fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

Commit d2217531 (google-labs-jules SSRF fix) catastrophically deleted 11,500+ lines across 100+ files while fixing an unrelated IMAP issue. Restored from d2217531^ (pre-bad-commit state): Deleted files (fully restored): - app/api/{automation,classification_rules,comments,sharing}.py - app/middleware/upload_rate_limit.py - app/tasks/{automation_tasks,classify_document}.py - app/utils/{automation_hooks,classification_rules}.py - docs/AppleAppStoreCompliance.md - frontend/input.css, package.json, package-lock.json, tailwind.config.js - frontend/static/js/{annotations,claim,comments,sharing}.js - frontend/templates/{admin_connections,file_annotations,file_summary}.html - tests/{test_api_files_comprehensive,test_auth_extended,test_sharing, test_comments,test_connections,test_imap_profiles,test_api_sessions, test_automation,test_classification_rules,test_api_advanced_filters, test_api_classification_rules,test_upload_rate_limit,test_api_dropbox, test_classify_document,test_comments_ui,test_upload_to_icloud, test_api_onedrive_comprehensive,test_frontend_build,test_sentry, test_diagnostic,test_database,test_views_dropbox,test_local_auth}.py Truncated files (content restored): - app/{auth,config,main,models,celery_worker,database}.py - app/api/{__init__,api_tokens,diagnostic,dropbox,files,google_drive, integrations,local_auth,mobile,onedrive,pipelines,qr_auth, settings,url_upload}.py - app/middleware/upload_rate_limit.py - app/tasks/upload_to_nextcloud.py - app/utils/{allowed_types,settings_service,settings_sync,user_scope,webhook}.py - app/views/{base,dropbox,files,google_drive,onedrive,settings}.py - docs/{API,AuthenticationSetup,ConfigurationGuide,DatabaseConfiguration, DeploymentGuide,DropboxSetup,GoogleDriveSetup,KubernetesDeployment, MobileApp,OneDriveSetup,ProductionReadiness,SentrySetup, SocialLoginSetup,UserGuide}.md - frontend/static/{js/upload.js,styles.css} - frontend/templates/{api_tokens,base,devices,dropbox,dropbox_callback, file_view,files,google_drive,onedrive,onedrive_callback, signup}.html - frontend/translations/en.json - migrations/env.py - tests/{conftest,test_api_integrations,test_api_mobile,test_api_settings, test_api_tokens,test_audit_logs,test_duplicates,test_imap_tasks, test_setup_wizard,test_views_files_comprehensive}.py Security fixes kept from post-d2217531 commits: - app/utils/network.py: DNS SSRF fail-secure fix (06b0fced) - app/utils/file_operations.py: path traversal fix (1018ea17) - tests/test_imap_tasks.py: re-applied 4 is_private_ip mock patches Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/51133dd8-9bec-41ab-aa10-3de753634187
2026-03-23 23:52:39 +00:00
parent 11a49eb7fd
commit c7d3ec57c3
115 changed files with 23532 additions and 1043 deletions
@@ -180,6 +180,27 @@ class TestSettingModels:
        assert update.key == "test_key"
        assert update.value is None

+    def test_setting_value_update_model(self):
+        """Test SettingValueUpdate model (PUT body — no key required)."""
+        from app.api.settings import SettingValueUpdate
+
+        body = SettingValueUpdate(value="test_value")
+        assert body.value == "test_value"
+
+    def test_setting_value_update_model_with_none_value(self):
+        """Test SettingValueUpdate model accepts None value."""
+        from app.api.settings import SettingValueUpdate
+
+        body = SettingValueUpdate(value=None)
+        assert body.value is None
+
+    def test_setting_value_update_model_defaults_to_none(self):
+        """Test SettingValueUpdate model value defaults to None when omitted."""
+        from app.api.settings import SettingValueUpdate
+
+        body = SettingValueUpdate()
+        assert body.value is None
+
    def test_setting_response_model(self):
        """Test SettingResponse model."""
        from app.api.settings import SettingResponse
@@ -205,8 +226,100 @@ class TestSettingModels:
        assert "test_key" in response.db_settings


