70 lines
2.3 KiB
Python
70 lines
2.3 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib
|
|
from datetime import UTC, datetime, timedelta
|
|
|
|
import pytest
|
|
|
|
PASSWORD = "correct horse battery staple"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_remote_setup_requires_bootstrap_secret(tmp_path) -> None:
|
|
config = importlib.import_module("backup_tool.config")
|
|
app_module = importlib.import_module("backup_tool.api.app")
|
|
key = tmp_path / "master.key"
|
|
key.write_bytes(b"m2-test-master-key-material-32-bytes-minimum")
|
|
key.chmod(0o600)
|
|
roots = []
|
|
for name in ("data", "repositories", "sources", "restores"):
|
|
path = tmp_path / name
|
|
path.mkdir()
|
|
roots.append(path)
|
|
settings = config.Settings(
|
|
data_dir=roots[0],
|
|
database_url=f"sqlite+aiosqlite:///{roots[0] / 'metadata.db'}",
|
|
repository_roots=(roots[1],),
|
|
local_source_roots=(roots[2],),
|
|
restore_roots=(roots[3],),
|
|
master_key_file=key,
|
|
public_base_url="https://backup.example.test",
|
|
bootstrap_secret="bootstrap-secret-123",
|
|
)
|
|
cli = importlib.import_module("backup_tool.cli")
|
|
from alembic import command
|
|
from httpx import ASGITransport, AsyncClient
|
|
|
|
command.upgrade(cli.build_alembic_config(settings), "head")
|
|
app = app_module.create_app(settings)
|
|
async with AsyncClient(
|
|
transport=ASGITransport(app=app), base_url="https://backup.example.test"
|
|
) as client:
|
|
denied = await client.post(
|
|
"/api/v2/setup", json={"username": "admin", "password": PASSWORD}
|
|
)
|
|
assert denied.status_code == 403
|
|
accepted = await client.post(
|
|
"/api/v2/setup",
|
|
json={
|
|
"username": "admin",
|
|
"password": PASSWORD,
|
|
"bootstrap_secret": "bootstrap-secret-123",
|
|
},
|
|
)
|
|
assert accepted.status_code == 201
|
|
await app.state.engine.dispose()
|
|
|
|
|
|
def test_expired_session_is_rejected(tmp_path) -> None:
|
|
auth = importlib.import_module("backup_tool.security.auth")
|
|
key = tmp_path / "master.key"
|
|
key.write_bytes(b"x" * 32)
|
|
expired = auth.sign_session(
|
|
"user",
|
|
"csrf",
|
|
key,
|
|
expires_at=datetime.now(UTC) - timedelta(seconds=1),
|
|
session_id="session",
|
|
)
|
|
assert auth.verify_session(expired, key) is None
|