Spaces:
Running
Running
| import pytest | |
| from fastapi.testclient import TestClient | |
| from app import app | |
| def client(): | |
| return TestClient(app) | |
| def test_cors_allows_configured_localhost(client): | |
| """Origin in CORS_ALLOW_ORIGINS receives Access-Control-Allow-Origin.""" | |
| response = client.options( | |
| "/health", | |
| headers={ | |
| "Origin": "http://localhost:5173", | |
| "Access-Control-Request-Method": "GET", | |
| }, | |
| ) | |
| assert response.status_code == 200 | |
| assert response.headers.get("access-control-allow-origin") == "http://localhost:5173" | |
| def test_cors_rejects_untrusted_origin(client): | |
| """Untrusted origin does not receive Access-Control-Allow-Origin.""" | |
| response = client.options( | |
| "/health", | |
| headers={ | |
| "Origin": "http://malicious-site.com", | |
| "Access-Control-Request-Method": "GET", | |
| }, | |
| ) | |
| assert response.headers.get("access-control-allow-origin") is None | |
| def test_cors_allows_vercel_and_hf_origins(client): | |
| """Vercel and Hugging Face domains match regex and receive Access-Control-Allow-Origin.""" | |
| response_vercel = client.options( | |
| "/health", | |
| headers={ | |
| "Origin": "https://vectorless-front-8gpg.vercel.app", | |
| "Access-Control-Request-Method": "GET", | |
| }, | |
| ) | |
| assert response_vercel.status_code == 200 | |
| assert response_vercel.headers.get("access-control-allow-origin") == "https://vectorless-front-8gpg.vercel.app" | |
| response_hf = client.options( | |
| "/health", | |
| headers={ | |
| "Origin": "https://amir-rag-space.hf.space", | |
| "Access-Control-Request-Method": "GET", | |
| }, | |
| ) | |
| assert response_hf.status_code == 200 | |
| assert response_hf.headers.get("access-control-allow-origin") == "https://amir-rag-space.hf.space" | |