ebbe.bassandClaude Sonnet 5.5
3c69c2a156
Authorization-code flow with PKCE through an idp adapter (with a fake), ID token validation, identity and roles resolved from the directory with a short cache, refusal of unknown, disabled and locked accounts with one generic page, sessions that end when the account becomes unavailable, sign-out that ends the server-side session, role decorators and the trusted-proxy client address rule. Adds the OIDC_* and PUBLIC_BASE_URL configuration. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
143 lines
4.4 KiB
Python
143 lines
4.4 KiB
Python
import os
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from portal.config.env import ConfigError, load_config
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def test_valid_environment_uses_safe_defaults(valid_env):
|
|
config = load_config(valid_env)
|
|
assert config.debug is False
|
|
assert config.log_level == "INFO"
|
|
assert config.default_timezone == "Europe/Berlin"
|
|
assert config.trusted_proxies == []
|
|
assert config.allowed_hosts == ["testserver"]
|
|
|
|
|
|
def test_every_problem_is_listed_and_no_value_leaks(valid_env):
|
|
secret = "short-secret"
|
|
env = {
|
|
**valid_env,
|
|
"SECRET_KEY": secret,
|
|
"LOG_LEVEL": "loud",
|
|
"DEBUG": "maybe",
|
|
"TRUSTED_PROXIES": "not-an-ip",
|
|
"DEFAULT_TIMEZONE": "Nowhere/Land",
|
|
}
|
|
del env["ALLOWED_HOSTS"]
|
|
with pytest.raises(ConfigError) as info:
|
|
load_config(env)
|
|
message = str(info.value)
|
|
for name in (
|
|
"SECRET_KEY",
|
|
"ALLOWED_HOSTS",
|
|
"LOG_LEVEL",
|
|
"DEBUG",
|
|
"TRUSTED_PROXIES",
|
|
"DEFAULT_TIMEZONE",
|
|
):
|
|
assert name in message
|
|
assert secret not in message
|
|
|
|
|
|
def test_missing_data_dir_is_reported(valid_env, tmp_path):
|
|
with pytest.raises(ConfigError, match="DATA_DIR"):
|
|
load_config({**valid_env, "DATA_DIR": str(tmp_path / "missing")})
|
|
|
|
|
|
def test_process_exits_nonzero_naming_both_variables(tmp_path):
|
|
env = {k: v for k, v in os.environ.items() if k not in ("SECRET_KEY", "LOG_LEVEL")}
|
|
env.update(
|
|
ALLOWED_HOSTS="testserver",
|
|
DATA_DIR=str(tmp_path),
|
|
LOG_LEVEL="loud",
|
|
DJANGO_SETTINGS_MODULE="portal.config.settings",
|
|
)
|
|
result = subprocess.run( # noqa: S603
|
|
[sys.executable, "manage.py", "check"],
|
|
cwd=ROOT,
|
|
env=env,
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
assert result.returncode != 0
|
|
assert "SECRET_KEY" in result.stderr
|
|
assert "LOG_LEVEL" in result.stderr
|
|
assert "Traceback" not in result.stderr
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"name",
|
|
[
|
|
"LDAP_SERVER",
|
|
"LDAP_USER_OU_DN",
|
|
"LDAP_BIND_DN",
|
|
"LDAP_BIND_PASSWORD",
|
|
"LDAP_CA_FILE",
|
|
"LDAP_PUBLISHER_GROUP_DN",
|
|
"LDAP_ADMIN_GROUP_DN",
|
|
],
|
|
)
|
|
def test_each_directory_variable_is_required(valid_env, name):
|
|
del valid_env[name]
|
|
with pytest.raises(ConfigError, match=name):
|
|
load_config(valid_env)
|
|
|
|
|
|
def test_directory_settings_are_loaded_and_the_password_is_not_printed(valid_env):
|
|
directory = load_config(valid_env).directory
|
|
assert directory.server == "dc.example.test"
|
|
assert directory.user_ou_dn == "OU=Users,DC=example,DC=test"
|
|
assert "service-password" not in repr(directory)
|
|
|
|
|
|
def test_ldap_server_must_not_be_a_url(valid_env):
|
|
with pytest.raises(ConfigError, match="LDAP_SERVER"):
|
|
load_config({**valid_env, "LDAP_SERVER": "ldap://dc.example.test"})
|
|
|
|
|
|
def test_a_missing_ca_file_is_reported(valid_env, tmp_path):
|
|
with pytest.raises(ConfigError, match="LDAP_CA_FILE: must be an existing file"):
|
|
load_config({**valid_env, "LDAP_CA_FILE": str(tmp_path / "missing.pem")})
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"name", ["OIDC_ISSUER", "OIDC_CLIENT_ID", "OIDC_CLIENT_SECRET", "PUBLIC_BASE_URL"]
|
|
)
|
|
def test_each_oidc_variable_is_required(valid_env, name):
|
|
del valid_env[name]
|
|
with pytest.raises(ConfigError, match=name):
|
|
load_config(valid_env)
|
|
|
|
|
|
def test_oidc_settings_are_loaded_and_the_secret_is_not_printed(valid_env):
|
|
oidc = load_config({**valid_env, "PUBLIC_BASE_URL": "https://portal.example.test/"}).oidc
|
|
assert oidc.issuer == "https://idp.example.test/application/o/portal/"
|
|
assert oidc.redirect_uri == "https://portal.example.test/auth/callback"
|
|
assert "client-secret" not in repr(oidc)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("name", "value"),
|
|
[
|
|
("OIDC_ISSUER", "http://idp.example.test/"),
|
|
("PUBLIC_BASE_URL", "http://portal.example.test"),
|
|
("PUBLIC_BASE_URL", "https://portal.example.test/app"),
|
|
("PUBLIC_BASE_URL", "portal.example.test"),
|
|
],
|
|
)
|
|
def test_oidc_addresses_must_be_https_origins(valid_env, name, value):
|
|
with pytest.raises(ConfigError, match=name):
|
|
load_config({**valid_env, name: value})
|
|
|
|
|
|
def test_a_plain_http_origin_is_allowed_only_in_debug(valid_env):
|
|
env = {**valid_env, "PUBLIC_BASE_URL": "http://localhost:8000"}
|
|
assert load_config({**env, "DEBUG": "true"}).oidc.public_base_url == "http://localhost:8000"
|