copilot-swe-agent[bot]
9f4b162811
Two root causes identified and fixed: 1. tests/test_api_settings.py (TestListCredentials): asyncio.get_event_loop().run_until_complete() raised RuntimeError in Python 3.12 because test_api_auth_enabled.py's asyncio.run() sets the current event loop to None on completion. Replace all 7 occurrences with asyncio.run() which creates its own event loop each time. 2. tests/test_cors.py: reload(app.config) replaced the app.config.settings singleton with a new instance, so app modules holding the original reference no longer saw patches applied to app.config.settings.X. This caused the notification, OpenAI, and file-upload tests to behave as if unpatched. Remove the redundant reload() calls — the tests only need a fresh Settings(...) instance constructed with the env var already set. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
225 lines
8.6 KiB
Python
225 lines
8.6 KiB
Python
#!/usr/bin/env python3
|
|
|
|
"""
|
|
Tests for CORS middleware configuration.
|
|
|
|
These tests validate that:
|
|
- CORS middleware is disabled by default (reverse proxy handles CORS in production)
|
|
- When enabled, CORS headers are present on responses
|
|
- Configuration settings (allowed origins, methods, headers, credentials) are respected
|
|
- Preflight (OPTIONS) requests are handled correctly when CORS is enabled
|
|
"""
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.mark.integration
|
|
def test_cors_configuration_exists():
|
|
"""Test that CORS configuration attributes exist in settings."""
|
|
from app.config import settings
|
|
|
|
assert hasattr(settings, "cors_enabled")
|
|
assert hasattr(settings, "cors_allowed_origins")
|
|
assert hasattr(settings, "cors_allow_credentials")
|
|
assert hasattr(settings, "cors_allowed_methods")
|
|
assert hasattr(settings, "cors_allowed_headers")
|
|
|
|
|
|
@pytest.mark.integration
|
|
def test_cors_disabled_by_default():
|
|
"""Test that CORS is disabled by default (reverse proxy handles it)."""
|
|
from app.config import Settings
|
|
|
|
# The default value for cors_enabled should be False
|
|
field_info = Settings.model_fields.get("cors_enabled")
|
|
assert field_info is not None
|
|
assert field_info.default is False, "CORS should be disabled by default"
|
|
|
|
|
|
@pytest.mark.integration
|
|
def test_cors_configuration_types():
|
|
"""Test that CORS configuration settings have correct types."""
|
|
from app.config import settings
|
|
|
|
assert isinstance(settings.cors_enabled, bool)
|
|
assert isinstance(settings.cors_allowed_origins, list)
|
|
assert isinstance(settings.cors_allow_credentials, bool)
|
|
assert isinstance(settings.cors_allowed_methods, list)
|
|
assert isinstance(settings.cors_allowed_headers, list)
|
|
|
|
|
|
@pytest.mark.unit
|
|
def test_cors_headers_absent_when_disabled(client):
|
|
"""Test that CORS headers are NOT present when middleware is disabled."""
|
|
from app.config import settings
|
|
|
|
if settings.cors_enabled:
|
|
pytest.skip("CORS is enabled in this test environment")
|
|
|
|
response = client.get("/api/diagnostic/health", headers={"Origin": "https://example.com"})
|
|
# When CORS middleware is disabled, the application should not add CORS headers
|
|
assert "access-control-allow-origin" not in response.headers
|
|
|
|
|
|
@pytest.mark.unit
|
|
def test_no_cors_preflight_when_disabled(client):
|
|
"""Test that preflight OPTIONS requests return 405 (or similar) when CORS is disabled."""
|
|
from app.config import settings
|
|
|
|
if settings.cors_enabled:
|
|
pytest.skip("CORS is enabled in this test environment")
|
|
|
|
response = client.options(
|
|
"/api/diagnostic/health",
|
|
headers={
|
|
"Origin": "https://example.com",
|
|
"Access-Control-Request-Method": "GET",
|
|
},
|
|
)
|
|
# Without CORSMiddleware, OPTIONS preflight is not handled as CORS
|
|
assert "access-control-allow-origin" not in response.headers
|
|
|
|
|
|
@pytest.mark.unit
|
|
class TestCORSMiddlewareEnabled:
|
|
"""Tests for CORSMiddleware behavior when enabled."""
|
|
|
|
def _make_app_with_cors(self, allow_origins=None, allow_credentials=False, allow_methods=None, allow_headers=None):
|
|
"""Create a minimal FastAPI app with CORSMiddleware for isolated testing."""
