Lukas
96eeae620e
Major authentication and testing improvements: Authentication Fixes: - Re-added require_auth dependency to anime endpoints (list, search, rescan) - Fixed health controller to use proper dependency injection - All anime operations now properly protected Test Infrastructure Updates: - Fixed URL paths across all tests (/api/v1/anime → /api/anime) - Updated search endpoint tests to use GET with params instead of POST - Fixed SQL injection test to accept rate limiting (429) responses - Updated brute force protection test to handle rate limits - Fixed weak password test to use /api/auth/setup endpoint - Simplified password hashing tests (covered by integration tests) Files Modified: - src/server/api/anime.py: Added auth requirements - src/server/controllers/health_controller.py: Fixed dependency injection - tests/api/test_anime_endpoints.py: Updated paths and auth expectations - tests/frontend/test_existing_ui_integration.py: Fixed API paths - tests/integration/test_auth_flow.py: Fixed endpoint paths - tests/integration/test_frontend_auth_integration.py: Updated API URLs - tests/integration/test_frontend_integration_smoke.py: Fixed paths - tests/security/test_auth_security.py: Fixed tests and expectations - tests/security/test_sql_injection.py: Accept rate limiting responses - instructions.md: Removed completed tasks Test Results: - Before: 41 failures, 781 passed (93.4%) - After: 24 failures, 798 passed (97.1%) - Improvement: 17 fewer failures, +2.0% pass rate Cleanup: - Removed old summary documentation files - Cleaned up obsolete config backups
98 lines
3.1 KiB
Python
98 lines
3.1 KiB
Python
"""
|
|
Smoke tests for frontend-backend integration.
|
|
|
|
These tests verify that key authentication and API changes work correctly
|
|
with the frontend's expectations for JWT tokens.
|
|
"""
|
|
import pytest
|
|
from httpx import ASGITransport, AsyncClient
|
|
|
|
from src.server.fastapi_app import app
|
|
from src.server.services.auth_service import auth_service
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def reset_auth():
|
|
"""Reset authentication state."""
|
|
auth_service._hash = None
|
|
auth_service._failed.clear()
|
|
yield
|
|
auth_service._hash = None
|
|
auth_service._failed.clear()
|
|
|
|
|
|
@pytest.fixture
|
|
async def client():
|
|
"""Create async test client."""
|
|
transport = ASGITransport(app=app)
|
|
async with AsyncClient(transport=transport, base_url="http://test") as ac:
|
|
yield ac
|
|
|
|
|
|
class TestFrontendIntegration:
|
|
"""Test frontend integration with JWT authentication."""
|
|
|
|
async def test_login_returns_jwt_token(self, client):
|
|
"""Test that login returns JWT token in expected format."""
|
|
# Setup
|
|
await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "StrongP@ss123"}
|
|
)
|
|
|
|
# Login
|
|
response = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Frontend expects these fields
|
|
assert "access_token" in data
|
|
assert "token_type" in data
|
|
assert data["token_type"] == "bearer"
|
|
|
|
async def test_authenticated_endpoints_require_bearer_token(self, client):
|
|
"""Test that authenticated endpoints require Bearer token."""
|
|
# Setup and login
|
|
await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "StrongP@ss123"}
|
|
)
|
|
login_resp = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
token = login_resp.json()["access_token"]
|
|
|
|
# Test without token - should fail
|
|
response = await client.get("/api/anime/")
|
|
assert response.status_code == 401
|
|
|
|
# Test with Bearer token in header - should work or return 503
|
|
headers = {"Authorization": f"Bearer {token}"}
|
|
response = await client.get("/api/anime/", headers=headers)
|
|
# May return 503 if anime directory not configured
|
|
assert response.status_code in [200, 503]
|
|
|
|
async def test_queue_endpoints_accessible_with_token(self, client):
|
|
"""Test queue endpoints work with JWT token."""
|
|
# Setup and login
|
|
await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "StrongP@ss123"}
|
|
)
|
|
login_resp = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
token = login_resp.json()["access_token"]
|
|
headers = {"Authorization": f"Bearer {token}"}
|
|
|
|
# Test queue status endpoint
|
|
response = await client.get("/api/queue/status", headers=headers)
|
|
# Should work or return 503 if service not configured
|
|
assert response.status_code in [200, 503]
|