Update

2026-07-19 18:57:43 +02:00
parent 48bb6c2ec2
commit c53e2a3319
179 changed files with 9307 additions and 897 deletions
@@ -0,0 +1,190 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from datetime import datetime, timezone
+from tests.conftest import BASE_URL
+from devplacepy.db_client import get_table
+from devplacepy.utils import generate_uid, make_combined_slug
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"award{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _login(seeded_db, who):
+    s = requests.Session()
+    creds = seeded_db[who]
+    s.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": creds["email"], "password": creds["password"]},
+        allow_redirects=True,
+    )
+    return s
+
+
+def _uid(username):
+    return get_table("users").find_one(username=username)["uid"]
+
+
+def _audit_find(admin, event_key, target_uid):
+    data = admin.get(
+        f"{BASE_URL}/admin/audit-log", headers=JSON, params={"event_key": event_key}
+    ).json()
+    for entry in data["entries"]:
+        if entry.get("target_uid") == target_uid:
+            return entry
+    return None
+
+
+def test_give_award_json_shape(app_server):
+    giver, _ = _signup()
+    _, receiver_name = _signup()
+    r = giver.post(
+        f"{BASE_URL}/profile/{receiver_name}/award",
+        headers=JSON,
+        json={"description": "Great debugging"},
+    )
+    assert r.status_code == 200, r.text
+    data = r.json()
+    assert data["ok"] is True
+    assert data["data"]["award_uid"]
+    assert data["data"]["award_slug"]
+
+
+def test_guest_cannot_give_award(seeded_db):
+    r = requests.post(
+        f"{BASE_URL}/profile/bob_test/award",
+        headers=JSON,
+        json={"description": "Nope"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (302, 303, 401, 403)
+
+
+def test_self_award_rejected(seeded_db):
+    bob = _login(seeded_db, "bob")
+    r = bob.post(
+        f"{BASE_URL}/profile/bob_test/award",
+        headers=JSON,
+        json={"description": "Self"},
+    )
+    assert r.status_code == 400
+
+
+def test_blocked_pair_rejects_award(seeded_db):
+    alice = _login(seeded_db, "alice")
+    bob = _login(seeded_db, "bob")
+    alice.post(f"{BASE_URL}/block/bob_test", allow_redirects=False)
+    try:
+        r = alice.post(
+            f"{BASE_URL}/profile/bob_test/award",
+            headers=JSON,
+            json={"description": "Blocked"},
+        )
+        assert r.status_code == 400
+        r2 = bob.post(
+            f"{BASE_URL}/profile/alice_test/award",
+            headers=JSON,
+            json={"description": "Reverse blocked"},
+        )
+        assert r2.status_code == 400
+    finally:
+        alice.post(f"{BASE_URL}/block/unblock/bob_test", allow_redirects=False)
+
+
+def test_giver_cooldown_rejects_second_award(app_server):
+    giver, giver_name = _signup()
+    _, target_a = _signup()
+    _, target_b = _signup()
+    first = giver.post(
+        f"{BASE_URL}/profile/{target_a}/award",
+        headers=JSON,
+        json={"description": "First award"},
+    )
+    assert first.status_code == 200
+    second = giver.post(
+        f"{BASE_URL}/profile/{target_b}/award",
+        headers=JSON,
+        json={"description": "Second award"},
+    )
+    assert second.status_code == 400
+    assert giver_name
+
+
+def test_receiver_cooldown_rejects_second_award(app_server):
+    giver_a, _ = _signup()
+    giver_b, _ = _signup()
+    _, receiver = _signup()
+    first = giver_a.post(
+        f"{BASE_URL}/profile/{receiver}/award",
+        headers=JSON,
+        json={"description": "From giver a"},
+    )
+    assert first.status_code == 200
+    second = giver_b.post(
+        f"{BASE_URL}/profile/{receiver}/award",
+        headers=JSON,
+        json={"description": "From giver b"},
+    )
+    assert second.status_code == 400
+
+
+def test_muted_receiver_still_accepts_award(app_server):
+    giver, giver_name = _signup()
+    receiver_session, receiver_name = _signup()
+    receiver_session.post(f"{BASE_URL}/mute/{giver_name}", allow_redirects=False)
+    try:
+        r = giver.post(
+            f"{BASE_URL}/profile/{receiver_name}/award",
+            headers=JSON,
+            json={"description": "Muted ok"},
+        )
+        assert r.status_code == 200
+    finally:
+        receiver_session.post(f"{BASE_URL}/mute/unmute/{giver_name}", allow_redirects=False)
+
+
+def test_valid_post_creates_pending_row_and_job(app_server):
+    giver, _ = _signup()
+    _, receiver_name = _signup()
+    r = giver.post(
+        f"{BASE_URL}/profile/{receiver_name}/award",
+        headers=JSON,
+        json={"description": "Fresh pending"},
+    )
+    assert r.status_code == 200
+    award_uid = r.json()["data"]["award_uid"]
+    row = get_table("awards").find_one(uid=award_uid)
+    assert row.get("generated_at") is None
+    job = get_table("jobs").find_one(uid=row.get("job_uid"))
+    assert job and job.get("kind") == "award"
+
+
+def test_award_give_audit_recorded(app_server):
+    giver, _ = _signup()
+    _, receiver_name = _signup()
+    r = giver.post(
+        f"{BASE_URL}/profile/{receiver_name}/award",
+        headers=JSON,
+        json={"description": "Audit me"},
+    )
+    assert r.status_code == 200
+    entry = _audit_find(giver, "award.give", _uid(receiver_name))
+    assert entry is not None
@@ -0,0 +1,93 @@
+# retoor <retoor@molodetz.nl>
