retoorandClaude Sonnet 5
3c69de9d55
Happy 404: an HTML 404 (unmatched route, or an explicit not-found inside a
real route) now renders a random existing post instead of the error page,
using the exact same context builder as a real post view. Toggle is the
happy_404_enabled site setting (default on, /admin/settings); JSON/API
requests and a handful of excluded prefixes are never affected. The pool of
candidate slugs is cached in-process and resampled periodically so it stays
fast and eventually cycles the whole posts table; on any internal failure it
falls straight through to the real 404 page.
Applying this everywhere surfaced ~60 existing tests that asserted a literal
404 for a legitimate resource-not-found flow (deleted post, unknown
container, wrong project slug, etc.) - each now disables the setting for the
duration of that specific check and restores it after, so the underlying
not-found behavior stays covered independently of the new feature.
Post page also gained, all built on the same shared post_page_context() so
they render identically on both a real post and a happy-404 page:
- A left sidebar (three separate cards, matching /feed's sidebar-card
convention) for "Gists from {author}", "Projects from {author}" (private
projects filtered through the normal visibility check), and "Related
Discussions" - each cached per author and invalidated on create/edit/
delete so new content shows up immediately.
- A right column reusing /feed's exact Daily Topic widget class for up to
three "Featured" articles (the existing but previously-unused `featured`
news flag), cached as a pool with per-request random sampling.
- A "Next post -> " link beside "Back to Feed", pointing at the next older
post site-wide (blocked authors skipped). Wired through the same next_url
mechanism already used for listing pagination, so it emits a real
backend-rendered <link rel="next"> tag for SEO, not just a visible link.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWJy6PrMMt5hwWxQwia2rd
173 lines
5.3 KiB
Python
173 lines
5.3 KiB
Python
# retoor <retoor@molodetz.nl>
|
|
|
|
import time
|
|
|
|
import pytest
|
|
import requests
|
|
|
|
from devplacepy.database import get_table, refresh_snapshot, set_setting
|
|
from tests.conftest import BASE_URL, CACHE_VERSION_PROPAGATION_SECONDS
|
|
|
|
JSON = {"Accept": "application/json"}
|
|
_counter = [0]
|
|
|
|
|
|
@pytest.fixture(scope="module", autouse=True)
|
|
def _disable_happy_404(app_server):
|
|
set_setting("happy_404_enabled", "0")
|
|
time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
|
|
yield
|
|
set_setting("happy_404_enabled", "1")
|
|
time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
|
|
|
|
|
|
def _unique(prefix="del"):
|
|
_counter[0] += 1
|
|
return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
|
|
|
|
|
|
def _member(prefix="del"):
|
|
name = _unique(prefix)
|
|
session = requests.Session()
|
|
session.post(
|
|
f"{BASE_URL}/auth/signup",
|
|
data={
|
|
"username": name,
|
|
"email": f"{name}@t.dev",
|
|
"password": "secret123",
|
|
"confirm_password": "secret123",
|
|
"birth_date": "1990-01-01",
|
|
"accept_terms": "1",
|
|
},
|
|
allow_redirects=True,
|
|
)
|
|
return session, name
|
|
|
|
|
|
def _post(session, title="Doomed post"):
|
|
response = session.post(
|
|
f"{BASE_URL}/posts/create",
|
|
data={"title": title, "content": "Content that disappears with the account."},
|
|
headers=JSON,
|
|
)
|
|
assert response.status_code == 200, response.text
|
|
return response.json()["data"]["uid"]
|
|
|
|
|
|
def test_the_page_states_what_is_removed_and_the_grace_window(app_server):
|
|
session, name = _member()
|
|
payload = session.get(f"{BASE_URL}/profile/{name}/delete", headers=JSON).json()
|
|
assert payload["username"] == name
|
