Lukas
6bc440dce4
- Add comprehensive documentation for backend development - Improve client IP detection with utility functions and tests - Update auth router with better error handling - Refactor config module with environment-based settings Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
315 lines
12 KiB
Python
315 lines
12 KiB
Python
"""Unit tests for application configuration and validation."""
|
|
|
|
import pytest
|
|
from pydantic import ValidationError
|
|
|
|
from app.config import Settings
|
|
|
|
|
|
def test_fail2ban_start_command_validates_simple_command() -> None:
|
|
"""Simple fail2ban commands without special characters are accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command="fail2ban-client start",
|
|
)
|
|
assert settings.fail2ban_start_command == "fail2ban-client start"
|
|
|
|
|
|
def test_fail2ban_start_command_validates_systemctl_command() -> None:
|
|
"""systemctl commands are accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command="systemctl start fail2ban",
|
|
)
|
|
assert settings.fail2ban_start_command == "systemctl start fail2ban"
|
|
|
|
|
|
def test_fail2ban_start_command_accepts_quoted_paths() -> None:
|
|
"""Commands with quoted paths containing spaces are accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command='"/opt/my tools/fail2ban-client" start',
|
|
)
|
|
assert settings.fail2ban_start_command == '"/opt/my tools/fail2ban-client" start'
|
|
|
|
|
|
def test_fail2ban_start_command_rejects_mismatched_quotes() -> None:
|
|
"""Commands with mismatched quotes raise ValidationError."""
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command='"/opt/my tools/fail2ban-client start',
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
assert "fail2ban_start_command" in error_msg
|
|
assert "mismatched quotes" in error_msg or "No closing quotation" in error_msg
|
|
|
|
|
|
def test_fail2ban_start_command_error_includes_problematic_value() -> None:
|
|
"""Validation errors include the problematic command value."""
|
|
problematic_command = '"/opt/broken start'
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command=problematic_command,
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
assert problematic_command in error_msg
|
|
|
|
|
|
def test_fail2ban_start_command_default_value_is_valid() -> None:
|
|
"""The default fail2ban_start_command value is valid and parseable."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
)
|
|
assert settings.fail2ban_start_command == "fail2ban-client start"
|
|
|
|
|
|
def test_fail2ban_start_command_single_quoted() -> None:
|
|
"""Commands with single quotes are accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command="'/usr/bin/fail2ban-client' start",
|
|
)
|
|
assert settings.fail2ban_start_command == "'/usr/bin/fail2ban-client' start"
|
|
|
|
|
|
def test_fail2ban_start_command_multiple_arguments() -> None:
|
|
"""Commands with multiple arguments are accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="test-secret-key-do-not-use-in-production",
|
|
fail2ban_start_command="fail2ban-client -c /etc/fail2ban start",
|
|
)
|
|
assert settings.fail2ban_start_command == "fail2ban-client -c /etc/fail2ban start"
|
|
|
|
|
|
def test_session_secret_enforces_minimum_length() -> None:
|
|
"""session_secret must be at least 32 characters."""
|
|
# Test with a secret shorter than 32 characters
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="short-secret",
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
assert "session_secret" in error_msg
|
|
assert "32" in error_msg or "at least" in error_msg
|
|
|
|
|
|
def test_session_secret_accepts_32_characters() -> None:
|
|
"""session_secret with exactly 32 characters is accepted."""
|
|
secret_32 = "a" * 32 # Exactly 32 characters
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret=secret_32,
|
|
)
|
|
assert settings.session_secret == secret_32
|
|
|
|
|
|
def test_session_secret_accepts_longer_than_32() -> None:
|
|
"""session_secret with more than 32 characters is accepted."""
|
|
secret_64 = "b" * 64 # 64 characters
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret=secret_64,
|
|
)
|
|
assert settings.session_secret == secret_64
|
|
|
|
|
|
def test_session_secret_error_message_includes_guidance() -> None:
|
|
"""Validation error for short session_secret includes secret generation guidance."""