+
+import io
+import requests
+from datetime import datetime, timezone
+from PIL import Image
+from tests.conftest import BASE_URL
+from devplacepy.attachments import store_attachment
+from devplacepy.db_client import get_table
+from devplacepy.utils import generate_uid, make_combined_slug
+
+JSON = {"Accept": "application/json"}
+
+
+def _png():
+    buf = io.BytesIO()
+    Image.new("RGBA", (16, 16), (90, 10, 10, 255)).save(buf, format="PNG")
+    return buf.getvalue()
+
+
+def _seed_published(receiver_username, giver_username, description):
+    receiver = get_table("users").find_one(username=receiver_username)
+    giver = get_table("users").find_one(username=giver_username)
+    uid = generate_uid()
+    slug = make_combined_slug(description, uid)
+    now = datetime.now(timezone.utc).isoformat()
+    att = store_attachment(_png(), "award-256.png", receiver["uid"])
+    get_table("awards").insert(
+        {
+            "uid": uid,
+            "slug": slug,
+            "description": description,
+            "giver_uid": giver["uid"],
+            "receiver_uid": receiver["uid"],
+            "attachment_uid_512": att["uid"],
+            "attachment_uid_256": att["uid"],
+            "attachment_uid_64": att["uid"],
+            "generated_at": now,
+            "created_at": now,
+            "job_uid": "",
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    get_table("users").update(
+        {
+            "uid": receiver["uid"],
+            "award_count": 1,
+            "last_award_at": now,
+            "last_award_slug": slug,
+            "last_award_uid": uid,
+        },
+        ["uid"],
+    )
+    return slug
+
+
+def test_awards_tab_html_contains_grid_and_slug(seeded_db):
+    slug = _seed_published("bob_test", "alice_test", "Tab award")
+    r = requests.get(f"{BASE_URL}/profile/bob_test?tab=awards")
+    assert r.status_code == 200
+    assert "awards-grid" in r.text
+    assert slug in r.text
+
+
+def test_guest_can_read_awards_tab(seeded_db):
+    _seed_published("bob_test", "alice_test", "Guest read")
+    r = requests.get(f"{BASE_URL}/profile/bob_test?tab=awards")
+    assert r.status_code == 200
+    assert "Give Award" not in r.text
+
+
+def test_awards_tab_json_includes_list(seeded_db):
+    slug = _seed_published("bob_test", "alice_test", "JSON tab")
+    r = requests.get(
+        f"{BASE_URL}/profile/bob_test?tab=awards",
+        headers=JSON,
+    )
+    assert r.status_code == 200
+    data = r.json()
+    assert data["awards_count"] >= 1
+    assert any(item.get("slug") == slug for item in data.get("awards", []))
+
+
+def test_awards_tab_absent_when_count_zero(seeded_db):
+    bob = get_table("users").find_one(username="bob_test")
+    get_table("users").update(
+        {"uid": bob["uid"], "award_count": 0, "last_award_uid": None, "last_award_slug": None},
+        ["uid"],
+    )
+    r = requests.get(f"{BASE_URL}/profile/bob_test")
+    assert r.status_code == 200
+    assert "tab=awards" not in r.text
@@ -0,0 +1,109 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _settings(app_server):
+    set_setting("rate_limit_per_minute", "1000000")
+    set_setting("registration_open", "1")
+    set_setting("devii_interactions_default", "1")
+    yield
+
+
+def _member():
+    _counter[0] += 1
+    name = f"ixp{int(time.time() * 1000)}{_counter[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    return name, user["uid"], user["api_key"]
+
+
+def _admin_key(seeded_db):
+    refresh_snapshot()
+    return get_table("users").find_one(username="alice_test")["api_key"]
+
+
+def test_owner_disables_interactions(app_server):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/interactions",
+        headers={"X-API-KEY": key, **JSON},
+        data={"enabled": "false"},
+    )
+    assert r.status_code == 200, r.text[:200]
+    body = r.json()["data"]
+    assert body["enabled"] is False
+    assert body["source"] == "user"
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
+
+
+def test_owner_resets_to_default(app_server):
+    name, uid, key = _member()
+    requests.post(
+        f"{BASE_URL}/profile/{name}/interactions",
+        headers={"X-API-KEY": key, **JSON},
+        data={"enabled": "false"},
+    )
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/interactions",
+        headers={"X-API-KEY": key, **JSON},
+        data={"reset": "true"},
+    )
+    assert r.status_code == 200
+    body = r.json()["data"]
+    assert body["source"] == "default"
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=uid)["interactions_enabled"] == -1
+
+
+def test_admin_sets_for_other_user(seeded_db):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/interactions",
+        headers={"X-API-KEY": _admin_key(seeded_db), **JSON},
+        data={"enabled": "false"},
+    )
+    assert r.status_code == 200
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
+
+
+def test_non_owner_forbidden(app_server):
+    name, uid, key = _member()
+    _, _, other_key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/interactions",
+        headers={"X-API-KEY": other_key, **JSON},
+        data={"enabled": "false"},
+    )
+    assert r.status_code == 403
+
+
+def test_guest_rejected(app_server):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/interactions",
+        headers=JSON,
+        data={"enabled": "false"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (401, 303)