Spaces:
Running
Running
File size: 2,139 Bytes
e8aac63 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 | import pytest
from sqlalchemy import select
from app.admin_bootstrap import provision_admin
from app.models import User
from app.security import hash_password
async def test_bootstrap_requires_explicit_valid_seed(environment):
app, _, _ = environment
async with app.state.db() as db:
for action, seed in [("grant", None), ("bootstrap", None), ("bootstrap", "not-a-hash")]:
with pytest.raises(ValueError):
await provision_admin(db, "owner@example.com", action, seed)
assert await db.scalar(select(User)) is None
async def test_fresh_owner_can_sign_in_and_restarts_preserve_password(environment):
app, client, _ = environment
seed = await hash_password("bootstrap-owner-password-123")
async with app.state.db() as db:
owner = await provision_admin(db, "owner@example.com", "bootstrap", seed)
uid = owner.id
assert owner.is_admin
login = await client.post(
"/api/auth/login",
json={"email": "owner@example.com", "password": "bootstrap-owner-password-123"},
)
assert login.status_code == 200 and login.json()["user"]["is_admin"]
assert (await client.get("/api/admin/settings")).status_code == 200
async with app.state.db() as db:
owner = await provision_admin(
db, "owner@example.com", "bootstrap", await hash_password("a-different-password-123")
)
assert owner.id == uid and owner.password_hash == seed
await provision_admin(db, "owner@example.com", "revoke")
assert (await client.get("/api/admin/settings")).status_code == 403
async def test_bootstrap_does_not_unsuspend_accounts(environment):
app, _, _ = environment
async with app.state.db() as db:
owner = await provision_admin(
db,
"owner@example.com",
"bootstrap",
await hash_password("bootstrap-owner-password-123"),
)
owner.disabled = True
await db.commit()
with pytest.raises(ValueError, match="Restore"):
await provision_admin(db, "owner@example.com", "bootstrap")
assert owner.disabled
|