-@pytest.mark.unit
-class TestListCredentials:
+@pytest.mark.integration
+class TestPutSettingEndpoint:
+    """Tests for PUT /api/settings/{key} endpoint."""
+
+    def test_put_setting_requires_admin(self, client):
+        """Test PUT /settings/{key} requires admin access."""
+        response = client.put("/api/settings/social_auth_dropbox_enabled", json={"value": "true"})
+        assert response.status_code in [302, 401, 403]
+
+    @patch("app.api.settings.notify_settings_updated")
+    @patch("app.api.settings.get_setting_metadata")
+    @patch("app.api.settings.validate_setting_value")
+    @patch("app.api.settings.save_setting_to_db")
+    def test_put_setting_saves_value(self, mock_save, mock_validate, mock_metadata, mock_notify, client):
+        """Test PUT /settings/{key} saves the value when authenticated as admin."""
+        from app.api.settings import require_admin
+        from app.main import app as fastapi_app
+
+        mock_validate.return_value = (True, None)
+        mock_save.return_value = True
+        mock_metadata.return_value = {"restart_required": True}
+
+        def override_require_admin():
+            return {"id": "admin", "is_admin": True, "preferred_username": "admin"}
+
+        fastapi_app.dependency_overrides[require_admin] = override_require_admin
+        try:
+            response = client.put(
+                "/api/settings/social_auth_dropbox_enabled",
+                json={"value": "true"},
+            )
+            assert response.status_code == 200
+            data = response.json()
+            assert data["success"] is True
+            assert data["key"] == "social_auth_dropbox_enabled"
+            assert data["value"] == "true"
+            assert data["restart_required"] is True
+        finally:
+            fastapi_app.dependency_overrides.pop(require_admin, None)
+
+    @patch("app.api.settings.notify_settings_updated")
+    @patch("app.api.settings.get_setting_metadata")
+    @patch("app.api.settings.validate_setting_value")
+    @patch("app.api.settings.save_setting_to_db")
+    def test_put_setting_body_without_key_field_is_accepted(
+        self, mock_save, mock_validate, mock_metadata, mock_notify, client
+    ):
+        """Test PUT /settings/{key} body need not contain a key field."""
+        from app.api.settings import require_admin
+        from app.main import app as fastapi_app
+
+        mock_validate.return_value = (True, None)
+        mock_save.return_value = True
+        mock_metadata.return_value = {"restart_required": False}
+
+        def override_require_admin():
+            return {"id": "admin", "is_admin": True, "preferred_username": "admin"}
+
+        fastapi_app.dependency_overrides[require_admin] = override_require_admin
+        try:
+            # Body only contains "value" — no "key" field (mirrors admin_connections.html behaviour)
+            response = client.put(
+                "/api/settings/social_auth_dropbox_use_global_credentials",
+                json={"value": "false"},
+            )
+            assert response.status_code == 200
+            data = response.json()
+            assert data["success"] is True
+        finally:
+            fastapi_app.dependency_overrides.pop(require_admin, None)
+
+    @patch("app.api.settings.validate_setting_value")
+    @patch("app.api.settings.get_setting_metadata")
+    def test_put_setting_returns_400_on_invalid_value(self, mock_metadata, mock_validate, client):
+        """Test PUT /settings/{key} returns 400 for invalid values."""
+        from app.api.settings import require_admin
+        from app.main import app as fastapi_app
+
+        mock_validate.return_value = (False, "Invalid boolean value")
+        mock_metadata.return_value = {"restart_required": False}
+
+        def override_require_admin():
+            return {"id": "admin", "is_admin": True}
+
+        fastapi_app.dependency_overrides[require_admin] = override_require_admin
+        try:
+            response = client.put(
+                "/api/settings/social_auth_dropbox_enabled",
+                json={"value": "not_a_bool"},
+            )
+            assert response.status_code == 400
+        finally:
+            fastapi_app.dependency_overrides.pop(require_admin, None)
+
    """Tests for the list_credentials function (GET /api/settings/credentials)."""

    @patch("app.api.settings.get_all_settings_from_db")