Publish curated VacatureRadar source snapshot

tests/unit/test_settings_security.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+import pytest
+from django.core.exceptions import ImproperlyConfigured
+
+from config.settings import _validate_production_security, env_int_range
+
+
+def test_env_int_range_accepts_default_and_rejects_invalid_values(monkeypatch):
+    monkeypatch.delenv("TEST_BOUNDED_SETTING", raising=False)
+    assert env_int_range("TEST_BOUNDED_SETTING", 6, minimum=0, maximum=23) == 6
+
+    monkeypatch.setenv("TEST_BOUNDED_SETTING", "24")
+    with pytest.raises(ImproperlyConfigured):
+        env_int_range("TEST_BOUNDED_SETTING", 6, minimum=0, maximum=23)
+
+    monkeypatch.setenv("TEST_BOUNDED_SETTING", "morgen")
+    with pytest.raises(ImproperlyConfigured):
+        env_int_range("TEST_BOUNDED_SETTING", 6, minimum=0, maximum=23)
+
+
+def test_validate_production_security_skips_when_debug_mode_is_enabled():
+    _validate_production_security(
+        debug=True,
+        secret_key="dev-only-change-me",
+        allowed_hosts=[],
+        csrf_trusted_origins=[],
+        session_cookie_secure=False,
+        csrf_cookie_secure=False,
+        secure_ssl_redirect=False,
+    )
+
+
+@pytest.mark.parametrize(
+    (
+        "secret_key",
+        "allowed_hosts",
+        "csrf_trusted_origins",
+        "session_cookie_secure",
+        "csrf_cookie_secure",
+        "secure_ssl_redirect",
+    ),
+    [
+        ("", ["example.org"], ["https://example.org"], True, True, True),
+        ("change-me", ["example.org"], ["https://example.org"], True, True, True),
+        ("too-short", ["example.org"], ["https://example.org"], True, True, True),
+        ("a" * 64, [], ["https://example.org"], True, True, True),
+        ("a" * 64, ["*"], ["https://example.org"], True, True, True),
+        ("a" * 64, ["example.org"], [], True, True, True),
+        ("a" * 64, ["example.org"], ["http://example.org"], True, True, True),
+        ("a" * 64, ["example.org"], ["https://example.org"], False, True, True),
+        ("a" * 64, ["example.org"], ["https://example.org"], True, False, True),
+        ("a" * 64, ["example.org"], ["https://example.org"], True, True, False),
+    ],
+)
+def test_validate_production_security_requires_secure_settings_for_prod(
+    secret_key,
+    allowed_hosts,
+    csrf_trusted_origins,
+    session_cookie_secure,
+    csrf_cookie_secure,
+    secure_ssl_redirect,
+):
+    with pytest.raises(ImproperlyConfigured):
+        _validate_production_security(
+            debug=False,
+            secret_key=secret_key,
+            allowed_hosts=allowed_hosts,
+            csrf_trusted_origins=csrf_trusted_origins,
+            session_cookie_secure=session_cookie_secure,
+            csrf_cookie_secure=csrf_cookie_secure,
+            secure_ssl_redirect=secure_ssl_redirect,
+        )
+
+
+def test_validate_production_security_rejects_writable_public_demo():
+    with pytest.raises(ImproperlyConfigured):
+        _validate_production_security(
+            debug=False,
+            secret_key="a" * 64,
+            allowed_hosts=["vacatureradar.itworx.tech"],
+            csrf_trusted_origins=["https://vacatureradar.itworx.tech"],
+            session_cookie_secure=True,
+            csrf_cookie_secure=True,
+            secure_ssl_redirect=True,
+            public_base_url="https://vacatureradar.itworx.tech",
+            demo_mode_enabled=True,
+            demo_read_only=False,
+        )
+
+
+def test_validate_production_security_accepts_read_only_https_demo():
+    _validate_production_security(
+        debug=False,
+        secret_key="a" * 64,
+        allowed_hosts=["vacatureradar.itworx.tech"],
+        csrf_trusted_origins=["https://vacatureradar.itworx.tech"],
+        session_cookie_secure=True,
+        csrf_cookie_secure=True,
+        secure_ssl_redirect=True,
+        public_base_url="https://vacatureradar.itworx.tech",
+        demo_mode_enabled=True,
+        demo_read_only=True,
+    )