|
| 1 | +"""In-process tests for the optional API-key layer (auth.py) and the CORS |
| 2 | +contract that external browser apps (Flutter Web, React, ...) rely on. |
| 3 | +
|
| 4 | +Uses FastAPI's TestClient, so no running server is needed. API_KEYS / |
| 5 | +AUTH_EXEMPT_ORIGINS are read per-request by auth.py, which is what makes |
| 6 | +monkeypatch.setenv work here without reloading the app. |
| 7 | +""" |
| 8 | + |
| 9 | +from __future__ import annotations |
| 10 | + |
| 11 | +import pytest |
| 12 | +from fastapi.testclient import TestClient |
| 13 | + |
| 14 | +from server import app |
| 15 | + |
| 16 | +KEY = "test-key-abc123" |
| 17 | +SECOND_KEY = "second-key-xyz789" |
| 18 | + |
| 19 | +# Cheap authenticated endpoint - static payload, no ephemeris math. |
| 20 | +PROBE = "/api/ayanamsa-options" |
| 21 | + |
| 22 | + |
| 23 | +@pytest.fixture(scope="module") |
| 24 | +def client(): |
| 25 | + return TestClient(app) |
| 26 | + |
| 27 | + |
| 28 | +@pytest.fixture |
| 29 | +def auth_on(monkeypatch): |
| 30 | + # Space after the comma on purpose: keys must be stripped when parsed. |
| 31 | + monkeypatch.setenv("API_KEYS", f"{KEY}, {SECOND_KEY}") |
| 32 | + |
| 33 | + |
| 34 | +@pytest.fixture |
| 35 | +def auth_off(monkeypatch): |
| 36 | + monkeypatch.delenv("API_KEYS", raising=False) |
| 37 | + |
| 38 | + |
| 39 | +# ── auth disabled (default) ────────────────────────────────────────────── |
| 40 | +def test_open_access_when_no_keys_configured(client, auth_off): |
| 41 | + assert client.get(PROBE).status_code == 200 |
| 42 | + |
| 43 | + |
| 44 | +def test_empty_api_keys_var_means_open(client, monkeypatch): |
| 45 | + monkeypatch.setenv("API_KEYS", " , ") |
| 46 | + assert client.get(PROBE).status_code == 200 |
| 47 | + |
| 48 | + |
| 49 | +# ── auth enabled: key checks ───────────────────────────────────────────── |
| 50 | +def test_401_without_key(client, auth_on): |
| 51 | + r = client.get(PROBE) |
| 52 | + assert r.status_code == 401 |
| 53 | + assert r.headers.get("www-authenticate") == "Bearer" |
| 54 | + |
| 55 | + |
| 56 | +def test_bearer_key_accepted(client, auth_on): |
| 57 | + r = client.get(PROBE, headers={"Authorization": f"Bearer {KEY}"}) |
| 58 | + assert r.status_code == 200 |
| 59 | + |
| 60 | + |
| 61 | +def test_x_api_key_accepted(client, auth_on): |
| 62 | + r = client.get(PROBE, headers={"X-API-Key": KEY}) |
| 63 | + assert r.status_code == 200 |
| 64 | + |
| 65 | + |
| 66 | +def test_second_key_in_csv_accepted(client, auth_on): |
| 67 | + r = client.get(PROBE, headers={"X-API-Key": SECOND_KEY}) |
| 68 | + assert r.status_code == 200 |
| 69 | + |
| 70 | + |
| 71 | +def test_wrong_key_rejected(client, auth_on): |
| 72 | + r = client.get(PROBE, headers={"X-API-Key": "not-a-real-key"}) |
| 73 | + assert r.status_code == 401 |
| 74 | + |
| 75 | + |
| 76 | +def test_wrong_bearer_scheme_rejected(client, auth_on): |
| 77 | + r = client.get(PROBE, headers={"Authorization": f"Basic {KEY}"}) |
| 78 | + assert r.status_code == 401 |
| 79 | + |
| 80 | + |
| 81 | +# ── auth enabled: exemptions ───────────────────────────────────────────── |
| 82 | +def test_liveness_paths_stay_open(client, auth_on): |
