Kyle DammannandClaude Opus 5.5
ef9deaeff7
- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes, healthcheck on /healthz, test profile running pytest against Postgres) - Custom e-mail user model with user/admin roles - Invitation-only registration with single-use, hashed, expiring links - Admin area: invitations, role changes, deactivation, password reset via one-time link or temporary password (forced change on login) - First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup - Login rate limiting per e-mail and IP (DB-backed, worker-safe) - Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES, optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP) - Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies - Mobile-first German UI, CLAUDE.md, README, init-env script - 65 tests for auth, permissions, proxy handling and rate limiting Co-Authored-By: Claude Opus 5.5 <[email protected]>
71 lines
2.8 KiB
Python
71 lines
2.8 KiB
Python
import pytest
|
|
from django.test import Client
|
|
from django.urls import reverse
|
|
|
|
from accounts.models import Invitation, User
|
|
|
|
from .conftest import PASSWORD
|
|
|
|
pytestmark = pytest.mark.django_db
|
|
|
|
|
|
@pytest.mark.parametrize("name", ["accounts:admin_users", "accounts:admin_invitations"])
|
|
def test_admin_pages_forbidden_for_users(user_client, name):
|
|
assert user_client.get(reverse(name)).status_code == 403
|
|
|
|
|
|
@pytest.mark.parametrize("name", ["accounts:admin_users", "accounts:admin_invitations"])
|
|
def test_admin_pages_ok_for_admin(admin_client, name):
|
|
assert admin_client.get(reverse(name)).status_code == 200
|
|
|
|
|
|
@pytest.mark.parametrize("action", ["make_admin", "deactivate", "reset_link", "temp_password"])
|
|
def test_user_actions_forbidden_for_users(user_client, other_user, action):
|
|
response = user_client.post(reverse("accounts:admin_user_action", args=[other_user.pk, action]))
|
|
assert response.status_code == 403
|
|
other_user.refresh_from_db()
|
|
assert other_user.role == User.Role.USER and other_user.is_active and other_user.check_password(PASSWORD)
|
|
|
|
|
|
def test_user_cannot_create_invitation(user_client):
|
|
user_client.post(reverse("accounts:admin_invitations"), {"role": "admin", "valid_days": 7})
|
|
assert not Invitation.objects.exists()
|
|
|
|
|
|
def test_admin_creates_invitation(admin_client):
|
|
response = admin_client.post(reverse("accounts:admin_invitations"), {"role": "user", "valid_days": 3, "note": "Oma"})
|
|
assert response.status_code == 200
|
|
assert "/einladung/" in response.context["value"]
|
|
assert Invitation.objects.get().note == "Oma"
|
|
|
|
|
|
def test_admin_can_promote_and_deactivate(admin_client, user):
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "make_admin"]))
|
|
user.refresh_from_db()
|
|
assert user.role == User.Role.ADMIN
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "deactivate"]))
|
|
user.refresh_from_db()
|
|
assert not user.is_active
|
|
|
|
|
|
def test_deactivated_user_session_ends(admin_client, user):
|
|
session = Client()
|
|
session.force_login(user)
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "deactivate"]))
|
|
assert session.get(reverse("core:home")).status_code == 302
|
|
|
|
|
|
def test_admin_cannot_demote_or_deactivate_self(admin_client, admin_user):
|
|
for action in ["make_user", "deactivate"]:
|
|
admin_client.post(reverse("accounts:admin_user_action", args=[admin_user.pk, action]))
|
|
admin_user.refresh_from_db()
|
|
assert admin_user.is_admin
|
|
|
|
|
|
def test_unknown_action_rejected(admin_client, user):
|
|
assert admin_client.post(reverse("accounts:admin_user_action", args=[user.pk, "delete"])).status_code == 403
|
|
|
|
|
|
def test_admin_actions_require_post(admin_client, user):
|
|
assert admin_client.get(reverse("accounts:admin_user_action", args=[user.pk, "make_admin"])).status_code == 405
|