50 lines
2.1 KiB
Python
50 lines
2.1 KiB
Python
"""单作者会话与错误合同；ASGI 传输不建立网络连接。"""
|
||
|
||
from pathlib import Path
|
||
|
||
from fastapi.testclient import TestClient
|
||
|
||
from muse.接入.http.应用 import 创建应用
|
||
from muse.配置 import 应用配置, 数据库引用, 服务配置
|
||
|
||
|
||
def test_会话不能伪造作者且写入核对来源__a70001(tmp_path: Path) -> None:
|
||
"""合成口令通过认证；客户端身份和错误来源无法获得写权限。"""
|
||
口令 = tmp_path / "访问口令.txt"
|
||
口令.write_text("synthetic-session-key-000000000000", encoding="utf-8")
|
||
配置 = 应用配置(
|
||
数据库引用("环境变量", "MUSE_HTTP_TEST_DB"),
|
||
"test",
|
||
HTTP=服务配置(str(口令), 公开地址="http://testserver", 允许来源=("http://testserver",)),
|
||
)
|
||
with TestClient(创建应用(配置)) as 客户端:
|
||
assert 客户端.get("/health").status_code == 200
|
||
assert 客户端.get("/ready").status_code == 503
|
||
assert 客户端.get("/api/v1/session").status_code == 401
|
||
登录 = 客户端.post(
|
||
"/api/v1/session",
|
||
json={"password": "synthetic-session-key-000000000000", "decided_by": "forged"},
|
||
headers={"Origin": "http://testserver"},
|
||
)
|
||
assert 登录.status_code == 422
|
||
登录 = 客户端.post(
|
||
"/api/v1/session",
|
||
json={"password": "synthetic-session-key-000000000000"},
|
||
headers={"Origin": "http://testserver"},
|
||
)
|
||
assert 登录.status_code == 200
|
||
assert 登录.json()["author_id"] == "author-local"
|
||
assert "httponly" in 登录.headers["set-cookie"].lower()
|
||
assert (
|
||
客户端.delete(
|
||
"/api/v1/session", headers={"Origin": "https://outside.invalid"}
|
||
).status_code
|
||
== 403
|
||
)
|
||
assert 客户端.get("/api/v1/session").json()["author_id"] == "author-local"
|
||
assert (
|
||
客户端.delete("/api/v1/session", headers={"Origin": "http://testserver"}).status_code
|
||
== 200
|
||
)
|
||
assert 客户端.get("/api/v1/session").status_code == 401
|