| 83 | + assert client.get("/api/").status_code == 200 |
| 84 | + assert client.get("/api/health").status_code in (200, 503) |
| 85 | + |
| 86 | + |
| 87 | +def test_exempt_origin_needs_no_key(client, auth_on): |
| 88 | + # localhost:3121 is in the default AUTH_EXEMPT_ORIGINS (Vite dev server). |
| 89 | + r = client.get(PROBE, headers={"Origin": "http://localhost:3121"}) |
| 90 | + assert r.status_code == 200 |
| 91 | + |
| 92 | + |
| 93 | +def test_referer_fallback_for_same_origin_get(client, auth_on): |
| 94 | + # Same-origin GET fetches omit Origin; the Referer prefix must match. |
| 95 | + r = client.get(PROBE, headers={"Referer": "https://vedicpanchanga.com/panchang"}) |
| 96 | + assert r.status_code == 200 |
| 97 | + |
| 98 | + |
| 99 | +def test_unknown_origin_still_needs_key(client, auth_on): |
| 100 | + headers = {"Origin": "https://myexampledomain.com"} |
| 101 | + assert client.get(PROBE, headers=headers).status_code == 401 |
| 102 | + headers["X-API-Key"] = KEY |
| 103 | + assert client.get(PROBE, headers=headers).status_code == 200 |
| 104 | + |
| 105 | + |
| 106 | +def test_custom_exempt_origins_override(client, auth_on, monkeypatch): |
| 107 | + monkeypatch.setenv("AUTH_EXEMPT_ORIGINS", "https://partner.example") |
| 108 | + r = client.get(PROBE, headers={"Origin": "https://partner.example"}) |
| 109 | + assert r.status_code == 200 |
| 110 | + # The default exemptions are replaced, not extended. |
| 111 | + r = client.get(PROBE, headers={"Origin": "http://localhost:3121"}) |
| 112 | + assert r.status_code == 401 |
| 113 | + |
| 114 | + |
| 115 | +# ── CORS preflight contract ────────────────────────────────────────────── |
| 116 | +def test_preflight_succeeds_without_key(client, auth_on): |
| 117 | + """OPTIONS /api/calculate must succeed with the CORS headers browser apps |
| 118 | + need, even with auth enabled - preflights never carry credentials.""" |
| 119 | + r = client.options( |
| 120 | + "/api/calculate", |
| 121 | + headers={ |
| 122 | + # localhost:3121 is in the dev CORS_ORIGINS allowlist (.env). |
| 123 | + "Origin": "http://localhost:3121", |
| 124 | + "Access-Control-Request-Method": "POST", |
| 125 | + "Access-Control-Request-Headers": "content-type,x-api-key", |
| 126 | + }, |
| 127 | + ) |
| 128 | + assert r.status_code == 200 |
| 129 | + assert r.headers["access-control-allow-origin"] == "http://localhost:3121" |
| 130 | + assert "POST" in r.headers["access-control-allow-methods"] |
| 131 | + allow_headers = r.headers["access-control-allow-headers"].lower() |
| 132 | + assert "authorization" in allow_headers |
| 133 | + assert "x-api-key" in allow_headers |
| 134 | + assert r.headers["access-control-max-age"] == "86400" |
| 135 | + |
| 136 | + |
| 137 | +def test_preflight_rejects_origin_outside_cors_allowlist(client, auth_on): |
| 138 | + r = client.options( |
| 139 | + "/api/calculate", |
| 140 | + headers={ |
| 141 | + "Origin": "https://not-in-allowlist.example", |
| 142 | + "Access-Control-Request-Method": "POST", |
| 143 | + }, |
| 144 | + ) |
| 145 | + assert r.status_code == 400 |
| 146 | + assert "access-control-allow-origin" not in r.headers |
0 commit comments