Spaces:
Sleeping
Sleeping
File size: 1,871 Bytes
67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df 0fd3d47 67af2df | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 | """Write-path key handling.
There is only one key now. It gates writes, it is public by design, and reads
are partitioned by session rather than gated -- see test_session_isolation.py for
the rules that actually keep one visitor's data away from another's.
"""
from __future__ import annotations
WRITE_BODY = {"dominant_emotion": "Happy", "duration_seconds": 10}
SESSION = {"X-Session-Id": "auth-test-session-01"}
class TestWritePath:
def test_requires_a_key(self, client):
response = client.post("/api/logs", json=WRITE_BODY, headers=SESSION)
assert response.status_code == 401
def test_rejects_a_wrong_key(self, client):
response = client.post(
"/api/logs", json=WRITE_BODY, headers={**SESSION, "X-API-Key": "nope"}
)
assert response.status_code == 401
def test_accepts_the_ingest_key(self, client, ingest_headers):
response = client.post("/api/logs", json=WRITE_BODY, headers=ingest_headers)
assert response.status_code == 201
def test_error_body_does_not_describe_the_expected_key(self, client):
body = client.post(
"/api/logs", json=WRITE_BODY, headers={**SESSION, "X-API-Key": "nope"}
).json()
assert "ingest" not in body["message"].lower()
class TestReadPath:
"""Reads carry a session id and no credential at all."""
def test_reads_need_no_key(self, client, session_headers):
assert client.get("/api/logs", headers=session_headers).status_code == 200
def test_stats_need_no_key(self, client, session_headers):
assert client.get("/api/logs/stats", headers=session_headers).status_code == 200
def test_delete_needs_no_key(self, client, session_headers, log_factory):
row = log_factory(count=1)[0]
assert client.delete(f"/api/logs/{row.id}", headers=session_headers).status_code == 200
|