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.testclient import TestClient
|
|
|
|
test_app = FastAPI()
|
|
test_app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=allow_origins or ["https://trusted.example.com"],
|
|
allow_credentials=allow_credentials,
|
|
allow_methods=allow_methods or ["GET", "POST", "OPTIONS"],
|
|
allow_headers=allow_headers or ["*"],
|
|
)
|
|
|
|
@test_app.get("/test")
|
|
def test_endpoint():
|
|
return {"status": "ok"}
|
|
|
|
return TestClient(test_app)
|
|
|
|
def test_cors_header_present_for_allowed_origin(self):
|
|
"""Test that CORS header is present for allowed origin."""
|
|
test_client = self._make_app_with_cors(allow_origins=["https://trusted.example.com"])
|
|
response = test_client.get("/test", headers={"Origin": "https://trusted.example.com"})
|
|
assert response.status_code == 200
|
|
assert "access-control-allow-origin" in response.headers
|
|
assert response.headers["access-control-allow-origin"] == "https://trusted.example.com"
|
|
|
|
def test_cors_wildcard_origin(self):
|
|
"""Test that wildcard origin allows any origin."""
|
|
test_client = self._make_app_with_cors(allow_origins=["*"])
|
|
response = test_client.get("/test", headers={"Origin": "https://any-origin.example.com"})
|
|
assert response.status_code == 200
|
|
assert "access-control-allow-origin" in response.headers
|
|
|
|
def test_cors_preflight_returns_200(self):
|
|
"""Test that CORS preflight OPTIONS request returns 200."""
|
|
test_client = self._make_app_with_cors(allow_origins=["https://trusted.example.com"])
|
|
response = test_client.options(
|
|
"/test",
|
|
headers={
|
|
"Origin": "https://trusted.example.com",
|
|
"Access-Control-Request-Method": "GET",
|
|
"Access-Control-Request-Headers": "Content-Type",
|
|
},
|
|
)
|
|
assert response.status_code == 200
|
|
assert "access-control-allow-origin" in response.headers
|
|
|
|
def test_cors_credentials_allowed(self):
|
|
"""Test that credentials header is present when allow_credentials=True."""
|
|
test_client = self._make_app_with_cors(
|
|
allow_origins=["https://trusted.example.com"],
|
|
allow_credentials=True,
|
|
)
|
|
response = test_client.get("/test", headers={"Origin": "https://trusted.example.com"})
|
|
assert response.status_code == 200
|
|
assert response.headers.get("access-control-allow-credentials") == "true"
|
|
|
|
def test_cors_methods_in_preflight(self):
|
|
"""Test that allowed methods appear in preflight response."""
|
|
test_client = self._make_app_with_cors(
|
|
allow_origins=["https://trusted.example.com"],
|
|
allow_methods=["GET", "POST"],
|
|
)
|
|
response = test_client.options(
|
|
"/test",
|
|
headers={
|
|
"Origin": "https://trusted.example.com",
|
|
"Access-Control-Request-Method": "POST",
|
|
},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
|
|
@pytest.mark.unit
|
|
def test_cors_parse_comma_separated_origins():
|
|
"""Test that comma-separated CORS origins string is parsed into a list."""
|
|
import os
|
|
|
|
# Temporarily set env var to test parsing
|
|
original = os.environ.get("CORS_ALLOWED_ORIGINS")
|
|
os.environ["CORS_ALLOWED_ORIGINS"] = "https://app.example.com,https://admin.example.com"
|
|
try:
|
|
from app.config import Settings
|
|
|
|
test_settings = Settings(
|
|
database_url="sqlite:///:memory:",
|
|
redis_url="redis://localhost:6379/0",
|
|
openai_api_key="test-key",
|
|
azure_ai_key="test-key",
|
|
azure_region="test",
|
|
azure_endpoint="https://test.cognitiveservices.azure.com/",
|
|
gotenberg_url="http://localhost:3000",
|
|
workdir="/tmp",
|
|
auth_enabled=False,
|
|
)
|
|
assert isinstance(test_settings.cors_allowed_origins, list)
|
|
assert len(test_settings.cors_allowed_origins) == 2
|
|
origins = set(test_settings.cors_allowed_origins)
|
|
assert origins == {"https://app.example.com", "https://admin.example.com"}
|
|
finally:
|
|
if original is None:
|
|
os.environ.pop("CORS_ALLOWED_ORIGINS", None)
|
|
else:
|
|
os.environ["CORS_ALLOWED_ORIGINS"] = original
|
|
|
|
|
|
@pytest.mark.unit
|
|
def test_cors_single_origin_string_to_list():
|
|
"""Test that a single-origin string is parsed into a list with one item."""
|
|
import os
|
|
|
|
original = os.environ.get("CORS_ALLOWED_ORIGINS")
|
|
os.environ["CORS_ALLOWED_ORIGINS"] = "https://app.example.com"
|
|
try:
|
|
from app.config import Settings
|
|
|
|
test_settings = Settings(
|
|
database_url="sqlite:///:memory:",
|
|
redis_url="redis://localhost:6379/0",
|
|
openai_api_key="test-key",
|
|
azure_ai_key="test-key",
|
|
azure_region="test",
|
|
azure_endpoint="https://test.cognitiveservices.azure.com/",
|
|
gotenberg_url="http://localhost:3000",
|
|
workdir="/tmp",
|
|
auth_enabled=False,
|
|
)
|
|
assert isinstance(test_settings.cors_allowed_origins, list)
|
|
assert len(test_settings.cors_allowed_origins) == 1
|
|
assert test_settings.cors_allowed_origins[0] == "https://app.example.com"
|
|
finally:
|
|
if original is None:
|
|
os.environ.pop("CORS_ALLOWED_ORIGINS", None)
|
|
else:
|
|
os.environ["CORS_ALLOWED_ORIGINS"] = original
|