b70d148b94
Backend - Routes moved under /api/, JWT bearer auth via @before_request - DEV_AUTH_BYPASS escape hatch for local dev - In-memory chat history and report state replaced with Postgres tables (preferences, chat_messages, reports, feedback_events) keyed on user - SQLAlchemy 2.x + Alembic migrations run on container start - Graceful Airtable failure handling — bad creds no longer 500 the API - Per-user data isolation via g.user_email from validated token Frontend - React + Vite + TypeScript SPA at /programme-pulse/ - MSAL.js (PKCE, sessionStorage, ID token to backend) - VITE_DEV_AUTH_BYPASS mirrors backend bypass for local dev - Streaming chat via fetch ReadableStream + SSE parsing - Charts via chart.js, markdown via react-markdown + remark-gfm - Full UI parity with the original templates/index.html Deploy (optical-dev split-build pattern) - Dockerfile + docker-compose.yml (name: programme-pulse pinned; app + Postgres; 127.0.0.1 binding only) - deploy/apache-programme-pulse.conf.tmpl with flushpackets=on for SSE - deploy/deploy.sh mirrors OSOP — port auto-pick (5051..5099), apache conf render, frontend build in throwaway node container, rsync to /var/www/html/programme-pulse, /api/health poll Tests - 49 passing; new tests for DB-backed preferences and JWT auth helpers - SQLite-backed test fixture in tests/conftest.py Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
1.5 KiB
Python
48 lines
1.5 KiB
Python
import os
|
|
|
|
import pytest
|
|
|
|
from src import auth
|
|
|
|
|
|
def test_dev_bypass_disabled_by_default(monkeypatch):
|
|
monkeypatch.delenv("DEV_AUTH_BYPASS", raising=False)
|
|
assert auth.dev_bypass_enabled() is False
|
|
|
|
|
|
def test_dev_bypass_enabled(monkeypatch):
|
|
monkeypatch.setenv("DEV_AUTH_BYPASS", "true")
|
|
assert auth.dev_bypass_enabled() is True
|
|
monkeypatch.setenv("DEV_AUTH_BYPASS", "1")
|
|
assert auth.dev_bypass_enabled() is True
|
|
|
|
|
|
def test_dev_user_claims_shape():
|
|
claims = auth.dev_user_claims()
|
|
assert claims["_email"] == "dev@oliver.agency"
|
|
assert claims["_name"] == "Dev User"
|
|
|
|
|
|
def test_check_domain_allows_when_no_allow_list(monkeypatch):
|
|
monkeypatch.delenv("AUTH_ALLOWED_DOMAINS", raising=False)
|
|
auth._check_domain("anyone@example.com") # no raise
|
|
|
|
|
|
def test_check_domain_allows_listed(monkeypatch):
|
|
monkeypatch.setenv("AUTH_ALLOWED_DOMAINS", "oliver.agency,oliver.com")
|
|
auth._check_domain("alice@oliver.agency")
|
|
auth._check_domain("bob@oliver.com")
|
|
|
|
|
|
def test_check_domain_rejects_unlisted(monkeypatch):
|
|
monkeypatch.setenv("AUTH_ALLOWED_DOMAINS", "oliver.agency")
|
|
with pytest.raises(auth.AuthError) as exc:
|
|
auth._check_domain("intruder@evil.com")
|
|
assert exc.value.status_code == 403
|
|
|
|
|
|
def test_validate_bearer_token_rejects_empty(monkeypatch):
|
|
monkeypatch.setenv("AZURE_TENANT_ID", "00000000-0000-0000-0000-000000000000")
|
|
monkeypatch.setenv("AZURE_CLIENT_ID", "11111111-1111-1111-1111-111111111111")
|
|
with pytest.raises(auth.AuthError):
|
|
auth.validate_bearer_token("")
|