126 lines
4.7 KiB
Python
126 lines
4.7 KiB
Python
import asyncio
|
|
from dataclasses import replace
|
|
|
|
import httpx
|
|
from cryptography.fernet import Fernet
|
|
from fastapi import Query
|
|
|
|
from backend.bootstrap.application import create_application
|
|
from backend.bootstrap.settings import Settings
|
|
from backend.http.errors import AppError
|
|
from tests.support import request
|
|
|
|
|
|
def test_health_reports_runtime_environment(tmp_path) -> None:
|
|
application = create_application(Settings.for_test(tmp_path))
|
|
response = request(application, "/api/health")
|
|
|
|
assert response.status_code == 200
|
|
assert response.json() == {
|
|
"status": "ok",
|
|
"environment": "test",
|
|
"components": {"process": "ok", "database": "ok"},
|
|
}
|
|
assert len(response.headers["X-Request-ID"]) == 32
|
|
assert response.headers["X-Content-Type-Options"] == "nosniff"
|
|
assert response.headers["X-Frame-Options"] == "DENY"
|
|
|
|
|
|
def test_unknown_failure_uses_safe_error_contract(tmp_path) -> None:
|
|
application = create_application(Settings.for_test(tmp_path))
|
|
|
|
@application.get("/api/test/failure")
|
|
def fail() -> None:
|
|
raise RuntimeError("secret provider details")
|
|
|
|
response = request(application, "/api/test/failure")
|
|
|
|
payload = response.json()["error"]
|
|
assert response.status_code == 500
|
|
assert payload["code"] == "internal_error"
|
|
assert payload["message"] == "服务暂时不可用，请稍后重试。"
|
|
assert "secret provider details" not in response.text
|
|
assert len(payload["request_id"]) == 32
|
|
assert response.headers["X-Request-ID"] == payload["request_id"]
|
|
|
|
|
|
def test_application_error_uses_business_message(tmp_path) -> None:
|
|
application = create_application(Settings.for_test(tmp_path))
|
|
|
|
@application.get("/api/test/locked")
|
|
def locked() -> None:
|
|
raise AppError("membership_required", "该功能仅对会员开放。", 403)
|
|
|
|
response = request(application, "/api/test/locked")
|
|
|
|
assert response.status_code == 403
|
|
assert response.json()["error"]["code"] == "membership_required"
|
|
assert response.json()["error"]["message"] == "该功能仅对会员开放。"
|
|
|
|
|
|
def test_framework_404_uses_the_same_safe_contract(tmp_path) -> None:
|
|
application = create_application(Settings.for_test(tmp_path))
|
|
|
|
response = request(application, "/api/does-not-exist")
|
|
|
|
assert response.status_code == 404
|
|
assert response.json()["error"]["code"] == "not_found"
|
|
assert response.json()["error"]["message"] == "请求的内容不存在。"
|
|
|
|
|
|
def test_validation_error_does_not_expose_framework_details(tmp_path) -> None:
|
|
application = create_application(Settings.for_test(tmp_path))
|
|
|
|
@application.get("/api/test/validated")
|
|
def validated(value: int = Query(ge=1)) -> dict[str, int]:
|
|
return {"value": value}
|
|
|
|
response = request(application, "/api/test/validated?value=wrong")
|
|
|
|
assert response.status_code == 422
|
|
assert response.json()["error"]["code"] == "invalid_request"
|
|
assert "integer" not in response.text.lower()
|
|
|
|
|
|
def test_production_frontend_serves_spa_without_capturing_api_404(tmp_path) -> None:
|
|
settings = Settings.for_test(tmp_path)
|
|
settings.frontend_dist_directory.mkdir(parents=True)
|
|
settings.frontend_dist_directory.joinpath("index.html").write_text(
|
|
"<main>application</main>", encoding="utf-8"
|
|
)
|
|
settings.frontend_dist_directory.joinpath("assets").mkdir()
|
|
settings.frontend_dist_directory.joinpath("assets", "asset.js").write_text(
|
|
"window.ready=true", encoding="utf-8"
|
|
)
|
|
application = create_application(settings)
|
|
|
|
assert request(application, "/review/history").text == "<main>application</main>"
|
|
asset_response = request(application, "/assets/asset.js")
|
|
assert asset_response.text == "window.ready=true"
|
|
assert asset_response.headers["Cache-Control"] == "public,max-age=31536000,immutable"
|
|
api_response = request(application, "/api/unknown")
|
|
assert api_response.status_code == 404
|
|
assert api_response.json()["error"]["code"] == "not_found"
|
|
|
|
|
|
def test_production_security_headers_are_strict_on_https(tmp_path) -> None:
|
|
settings = Settings.for_test(tmp_path)
|
|
settings = replace(
|
|
settings,
|
|
environment="production",
|
|
encryption_key=Fernet.generate_key().decode("ascii"),
|
|
)
|
|
application = create_application(settings)
|
|
|
|
async def get():
|
|
transport = httpx.ASGITransport(app=application)
|
|
async with application.router.lifespan_context(application):
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="https://testserver"
|
|
) as client:
|
|
return await client.get("/api/health")
|
|
|
|
response = asyncio.run(get())
|
|
assert "default-src 'self'" in response.headers["Content-Security-Policy"]
|
|
assert response.headers["Strict-Transport-Security"].startswith("max-age=31536000")
|