49aba8efb4
- C1: drop module-level app singleton in app/main.py so importing the package no longer validates Settings or creates DATA_DIR; run uvicorn with --factory in the Dockerfile. pytest now collects and passes with no ambient env vars. - I2: add missing app/auth, app/security, app/web __init__.py so setuptools discovers all five packages. - I3: resolve the Jinja2 template directory relative to __file__ instead of the process CWD. - I4: add .gitignore covering .env, data/, .venv/, caches and build artifacts so example deployment secrets cannot be committed. - I5: assert UserRepository.list_enabled() excludes disabled users. - M6: encode both operands before hmac.compare_digest in validate_csrf so a non-ASCII token yields 403 instead of an unhandled 500. - M9: remove unused relationship / HealthState imports. - M11: make session cookie https_only configurable via SESSION_HTTPS_ONLY (default unchanged: false). - M13: dispose SQLAlchemy engines in the db_session and client fixtures. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
57 lines
1.5 KiB
Python
57 lines
1.5 KiB
Python
from pathlib import Path
|
|
|
|
import pytest
|
|
from cryptography.fernet import Fernet
|
|
from fastapi.testclient import TestClient
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import Session, sessionmaker
|
|
from sqlalchemy.pool import StaticPool
|
|
|
|
from app.config import Settings
|
|
from app.db.models import Base
|
|
from app.db.repositories import ActivityRepository, UserRepository
|
|
from app.main import create_app
|
|
|
|
|
|
@pytest.fixture
|
|
def db_session() -> Session:
|
|
engine = create_engine(
|
|
"sqlite://",
|
|
connect_args={"check_same_thread": False},
|
|
poolclass=StaticPool,
|
|
)
|
|
Base.metadata.create_all(engine)
|
|
factory = sessionmaker(bind=engine, expire_on_commit=False)
|
|
try:
|
|
with factory() as session:
|
|
yield session
|
|
finally:
|
|
engine.dispose()
|
|
|
|
|
|
@pytest.fixture
|
|
def user_repository(db_session: Session) -> UserRepository:
|
|
return UserRepository(db_session)
|
|
|
|
|
|
@pytest.fixture
|
|
def activity_repository(db_session: Session) -> ActivityRepository:
|
|
return ActivityRepository(db_session)
|
|
|
|
|
|
@pytest.fixture
|
|
def client(tmp_path: Path) -> TestClient:
|
|
settings = Settings(
|
|
ADMIN_PASSWORD="admin-secret",
|
|
SECRET_KEY="0123456789abcdef0123456789abcdef",
|
|
CREDENTIAL_ENCRYPTION_KEY=Fernet.generate_key().decode("ascii"),
|
|
DATA_DIR=str(tmp_path),
|
|
DATABASE_URL=f"sqlite:///{tmp_path / 'app.db'}",
|
|
SYNC_INTERVAL_MINUTES=5,
|
|
)
|
|
app = create_app(settings)
|
|
try:
|
|
yield TestClient(app)
|
|
finally:
|
|
app.state.db_engine.dispose()
|