635372d7a2
Decap looks like a different product because it cannot be made to look like this one: its maintainer's answer is override the CSS and accept that class names move between releases, or fork it and carry that forever. Neither is worth building on, so editing moves into the app that already has the site's design and this project's tests. Posts are files in git, so the editor is a form that commits a file through Gitea's contents API. No working copy, no queue, no new state, and no way for the pipeline to tell which editor wrote the file — which is what makes running both at once safe. Decap keeps working; nothing here removes it, and the fallback if something is missing is switching tabs. Filenames and frontmatter are not this module's to invent. They are the contract scripts/translate.py reads: `<basename>.es.md` is what split_lang() parses, the date prefix is what keeps two posts with one title off a single URL, and the absence of `translated_from` is what marks a file as something a person wrote. Several tests import translate.py and run its own parser over what the editor produced, because a file it cannot parse publishes in Spanish and is never translated, with nothing reported anywhere. Commits carry the writer's own Gitea account rather than a bot's, so history says who wrote each post and Gitea's permissions apply unchanged. That needs their access token, which lives in the database and never in a cookie: Flask signs cookies but does not encrypt them, and a token is enough to commit as its owner. Gitea expires tokens after about an hour, so they refresh ahead of expiry and retry once on rejection — without that, saving would start failing partway through an afternoon for no reason the writer could see. Publishing is admin-only. Posting to the internal board and publishing to the public site are different permissions, and the second is the larger grant. Listing caches frontmatter against the git blob sha, because the contents API returns names without bodies: that turns one request per post on every page load into one request in total, and needs no invalidation, since a sha changes only when the file does. Verified: 97 checks. The filename translate.py parses, an authored source that is_generated() rejects, the freeze toggle round-tripping, a stale sha refused with the other edit intact, six filename shapes that must 404 including a generated sibling, plain members refused, an SVG rejected as an image, uploads not colliding, the cache reading each file once and refreshing when it changes, and a preview that renders markdown, escapes script tags and publishes nothing. Smoke-tested live: routes register and gate correctly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn
109 lines
3.9 KiB
Python
109 lines
3.9 KiB
Python
"""Who gets in, and who does not."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from apps.board import gitea
|
|
|
|
PROTECTED = [
|
|
"/comunidad/",
|
|
"/comunidad/nuevo",
|
|
"/comunidad/miembros",
|
|
"/comunidad/miembros/nuevo",
|
|
"/comunidad/mis-datos",
|
|
]
|
|
|
|
|
|
@pytest.mark.parametrize("path", PROTECTED)
|
|
def test_anonymous_is_sent_to_login(client, path):
|
|
response = client.get(path)
|
|
assert response.status_code == 302
|
|
assert "/comunidad/login" in response.headers["Location"]
|
|
|
|
|
|
def _stub_gitea(monkeypatch, login):
|
|
# exchange_code returns the whole token response now, because the editor
|
|
# needs the refresh token to keep working past Gitea's one-hour expiry.
|
|
monkeypatch.setattr(gitea, "exchange_code", lambda code, uri: {
|
|
"access_token": "token", "refresh_token": "refresh", "expires_in": 3600,
|
|
})
|
|
monkeypatch.setattr(gitea, "fetch_user", lambda token: {
|
|
"login": login, "full_name": login.title(), "email": f"{login}@example.com",
|
|
})
|
|
|
|
|
|
def _callback(client, monkeypatch, login):
|
|
_stub_gitea(monkeypatch, login)
|
|
with client.session_transaction() as session:
|
|
session["oauth_state"] = "state123"
|
|
return client.get("/comunidad/auth/callback?code=abc&state=state123")
|
|
|
|
|
|
def test_a_gitea_account_is_not_a_membership(client, monkeypatch):
|
|
"""The single most important rule in the app: Gitea says who you are, the
|
|
members table says whether you belong. The translations bot has a perfectly
|
|
valid Gitea account and must not get in."""
|
|
response = _callback(client, monkeypatch, "vienalatina-translations")
|
|
assert response.status_code == 302
|
|
with client.session_transaction() as session:
|
|
assert "member_id" not in session
|
|
|
|
|
|
def test_member_signs_in(client, monkeypatch, make_member):
|
|
make_member("maria")
|
|
response = _callback(client, monkeypatch, "maria")
|
|
assert response.status_code == 302
|
|
with client.session_transaction() as session:
|
|
assert "member_id" in session
|
|
|
|
|
|
def test_suspended_member_cannot_sign_in(client, monkeypatch, make_member):
|
|
make_member("expulsada", active=0)
|
|
_callback(client, monkeypatch, "expulsada")
|
|
with client.session_transaction() as session:
|
|
assert "member_id" not in session
|
|
|
|
|
|
def test_suspension_takes_effect_on_the_next_request(client, db, make_member, sign_in):
|
|
"""The role is read per request, not cached in the cookie, so revoking
|
|
access does not wait for a session to expire."""
|
|
member_id = make_member("temporal")
|
|
sign_in(member_id)
|
|
assert client.get("/comunidad/").status_code == 200
|
|
|
|
db.execute("UPDATE members SET active = 0 WHERE id = ?", (member_id,))
|
|
assert client.get("/comunidad/").status_code == 302
|
|
|
|
|
|
def test_callback_rejects_a_mismatched_state(client, monkeypatch, make_member):
|
|
make_member("maria")
|
|
_stub_gitea(monkeypatch, "maria")
|
|
with client.session_transaction() as session:
|
|
session["oauth_state"] = "the-real-state"
|
|
client.get("/comunidad/auth/callback?code=abc&state=attacker-state")
|
|
with client.session_transaction() as session:
|
|
assert "member_id" not in session
|
|
|
|
|
|
def test_post_without_csrf_is_refused(client, make_member, sign_in):
|
|
sign_in(make_member("maria"))
|
|
response = client.post("/comunidad/nuevo", data={"title": "Hola", "body": "Texto"})
|
|
assert response.status_code == 400
|
|
|
|
|
|
def test_login_redirect_cannot_be_pointed_offsite(client, monkeypatch, make_member):
|
|
make_member("maria")
|
|
_stub_gitea(monkeypatch, "maria")
|
|
with client.session_transaction() as session:
|
|
session["oauth_state"] = "state123"
|
|
response = client.get(
|
|
"/comunidad/auth/callback?code=abc&state=state123&next=https://evil.example.com/"
|
|
)
|
|
assert "evil.example.com" not in response.headers["Location"]
|
|
|
|
|
|
def test_responses_say_do_not_index(client):
|
|
response = client.get("/comunidad/login")
|
|
assert response.headers["X-Robots-Tag"] == "noindex, nofollow"
|