alex/backup-tool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): persist sessions and lock remote setup

Browse Source
This commit is contained in:
Alex
2026-07-27 21:01:04 +02:00
parent 5cbd5b836c
commit 175a550c7b
4 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/security/test_session_security.py
+16 -5
View File
@@ -80,8 +80,12 @@ async def test_remote_setup_without_configured_bootstrap_fails_closed(tmp_path)
)
command.upgrade(cli.build_alembic_config(settings), "head")
app = app_module.create_app(settings)
async with AsyncClient(transport=ASGITransport(app=app), base_url=settings.public_base_url) as client:
response = await client.post("/api/v2/setup", json={"username": "admin", "password": PASSWORD})
async with AsyncClient(
transport=ASGITransport(app=app), base_url=settings.public_base_url
) as client:
response = await client.post(
"/api/v2/setup", json={"username": "admin", "password": PASSWORD}
)
assert response.status_code == 403
assert response.json()["code"] == "bootstrap_required"
await app.state.engine.dispose()
@@ -122,10 +126,13 @@ async def test_logout_revocation_survives_app_restart(tmp_path) -> None:
local_source_roots=(roots[2],),
restore_roots=(roots[3],),
master_key_file=key,
public_base_url="https://127.0.0.1:8000",
)
command.upgrade(cli.build_alembic_config(settings), "head")
app = app_module.create_app(settings)
async with AsyncClient(transport=ASGITransport(app=app), base_url=settings.public_base_url) as client:
async with AsyncClient(
transport=ASGITransport(app=app), base_url=settings.public_base_url
) as client:
setup = await client.post("/api/v2/setup", json={"username": "admin", "password": PASSWORD})
assert setup.status_code == 201
copied_cookie = client.cookies.get("backup_tool_session")
@@ -137,7 +144,11 @@ async def test_logout_revocation_survives_app_restart(tmp_path) -> None:
await app.state.engine.dispose()
restarted = app_module.create_app(settings)
async with AsyncClient(transport=ASGITransport(restarted), base_url=settings.public_base_url) as client:
rejected = await client.get("/api/v2/auth/session", headers={"Cookie": f"backup_tool_session={copied_cookie}"})
async with AsyncClient(
transport=ASGITransport(restarted), base_url=settings.public_base_url
) as client:
rejected = await client.get(
"/api/v2/auth/session", headers={"Cookie": f"backup_tool_session={copied_cookie}"}
)
assert rejected.status_code == 401
await restarted.state.engine.dispose()