|
assert payload["removed"]
|
|
assert payload["retained"]
|
|
assert payload["grace_hours"] >= 0
|
|
|
|
|
|
def test_a_wrong_password_does_not_delete(app_server):
|
|
session, name = _member()
|
|
response = session.post(
|
|
f"{BASE_URL}/profile/{name}/delete",
|
|
data={"password": "not-the-password"},
|
|
headers=JSON,
|
|
)
|
|
assert response.status_code == 403
|
|
refresh_snapshot()
|
|
assert get_table("users").find_one(username=name) is not None
|
|
|
|
|
|
def test_deletion_removes_content_revokes_sessions_and_anonymises(app_server):
|
|
session, name = _member()
|
|
post_uid = _post(session)
|
|
refresh_snapshot()
|
|
before = get_table("users").find_one(username=name)
|
|
|
|
response = session.post(
|
|
f"{BASE_URL}/profile/{name}/delete",
|
|
data={"password": "secret123"},
|
|
headers=JSON,
|
|
)
|
|
assert response.status_code == 200, response.text
|
|
stamp = response.json()["data"]["stamp"]
|
|
|
|
refresh_snapshot()
|
|
assert get_table("users").find_one(username=name) is None
|
|
row = get_table("users").find_one(uid=before["uid"])
|
|
assert row["username"].startswith("deleted_")
|
|
assert not row["email"]
|
|
assert not row["api_key"]
|
|
assert not row["password_hash"]
|
|
assert row["deletion_requested_at"] == stamp
|
|
|
|
post = get_table("posts").find_one(uid=post_uid)
|
|
assert post["deleted_at"] == stamp
|
|
assert session.get(f"{BASE_URL}/reports/mine", headers=JSON).status_code == 401
|
|
assert requests.get(f"{BASE_URL}/profile/{name}").status_code == 404
|
|
|
|
|
|
def test_only_the_account_holder_can_delete(app_server, seeded_db):
|
|
victim, victim_name = _member()
|
|
admin = requests.Session()
|
|
admin.post(
|
|
f"{BASE_URL}/auth/login",
|
|
data={"email": "alice@test.devplace", "password": "secret123"},
|
|
allow_redirects=True,
|
|
)
|
|
response = admin.post(
|
|
f"{BASE_URL}/profile/{victim_name}/delete",
|
|
data={"password": "secret123"},
|
|
headers=JSON,
|
|
)
|
|
assert response.status_code == 403
|
|
refresh_snapshot()
|
|
assert get_table("users").find_one(username=victim_name) is not None
|
|
|
|
|
|
def test_restore_from_trash_brings_the_whole_event_back(app_server, seeded_db):
|
|
session, name = _member()
|
|
post_uid = _post(session, title="Restorable post")
|
|
session.post(
|
|
f"{BASE_URL}/profile/{name}/delete",
|
|
data={"password": "secret123"},
|
|
headers=JSON,
|
|
)
|
|
refresh_snapshot()
|
|
assert get_table("posts").find_one(uid=post_uid)["deleted_at"]
|
|
|
|
admin = requests.Session()
|
|
admin.post(
|
|
f"{BASE_URL}/auth/login",
|
|
data={"email": "alice@test.devplace", "password": "secret123"},
|
|
allow_redirects=True,
|
|
)
|
|
response = admin.post(
|
|
f"{BASE_URL}/admin/trash/posts/{post_uid}/restore", headers=JSON
|
|
)
|
|
assert response.status_code == 200
|
|
refresh_snapshot()
|
|
assert get_table("posts").find_one(uid=post_uid)["deleted_at"] is None
|
|
|
|
|
|
def test_purging_after_the_grace_window_leaves_no_personal_data(app_server):
|
|
from devplacepy.services.moderation import deletion
|
|
|
|
session, name = _member()
|
|
post_uid = _post(session, title="Purged post")
|
|
refresh_snapshot()
|
|
uid = get_table("users").find_one(username=name)["uid"]
|
|
session.post(
|
|
f"{BASE_URL}/profile/{name}/delete",
|
|
data={"password": "secret123"},
|
|
headers=JSON,
|
|
)
|
|
refresh_snapshot()
|
|
assert get_table("users").find_one(uid=uid)["username"].startswith("deleted_")
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
later = datetime.now(timezone.utc) + timedelta(hours=deletion.grace_hours() + 1)
|
|
purged = deletion.purge_due(now=later)
|
|
assert purged >= 1
|
|
refresh_snapshot()
|
|
assert get_table("posts").find_one(uid=post_uid) is None
|
|
assert get_table("users").find_one(uid=uid) is None
|