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="too-short",
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
# Verify the error mentions the constraint
|
|
assert "session_secret" in error_msg
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# trusted_proxies configuration tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_trusted_proxies_default_is_empty_list() -> None:
|
|
"""By default, trusted_proxies is an empty list (no trusted proxies)."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
)
|
|
assert settings.trusted_proxies == []
|
|
|
|
|
|
def test_trusted_proxies_accepts_single_ip() -> None:
|
|
"""Single IP address is accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="192.168.1.1",
|
|
)
|
|
assert settings.trusted_proxies == ["192.168.1.1"]
|
|
|
|
|
|
def test_trusted_proxies_accepts_single_cidr() -> None:
|
|
"""Single CIDR range is accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="10.0.0.0/8",
|
|
)
|
|
assert settings.trusted_proxies == ["10.0.0.0/8"]
|
|
|
|
|
|
def test_trusted_proxies_accepts_comma_separated_list() -> None:
|
|
"""Comma-separated list of IPs and CIDRs is accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="192.168.1.1,10.0.0.0/8,172.16.0.0/12",
|
|
)
|
|
assert settings.trusted_proxies == ["192.168.1.1", "10.0.0.0/8", "172.16.0.0/12"]
|
|
|
|
|
|
def test_trusted_proxies_accepts_list() -> None:
|
|
"""List of IPs and CIDRs is accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies=["192.168.1.1", "10.0.0.0/8"],
|
|
)
|
|
assert settings.trusted_proxies == ["192.168.1.1", "10.0.0.0/8"]
|
|
|
|
|
|
def test_trusted_proxies_strips_whitespace() -> None:
|
|
"""Whitespace around IPs is stripped."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies=" 192.168.1.1 , 10.0.0.0/8 ",
|
|
)
|
|
assert settings.trusted_proxies == ["192.168.1.1", "10.0.0.0/8"]
|
|
|
|
|
|
def test_trusted_proxies_rejects_invalid_ip() -> None:
|
|
"""Invalid IP address is rejected."""
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="not-an-ip",
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
assert "trusted_proxies" in error_msg or "Invalid IP" in error_msg
|
|
|
|
|
|
def test_trusted_proxies_rejects_invalid_cidr() -> None:
|
|
"""Invalid CIDR range is rejected."""
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="10.0.0.0/33", # Invalid - /33 is out of range for IPv4
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
assert "trusted_proxies" in error_msg or "Invalid IP" in error_msg
|
|
|
|
|
|
def test_trusted_proxies_rejects_one_invalid_in_list() -> None:
|
|
"""One invalid IP in a list causes entire list to be rejected."""
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="192.168.1.1,invalid-ip,10.0.0.0/8",
|
|
)
|
|
error_msg = str(exc_info.value)
|
|
assert "trusted_proxies" in error_msg or "Invalid IP" in error_msg
|
|
|
|
|
|
def test_trusted_proxies_accepts_ipv6_address() -> None:
|
|
"""IPv6 address is accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="2001:db8::1",
|
|
)
|
|
assert settings.trusted_proxies == ["2001:db8::1"]
|
|
|
|
|
|
def test_trusted_proxies_accepts_ipv6_cidr() -> None:
|
|
"""IPv6 CIDR range is accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="2001:db8::/32",
|
|
)
|
|
assert settings.trusted_proxies == ["2001:db8::/32"]
|
|
|
|
|
|
def test_trusted_proxies_accepts_mixed_ipv4_and_ipv6() -> None:
|
|
"""Mixed IPv4 and IPv6 addresses and ranges are accepted."""
|
|
settings = Settings(
|
|
database_path="/tmp/test.db",
|
|
fail2ban_socket="/tmp/fake_fail2ban.sock",
|
|
fail2ban_config_dir="/tmp/fail2ban",
|
|
session_secret="a" * 32,
|
|
trusted_proxies="192.168.1.0/24,2001:db8::/32,10.0.0.1",
|
|
)
|
|
assert settings.trusted_proxies == ["192.168.1.0/24", "2001:db8::/32", "10.0.0.1"]
|