retoorandClaude Sonnet 5
3c69de9d55
Happy 404: an HTML 404 (unmatched route, or an explicit not-found inside a
real route) now renders a random existing post instead of the error page,
using the exact same context builder as a real post view. Toggle is the
happy_404_enabled site setting (default on, /admin/settings); JSON/API
requests and a handful of excluded prefixes are never affected. The pool of
candidate slugs is cached in-process and resampled periodically so it stays
fast and eventually cycles the whole posts table; on any internal failure it
falls straight through to the real 404 page.
Applying this everywhere surfaced ~60 existing tests that asserted a literal
404 for a legitimate resource-not-found flow (deleted post, unknown
container, wrong project slug, etc.) - each now disables the setting for the
duration of that specific check and restores it after, so the underlying
not-found behavior stays covered independently of the new feature.
Post page also gained, all built on the same shared post_page_context() so
they render identically on both a real post and a happy-404 page:
- A left sidebar (three separate cards, matching /feed's sidebar-card
convention) for "Gists from {author}", "Projects from {author}" (private
projects filtered through the normal visibility check), and "Related
Discussions" - each cached per author and invalidated on create/edit/
delete so new content shows up immediately.
- A right column reusing /feed's exact Daily Topic widget class for up to
three "Featured" articles (the existing but previously-unused `featured`
news flag), cached as a pool with per-request random sampling.
- A "Next post -> " link beside "Back to Feed", pointing at the next older
post site-wide (blocked authors skipped). Wired through the same next_url
mechanism already used for listing pagination, so it emits a real
backend-rendered <link rel="next"> tag for SEO, not just a visible link.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWJy6PrMMt5hwWxQwia2rd
117 lines
4.1 KiB
Python
117 lines
4.1 KiB
Python
# retoor <retoor@molodetz.nl>
|
|
|
|
import io
|
|
import time
|
|
import requests
|
|
from datetime import datetime, timezone
|
|
from PIL import Image
|
|
from tests.conftest import BASE_URL, CACHE_VERSION_PROPAGATION_SECONDS
|
|
from devplacepy.attachments import store_attachment
|
|
from devplacepy.database import get_table, set_setting
|
|
from devplacepy.utils import generate_uid, make_combined_slug
|
|
|
|
JSON = {"Accept": "application/json"}
|
|
|
|
|
|
def _login(seeded_db, who):
|
|
s = requests.Session()
|
|
creds = seeded_db[who]
|
|
s.post(
|
|
f"{BASE_URL}/auth/login",
|
|
data={"email": creds["email"], "password": creds["password"]},
|
|
allow_redirects=True,
|
|
)
|
|
return s
|
|
|
|
|
|
def _png():
|
|
buf = io.BytesIO()
|
|
Image.new("RGBA", (24, 24), (5, 5, 5, 255)).save(buf, format="PNG")
|
|
return buf.getvalue()
|
|
|
|
|
|
def _seed_published(receiver_username, giver_username):
|
|
receiver = get_table("users").find_one(username=receiver_username)
|
|
giver = get_table("users").find_one(username=giver_username)
|
|
uid = generate_uid()
|
|
slug = make_combined_slug("Admin revoke", uid)
|
|
now = datetime.now(timezone.utc).isoformat()
|
|
att512 = store_attachment(_png(), "award-512.png", receiver["uid"])
|
|
att256 = store_attachment(_png(), "award-256.png", giver["uid"])
|
|
att64 = store_attachment(_png(), "award-64.png", giver["uid"])
|
|
get_table("awards").insert(
|
|
{
|
|
"uid": uid,
|
|
"slug": slug,
|
|
"description": "Admin revoke",
|
|
"giver_uid": giver["uid"],
|
|
"receiver_uid": receiver["uid"],
|
|
"attachment_uid_512": att512["uid"],
|
|
"attachment_uid_256": att256["uid"],
|
|
"attachment_uid_64": att64["uid"],
|
|
"generated_at": now,
|
|
"created_at": now,
|
|
"job_uid": "",
|
|
"deleted_at": None,
|
|
"deleted_by": None,
|
|
}
|
|
)
|
|
get_table("users").update(
|
|
{
|
|
"uid": receiver["uid"],
|
|
"award_count": 1,
|
|
"last_award_at": now,
|
|
"last_award_slug": slug,
|
|
"last_award_uid": uid,
|
|
},
|
|
["uid"],
|
|
)
|
|
return uid, slug, att512["uid"]
|
|
|
|
|
|
def test_member_cannot_revoke_award(seeded_db):
|
|
uid, _, _ = _seed_published("bob_test", "alice_test")
|
|
bob = _login(seeded_db, "bob")
|
|
r = bob.post(f"{BASE_URL}/admin/awards/{uid}/revoke", allow_redirects=False)
|
|
assert r.status_code in (302, 303)
|
|
admin = _login(seeded_db, "alice")
|
|
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
|
|
|
|
|
def test_admin_revoke_soft_deletes_and_recomputes(seeded_db):
|
|
uid, slug, att512 = _seed_published("bob_test", "alice_test")
|
|
admin = _login(seeded_db, "alice")
|
|
r = admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
|
assert r.status_code == 200
|
|
row = get_table("awards").find_one(uid=uid)
|
|
assert row.get("deleted_at")
|
|
assert get_table("attachments").find_one(uid=att512).get("deleted_at")
|
|
bob = get_table("users").find_one(username="bob_test")
|
|
assert bob.get("award_count") == 0
|
|
set_setting("happy_404_enabled", "0")
|
|
time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
|
|
try:
|
|
assert requests.get(f"{BASE_URL}/awards/{slug}/64").status_code == 404
|
|
finally:
|
|
set_setting("happy_404_enabled", "1")
|
|
time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
|
|
|
|
|
|
def test_media_gallery_hides_revoked_attachment(seeded_db):
|
|
uid, _, att512 = _seed_published("bob_test", "alice_test")
|
|
admin = _login(seeded_db, "alice")
|
|
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
|
r = requests.get(f"{BASE_URL}/profile/bob_test?tab=media", headers=JSON)
|
|
assert r.status_code == 200
|
|
media = r.json().get("media", [])
|
|
assert all(item.get("uid") != att512 for item in media)
|
|
|
|
|
|
def test_admin_revoke_audit_recorded(seeded_db):
|
|
uid, _, _ = _seed_published("bob_test", "alice_test")
|
|
admin = _login(seeded_db, "alice")
|
|
admin.post(f"{BASE_URL}/admin/awards/{uid}/revoke", headers=JSON)
|
|
data = admin.get(
|
|
f"{BASE_URL}/admin/audit-log", headers=JSON, params={"event_key": "award.revoke"}
|
|
).json()
|
|
assert any(entry.get("target_uid") == uid for entry in data["entries"]) |