54 lines
1.9 KiB
Python
54 lines
1.9 KiB
Python
|
import unittest
|
||
|
|
from fastapi.testclient import TestClient
|
||
|
|
|
||
|
|
import main
|
||
|
|
from db import connect, create
|
||
|
|
|
||
|
|
|
||
|
|
class TestRouteSurfaceLockdown(unittest.IsolatedAsyncioTestCase):
|
||
|
|
async def asyncSetUp(self):
|
||
|
|
self.conn = await connect(":memory:")
|
||
|
|
await create(self.conn)
|
||
|
|
|
||
|
|
async def override_get_db():
|
||
|
|
try:
|
||
|
|
yield self.conn
|
||
|
|
finally:
|
||
|
|
pass
|
||
|
|
|
||
|
|
main.app.dependency_overrides[main.get_db] = override_get_db
|
||
|
|
self.client = TestClient(main.app)
|
||
|
|
|
||
|
|
# Register a user to obtain auth header for positive checks
|
||
|
|
r = self.client.post(
|
||
|
|
"/api/v1/auth/register",
|
||
|
|
json={"email": "lock@test.com", "password": "pw", "displayName": "Lock"},
|
||
|
|
)
|
||
|
|
assert r.status_code == 200, r.text
|
||
|
|
self.auth_headers = {"Authorization": f"Bearer {r.json()['accessToken']}"}
|
||
|
|
|
||
|
|
async def asyncTearDown(self):
|
||
|
|
await self.conn.close()
|
||
|
|
main.app.dependency_overrides.clear()
|
||
|
|
|
||
|
|
def test_unscoped_endpoints_not_exposed(self):
|
||
|
|
# These v1-style unscoped paths should not exist
|
||
|
|
for path in [
|
||
|
|
"/api/v1/meals",
|
||
|
|
"/api/v1/meals/1",
|
||
|
|
"/api/v1/shopping/current",
|
||
|
|
"/api/v1/shopping/1",
|
||
|
|
]:
|
||
|
|
r = self.client.get(path)
|
||
|
|
assert r.status_code in (404, 405)
|
||
|
|
|
||
|
|
def test_protected_routes_require_auth(self):
|
||
|
|
# Household routes require Authorization (401 when missing)
|
||
|
|
# Use a slug that won't exist; should return 401 before 404 membership/not found checks
|
||
|
|
r = self.client.get("/api/v1/households/nope/whoami")
|
||
|
|
assert r.status_code == 401
|
||
|
|
|
||
|
|
# With auth, not found or forbidden are possible; whoami returns 404 for missing household
|
||
|
|
r2 = self.client.get("/api/v1/households/nope/whoami", headers=self.auth_headers)
|
||
|
|
assert r2.status_code == 404
|