retoor
e773067106
DevPlace CI / test (push) Successful in 35m0s
Add comprehensive test coverage for seven new API areas: - Backup schedules CRUD operations in admin panel - Service configuration saving and retrieval for news AI model - Token authentication with email/username and JSON body support - Bookmarking for project and news targets with invalid type validation - Content permissions testing with member and admin session fixtures - Devii adopt endpoint redirect behavior and session cookie handling - Devrant authentication flow with user registration and token retrieval
42 lines
1.1 KiB
Python
42 lines
1.1 KiB
Python
# retoor <retoor@molodetz.nl>
|
|
|
|
import pytest
|
|
import requests
|
|
from tests.conftest import BASE_URL
|
|
from devplacepy.database import set_setting
|
|
|
|
|
|
@pytest.fixture(scope="module", autouse=True)
|
|
def _settings(app_server):
|
|
set_setting("rate_limit_per_minute", "1000000")
|
|
yield
|
|
|
|
|
|
def test_adopt_redirects_to_default(app_server):
|
|
r = requests.get(f"{BASE_URL}/devii/adopt", allow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert r.headers["location"] == "/"
|
|
|
|
|
|
def test_adopt_honours_safe_next(app_server):
|
|
r = requests.get(
|
|
f"{BASE_URL}/devii/adopt", params={"next": "/feed"}, allow_redirects=False
|
|
)
|
|
assert r.status_code == 303
|
|
assert r.headers["location"] == "/feed"
|
|
|
|
|
|
def test_adopt_rejects_external_next(app_server):
|
|
r = requests.get(
|
|
f"{BASE_URL}/devii/adopt",
|
|
params={"next": "https://evil.example.com/x"},
|
|
allow_redirects=False,
|
|
)
|
|
assert r.status_code == 303
|
|
assert not r.headers["location"].startswith("http")
|
|
|
|
|
|
def test_adopt_without_pending_session_sets_no_cookie(app_server):
|
|
r = requests.get(f"{BASE_URL}/devii/adopt", allow_redirects=False)
|
|
assert "session" not in r.cookies
|