Spaces:
Running
Running
File size: 2,469 Bytes
c6aa952 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 | from __future__ import annotations
from pathlib import Path
from fastapi.testclient import TestClient
from app.core.config import Settings
from app.security.service import APIKeyService
from main import create_app
def test_sms_route_requires_authentication_and_execution_scope(
tmp_path: Path, monkeypatch
) -> None:
monkeypatch.delenv("HTTPSMS_API_KEY", raising=False)
admin = APIKeyService.generate_material("test")
settings = Settings(
_env_file=None,
temp_dir=tmp_path / "temp",
output_dir=tmp_path / "outputs",
database_url=f"sqlite+aiosqlite:///{tmp_path / 'security.db'}",
auth_enabled=True,
auth_bootstrap_key_hash=admin.key_hash,
auth_bootstrap_key_prefix=admin.key_prefix,
auth_bootstrap_environment="test",
auth_default_requests_per_minute=1000,
cleanup_interval_seconds=3600,
whisper_model="tiny",
max_workers=1,
)
with TestClient(create_app(settings)) as client:
payload = {
"from": "+2348012345678",
"to": "+2348098765432",
"content": "authorization regression test",
}
unauthenticated = client.post("/v1/sms/send", json=payload)
assert unauthenticated.status_code == 401
reader = client.post(
"/v1/api-keys",
headers={"Authorization": f"Bearer {admin.api_key}"},
json={
"name": "Template Reader",
"environment": "test",
"role": None,
"scopes": ["templates:read"],
},
)
assert reader.status_code == 201
forbidden = client.post(
"/v1/sms/send",
headers={"Authorization": f"Bearer {reader.json()['api_key']}"},
json=payload,
)
assert forbidden.status_code == 403
executor = client.post(
"/v1/api-keys",
headers={"Authorization": f"Bearer {admin.api_key}"},
json={
"name": "SMS Executor",
"environment": "test",
"role": None,
"scopes": ["operations:execute"],
},
)
assert executor.status_code == 201
not_configured = client.post(
"/v1/sms/send",
headers={"Authorization": f"Bearer {executor.json()['api_key']}"},
json=payload,
)
assert not_configured.status_code == 503
|