devplacepy/tests/api/auth/matrix.py

# retoor <retoor@molodetz.nl>

import time
import requests
from tests.conftest import BASE_URL
from devplacepy.database import get_table
from devplacepy.docs_api import API_GROUPS, build_services_group
from devplacepy.services.manager import service_manager
JSON_auth_matrix = {"Accept": "application/json"}
_counter_auth_matrix = [0]
LOGIN_REDIRECT = "/auth/login"
FEED_REDIRECT = "/feed"
JSON_BODY_OVERRIDES = {
    "push-register": {
        "endpoint": "https://example.test/p",
        "keys": {"p256dh": "a", "auth": "b"},
    },
    "gateway-chat": {"model": "x", "messages": [{"role": "user", "content": "hi"}]},
}
def _signup_auth_matrix(role="Member"):
    _counter_auth_matrix[0] += 1
    name = f"authmx{int(time.time() * 1000)}{_counter_auth_matrix[0]}"
    requests.post(
        f"{BASE_URL}/auth/signup",
        data={
            "username": name,
            "email": f"{name}@t.dev",
            "password": "secret123",
            "confirm_password": "secret123",
            "birth_date": "1990-01-01",
            "accept_terms": "1",
        },
        allow_redirects=True,
    )
    row = get_table("users").find_one(username=name)
    get_table("users").update({"uid": row["uid"], "role": role}, ["uid"])
    return get_table("users").find_one(username=name)["api_key"]
def _all_endpoints():
    endpoints = []
    for group in API_GROUPS:
        endpoints.extend(group["endpoints"])
    endpoints.extend(
        build_services_group(service_manager.describe_all(), BASE_URL)["endpoints"]
    )
    return endpoints
def _build(endpoint):
    path = endpoint["path"]
    params, data, files = {}, {}, None
    for param in endpoint["params"]:
        example = param.get("example") or ""
        location = param["location"]
        if location == "path":
            value = str(example)
            if "{{" in value or not value:
                value = "x"
            path = path.replace("{" + param["name"] + "}", value)
        elif location == "query":
            if example:
                params[param["name"]] = example
        elif location == "form":
            if param["type"] == "file":
                files = {"file": ("probe.txt", b"hello", "text/plain")}
            else:
                data[param["name"]] = param.get("example") or "x"
    json_body = None
    if endpoint["encoding"] == "json":
        json_body = JSON_BODY_OVERRIDES.get(
            endpoint["id"],
            {
                p["name"]: (p.get("example") or "x")
                for p in endpoint["params"]
                if p["location"] == "json"
            },
        )
    if endpoint["encoding"] == "multipart" and files is None:
        files = {"file": ("probe.txt", b"hello", "text/plain")}
    return path, params, data, json_body, files
def _call(endpoint, headers):
    path, params, data, json_body, files = _build(endpoint)
    kwargs = dict(headers=headers, params=params, allow_redirects=False, timeout=15)
    if json_body is not None:
        kwargs["json"] = json_body
    elif files is not None:
        kwargs["files"] = files
        if data:
            kwargs["data"] = data
    elif data:
        kwargs["data"] = data
    return requests.request(endpoint["method"], f"{BASE_URL}{path}", **kwargs)
def _clear_probe_jobs():
    from devplacepy.database import refresh_snapshot

    refresh_snapshot()
    jobs = get_table("jobs")
    for row in list(jobs.find()):
        jobs.delete(uid=row["uid"])


def _redirects_to(response, target):
    return response.status_code in (
        302,
        303,
        307,
        308,
    ) and target in response.headers.get("location", "")
def _is_auth_rejected(response):
    return response.status_code == 401 or _redirects_to(response, LOGIN_REDIRECT)
def _is_role_rejected(response):
    return response.status_code == 403 or _redirects_to(response, FEED_REDIRECT)
def _is_allowed(response):
    return not _is_auth_rejected(response) and response.status_code != 403


def test_documented_minimal_role_matches_enforcement(seeded_db):
    # depend on seeded_db so alice_test keeps the is_first -> Admin slot; our signups
    # below are never the first user and cannot demote the suite's admin fixture.
    member_key = _signup_auth_matrix("Member")
    member = {**JSON_auth_matrix, "X-API-KEY": member_key}

    endpoints = _all_endpoints()
    assert len(endpoints) >= 50

    failures = []
    try:
        for endpoint in endpoints:
            auth = endpoint["auth"]
            label = (
                f"{endpoint['method']} {endpoint['path']} ({endpoint['id']}, doc={auth})"
            )
            anon = _call(endpoint, JSON_auth_matrix)

            if auth == "public":
                if not _is_allowed(anon):
                    failures.append(
                        f"{label}: public but anonymous was rejected ({anon.status_code})"
                    )
                continue

            if not _is_auth_rejected(anon):
                failures.append(
                    f"{label}: requires {auth} but anonymous was NOT rejected ({anon.status_code})"
                )

            if auth == "user" and endpoint["method"] == "GET":
                mem = _call(endpoint, member)
                if not _is_allowed(mem):
                    failures.append(
                        f"{label}: documented user but a member was rejected ({mem.status_code})"
                    )

            if auth == "admin":
                mem = _call(endpoint, member)
                if not _is_role_rejected(mem):
                    failures.append(
                        f"{label}: documented admin but a non-admin member was NOT rejected ({mem.status_code})"
                    )
    finally:
        _clear_probe_jobs()

    assert not failures, "Auth enforcement does not match documentation:\n" + "\n".join(
        failures
    )


def test_every_endpoint_documents_minimal_role(seeded_db):
    for endpoint in _all_endpoints():
        assert endpoint["min_role"] in ("Public", "Member", "Admin"), endpoint["id"]