Jens/Unraid-AppOps-Gateway-Public
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

Browse Source
This commit is contained in:
Public Source Publisher committed 2026-10-01 19:39:31 +00:00
1 parent c61fbfd87f
commit 1a54836efc
101 files changed
+4973 -1298
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/tests/test_production_runtime.py
+4 -72
View File
@@ -64,7 +64,7 @@ def api_client(tmp_path, monkeypatch):
settings.environment = "production"
settings.voice_token = "test-voice-token"
security.settings.voice_token = "test-voice-token"
for key in ["PORTAINER_URL", "PORTAINER_API_KEY", "PORTAINER_ENDPOINT_ID"]:
for key in ["PORTAINER_URL", "PORTAINER_API_KEY", "PORTAINER_ENDPOINT_ID", "UNRAID_URL", "UNRAID_API_KEY"]:
settings.apis[key] = None
engine = create_engine(
@@ -252,77 +252,9 @@ def test_deep_health_is_available_without_admin_token(api_client):
assert "setup" in payload
def test_operator_token_is_exchanged_for_a_revocable_browser_session(api_client):
from backend.app.core import security
from backend.app.core.config import settings
token = "strong-session-test-operator-token-value"
previous = (settings.operator_auth_required, settings.operator_token)
settings.operator_auth_required = True
settings.operator_token = token
try:
unlocked = api_client.post(
"/api/operator/session",
headers={"X-AppOps-Operator-Token": token},
)
assert unlocked.status_code == 200
assert unlocked.json() == {"authorized": True, "mode": "session", "identity": None}
cookie = unlocked.headers["set-cookie"]
assert "appops_operator_session=" in cookie
assert "HttpOnly" in cookie
assert "SameSite=strict" in cookie
assert "Max-Age" not in cookie
assert token not in cookie
restored = api_client.get("/api/operator/session")
assert restored.json() == {"authorized": True, "mode": "session", "identity": None}
settings.operator_token = "a-new-strong-session-test-operator-token"
assert api_client.get("/api/operator/session").json()["authorized"] is False
settings.operator_token = token
assert api_client.get("/api/operator/session").json()["authorized"] is False
wrong_token = api_client.post(
"/api/operator/session",
headers={"X-AppOps-Operator-Token": "wrong-operator-token"},
)
assert wrong_token.status_code == 403
assert "set-cookie" not in wrong_token.headers
unlocked = api_client.post(
"/api/operator/session",
headers={"X-AppOps-Operator-Token": token},
)
assert unlocked.status_code == 200
missing_csrf = api_client.delete("/api/operator/session")
assert missing_csrf.status_code == 403
locked = api_client.delete(
"/api/operator/session",
headers={security.OPERATOR_SESSION_CSRF_HEADER: "1"},
)
assert locked.status_code == 200
assert api_client.get("/api/operator/session").json()["authorized"] is False
finally:
settings.operator_auth_required, settings.operator_token = previous
def test_operator_auth_policy_can_be_enabled_and_persists(api_client):
from backend.app.core.config import settings
from backend.app.db.models import AppSetting
from backend.app.db.session import engine
previous = settings.operator_auth_required
settings.operator_auth_required = False
try:
assert api_client.get("/api/runtime/operator-auth").json() == {"required": False}
response = api_client.patch("/api/runtime/operator-auth", json={"required": True})
assert response.status_code == 200
assert response.json() == {"required": True}
with Session(engine) as session:
assert session.get(AppSetting, "security.operator_auth").value_json == {"required": True}
finally:
settings.operator_auth_required = previous
def test_legacy_unlock_and_anonymous_admin_switch_are_removed(api_client):
assert api_client.post("/api/operator/session").status_code in {404, 405}
assert api_client.patch("/api/runtime/operator-auth", json={"required": False}).status_code in {404, 405}
def test_admin_exports_are_secret_safe(api_client):