ebbe.bassandClaude Sonnet 5.5
3c69c2a156
Authorization-code flow with PKCE through an idp adapter (with a fake), ID token validation, identity and roles resolved from the directory with a short cache, refusal of unknown, disabled and locked accounts with one generic page, sessions that end when the account becomes unavailable, sign-out that ends the server-side session, role decorators and the trusted-proxy client address rule. Adds the OIDC_* and PUBLIC_BASE_URL configuration. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
39 lines
1.3 KiB
Python
39 lines
1.3 KiB
Python
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
|
|
from portal.adapters import registry
|
|
from portal.adapters.directory import FakeDirectory
|
|
from portal.adapters.idp import FakeIdp
|
|
|
|
|
|
@pytest.fixture
|
|
def valid_env(tmp_path):
|
|
ca_file = tmp_path / "ca.pem"
|
|
ca_file.write_text("test ca")
|
|
return {
|
|
"SECRET_KEY": "x" * 48,
|
|
"ALLOWED_HOSTS": "testserver",
|
|
"DATA_DIR": str(tmp_path),
|
|
"LDAP_SERVER": "dc.example.test",
|
|
"LDAP_USER_OU_DN": "OU=Users,DC=example,DC=test",
|
|
"LDAP_BIND_DN": "svc@example.test",
|
|
"LDAP_BIND_PASSWORD": "service-password",
|
|
"LDAP_CA_FILE": str(ca_file),
|
|
"LDAP_PUBLISHER_GROUP_DN": "CN=Publishers,OU=Users,DC=example,DC=test",
|
|
"LDAP_ADMIN_GROUP_DN": "CN=Admins,OU=Users,DC=example,DC=test",
|
|
"OIDC_ISSUER": "https://idp.example.test/application/o/portal/",
|
|
"OIDC_CLIENT_ID": "portal-client",
|
|
"OIDC_CLIENT_SECRET": "client-secret",
|
|
"PUBLIC_BASE_URL": "https://portal.example.test",
|
|
}
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def adapters():
|
|
"""Fakes for every adapter, so no test can reach a real directory or provider."""
|
|
fakes = SimpleNamespace(directory=FakeDirectory(), idp=FakeIdp())
|
|
registry.install(fakes.directory, fakes.idp)
|
|
yield fakes
|
|
registry.install()
|