Spaces:
Running
Running
| from __future__ import annotations | |
| from pathlib import Path | |
| from fastapi.testclient import TestClient | |
| from app.core.config import Settings | |
| from app.security.service import APIKeyService | |
| from main import create_app | |
| def test_sms_route_requires_authentication_and_execution_scope( | |
| tmp_path: Path, monkeypatch | |
| ) -> None: | |
| monkeypatch.delenv("HTTPSMS_API_KEY", raising=False) | |
| admin = APIKeyService.generate_material("test") | |
| settings = Settings( | |
| _env_file=None, | |
| temp_dir=tmp_path / "temp", | |
| output_dir=tmp_path / "outputs", | |
| database_url=f"sqlite+aiosqlite:///{tmp_path / 'security.db'}", | |
| auth_enabled=True, | |
| auth_bootstrap_key_hash=admin.key_hash, | |
| auth_bootstrap_key_prefix=admin.key_prefix, | |
| auth_bootstrap_environment="test", | |
| auth_default_requests_per_minute=1000, | |
| cleanup_interval_seconds=3600, | |
| whisper_model="tiny", | |
| max_workers=1, | |
| ) | |
| with TestClient(create_app(settings)) as client: | |
| payload = { | |
| "from": "+2348012345678", | |
| "to": "+2348098765432", | |
| "content": "authorization regression test", | |
| } | |
| unauthenticated = client.post("/v1/sms/send", json=payload) | |
| assert unauthenticated.status_code == 401 | |
| reader = client.post( | |
| "/v1/api-keys", | |
| headers={"Authorization": f"Bearer {admin.api_key}"}, | |
| json={ | |
| "name": "Template Reader", | |
| "environment": "test", | |
| "role": None, | |
| "scopes": ["templates:read"], | |
| }, | |
| ) | |
| assert reader.status_code == 201 | |
| forbidden = client.post( | |
| "/v1/sms/send", | |
| headers={"Authorization": f"Bearer {reader.json()['api_key']}"}, | |
| json=payload, | |
| ) | |
| assert forbidden.status_code == 403 | |
| executor = client.post( | |
| "/v1/api-keys", | |
| headers={"Authorization": f"Bearer {admin.api_key}"}, | |
| json={ | |
| "name": "SMS Executor", | |
| "environment": "test", | |
| "role": None, | |
| "scopes": ["operations:execute"], | |
| }, | |
| ) | |
| assert executor.status_code == 201 | |
| not_configured = client.post( | |
| "/v1/sms/send", | |
| headers={"Authorization": f"Bearer {executor.json()['api_key']}"}, | |
| json=payload, | |
| ) | |
| assert not_configured.status_code == 503 | |