uid=row["uid"])
def _login_zip_download(page, name):
    page.goto(f"{BASE_URL}/auth/login", wait_until="domcontentloaded")
    page.fill("#email", f"{name}@t.dev")
    page.fill("#password", "secret123")
    page.click("button:has-text('Sign in')")
    page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")


def test_capability_download_works_without_auth(app_server):
    try:
        _, key = _signup_zip_download()
        proj = _create_project_zip_download(key, "Capability")
        slug = proj["slug"] or proj["uid"]
        _write_zip_download(key, slug, "README.md", "# hi")
        uid = requests.post(f"{BASE_URL}/projects/{slug}/zip", headers=_h_zip_download(key)).json()[
            "uid"
        ]
        _process_uid(uid)
        # No auth header at all - the uuid7 is the capability token.
        dl = requests.get(f"{BASE_URL}/zips/{uid}/download")
        assert dl.status_code == 200
        assert dl.headers["content-type"] == "application/zip"
    finally:
        _cleanup_archives()


def test_download_pending_job_404(app_server):
    try:
        _, key = _signup_zip_download()
        proj = _create_project_zip_download(key, "Pending Download")
        slug = proj["slug"] or proj["uid"]
        _write_zip_download(key, slug, "README.md", "# hi")
        uid = requests.post(f"{BASE_URL}/projects/{slug}/zip", headers=_h_zip_download(key)).json()[
            "uid"
        ]
        r = requests.get(f"{BASE_URL}/zips/{uid}/download")
        assert r.status_code == 404
    finally:
        _cleanup_archives()


def test_download_path_outside_root_blocked(app_server):
    try:
        uid = queue.enqueue("zip", {}, "user", "u", "evil")
        get_table("jobs").update(
            {
                "uid": uid,
                "status": "done",
                "result": json.dumps(
                    {
                        "local_path": "/etc/passwd",
                        "final_name": "passwd.zip",
                        "download_url": f"/zips/{uid}/download",
                    }
                ),
                "expires_at": "2999-01-01T00:00:00+00:00",
            },
            ["uid"],
        )
        r = requests.get(f"{BASE_URL}/zips/{uid}/download")
        assert r.status_code == 404
    finally:
        get_table("jobs").delete(kind="zip")