Updpdate

tests/api/messages/conversations.py

@@ -0,0 +1,101 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="mconv"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _signup():
+    name = _unique()
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def test_conversations_requires_auth_401_for_json(app_server):
+    r = requests.get(
+        f"{BASE_URL}/messages/conversations", headers=JSON, allow_redirects=False
+    )
+    assert r.status_code == 401
+
+
+def test_conversations_requires_auth_redirects_browser(app_server):
+    r = requests.get(f"{BASE_URL}/messages/conversations", allow_redirects=False)
+    assert r.status_code == 303
+
+
+def test_conversations_matches_messages_page_shape(app_server):
+    sender, _ = _signup()
+    _, other_name = _signup()
+    other_uid = _uid(other_name)
+
+    sent = sender.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON,
+        data={"receiver_uid": other_uid, "content": "hello from parity test"},
+    )
+    assert sent.status_code == 200, sent.text[:300]
+
+    page = sender.get(f"{BASE_URL}/messages", headers=JSON)
+    assert page.status_code == 200, page.text[:300]
+    page_conversations = page.json()["conversations"]
+
+    flat = sender.get(f"{BASE_URL}/messages/conversations")
+    assert flat.status_code == 200, flat.text[:300]
+    flat_conversations = flat.json()["conversations"]
+
+    assert page_conversations == flat_conversations
+
+    match = next(
+        c for c in flat_conversations if c["other_user"]["uid"] == other_uid
+    )
+    assert match["last_message"] == "hello from parity test"
+    assert match["unread"] is False
+
+
+def test_conversations_excludes_blocked_user(app_server):
+    viewer, _ = _signup()
+    blocked, blocked_name = _signup()
+    blocked_uid = _uid(blocked_name)
+
+    reply = viewer.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON,
+        data={"receiver_uid": blocked_uid, "content": "before block"},
+    )
+    assert reply.status_code == 200, reply.text[:300]
+
+    before = viewer.get(f"{BASE_URL}/messages/conversations")
+    assert any(
+        c["other_user"]["uid"] == blocked_uid for c in before.json()["conversations"]
+    )
+
+    viewer.post(f"{BASE_URL}/block/{blocked_name}", allow_redirects=False)
+
+    after = viewer.get(f"{BASE_URL}/messages/conversations")
+    assert after.status_code == 200
+    assert not any(
+        c["other_user"]["uid"] == blocked_uid for c in after.json()["conversations"]
+    )

tests/api/messages/send.py

@@ -1,9 +1,11 @@
 # retoor <retoor@molodetz.nl>
 
+import io
 import time
 from datetime import datetime, timezone
 import pytest
 import requests
+from PIL import Image
 from tests.conftest import BASE_URL
 from devplacepy.database import get_table, refresh_snapshot, set_setting
 from devplacepy.utils import generate_uid, make_combined_slug
@@ -127,3 +129,40 @@ def test_message_send_recorded(seeded_db):
     ).json()["data"]
     admin = _admin(seeded_db)
     assert _find(admin, "message.send", lambda e: e.get("target_uid") == msg["uid"]) is not None
+
+
+def _png_bytes():
+    buf = io.BytesIO()
+    Image.new("RGB", (4, 4), (0, 128, 255)).save(buf, "PNG")
+    return buf.getvalue()
+
+
+def _upload(session, name="attach.png"):
+    r = session.post(
+        f"{BASE_URL}/uploads/upload", files={"file": (name, _png_bytes(), "image/png")}
+    )
+    assert r.status_code == 201, r.text
+    return r.json()["uid"]
+
+
+def test_send_attachment_only_empty_content_succeeds(seeded_db):
+    s, _ = _member()
+    receiver = _db_user("bob_test")["uid"]
+    attachment_uid = _upload(s)
+
+    r = s.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON_audit_log,
+        data={
+            "content": "",
+            "receiver_uid": receiver,
+            "attachment_uids": attachment_uid,
+        },
+    )
+    assert r.status_code == 200, r.text[:300]
+    msg = r.json()["data"]
+    assert msg["uid"]
+
+    refresh_snapshot()
+    row = get_table("messages").find_one(uid=msg["uid"])
+    assert row["content"] == ""

tests/api/messages/wsticket.py

@@ -0,0 +1,110 @@
+# retoor <retoor@molodetz.nl>
+
+import asyncio
+import json
+import time
+
+import pytest
+import requests
+import websockets
+
+from tests.conftest import BASE_URL, PORT
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+WS_URL = f"ws://127.0.0.1:{PORT}/messages/ws"
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _wsticket_settings(app_server):
+    for key, value in {
+        "rate_limit_per_minute": "1000000",
+        "rate_limit_window_seconds": "60",
+        "registration_open": "1",
+        "maintenance_mode": "0",
+    }.items():
+        set_setting(key, value)
+    yield
+
+
+def _unique(prefix="wst"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _signup():
+    name = _unique()
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+
+
+def _uid(name):
+    refresh_snapshot()
+    return get_table("users").find_one(username=name)["uid"]
+
+
+async def _recv_until(ws, frame_type, timeout=5.0):
+    deadline = asyncio.get_event_loop().time() + timeout
+    while True:
+        remaining = deadline - asyncio.get_event_loop().time()
+        if remaining <= 0:
+            raise AssertionError(f"timed out waiting for {frame_type}")
+        raw = await asyncio.wait_for(ws.recv(), timeout=remaining)
+        frame = json.loads(raw)
+        if frame.get("type") == frame_type:
+            return frame
+
+
+def test_ws_ticket_requires_auth_401_for_json(app_server):
+    r = requests.post(
+        f"{BASE_URL}/messages/ws-ticket", headers=JSON, allow_redirects=False
+    )
+    assert r.status_code == 401
+
+
+def test_ws_ticket_requires_auth_redirects_browser(app_server):
+    r = requests.post(f"{BASE_URL}/messages/ws-ticket", allow_redirects=False)
+    assert r.status_code == 303
+
+
+def test_ws_ticket_issued_for_logged_in_session(app_server):
+    session, _ = _signup()
+    r = session.post(f"{BASE_URL}/messages/ws-ticket", headers=JSON)
+    assert r.status_code == 200, r.text[:300]
+    data = r.json()
+    assert data["ticket"]
+    assert data["expires_in"] == 30
+
+
+def test_ws_ticket_single_use_and_authenticates_owner(app_server):
+    session, name = _signup()
+    owner_uid = _uid(name)
+
+    ticket = session.post(f"{BASE_URL}/messages/ws-ticket", headers=JSON).json()[
+        "ticket"
+    ]
+
+    async def first_connect():
+        async with websockets.connect(f"{WS_URL}?ticket={ticket}") as ws:
+            ready = await _recv_until(ws, "ready")
+            assert ready["user_uid"] == owner_uid
+
+    asyncio.run(first_connect())
+
+    async def second_connect():
+        async with websockets.connect(f"{WS_URL}?ticket={ticket}") as ws:
+            with pytest.raises(websockets.exceptions.ConnectionClosed):
+                await asyncio.wait_for(ws.recv(), timeout=3.0)
+
+    asyncio.run(second_connect())