504b490d3b
Canalul web trece de la 100% deschis (hardcodat cont 1) la autentificat si multi-tenant. Un service nou se inregistreaza din browser, primeste o cheie API (o singura data) si o sesiune; contul se creeaza "in asteptare" (active=0) si nu trimite la RAR pana la activarea de catre admin (tools/account.py activate). - users + app/users.py: parole scrypt (salt per-user, eticheta parametri onorata la verify pentru migrare cost), email unic case-insensitive - sesiune: SessionMiddleware (same_site=strict, https_only config) + app/web/session.py (current_account/web_account/require_login->LoginRequired, set_session clear-inainte) - CSRF (app/web/csrf.py) enforce in prod inclusiv pe login/signup + rate-limit in-proces (app/web/ratelimit.py) pe signup si login - signup/login/logout (app/web/auth_routes.py): signup tranzactie atomica, cheie-o-data, log SIGNUP pentru descoperire admin - dashboard + import scoped pe contul sesiunii (regula NULL->cont 1); toate rutele web care ating date sensibile sub require_login; nomenclator ramane global - banner "cont in asteptare" pentru conturi active=0 - gate worker: claim_one LEFT JOIN accounts COALESCE(active,1)=1 (account_id NULL=activ) VERIFY context curat (2 runde): leak cross-account /_fragments/mapari prins+reparat. /code-review high: csrf_token lipsa pe re-randari de eroare, scrypt_params ignorat, login fara rate-limit -- toate reparate. 361 teste pass (de la 313). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
81 lines
3.0 KiB
Python
81 lines
3.0 KiB
Python
"""Teste task #8: csrf_token prezent in TOATE raspunsurile de formular (inclusiv ramuri eroare).
|
|
|
|
Lockout real in prod (web_auth_required=True, sesiune logata):
|
|
eroare la confirma/upload re-randeaza template FARA csrf_token in context →
|
|
campul {{ csrf_token }} devine gol → urmatorul submit trimite token gol → CsrfError 403.
|
|
|
|
TDD: RED pe codul actual (token gol in eroare), GREEN dupa fix.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import re
|
|
import tempfile
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
|
|
def _extract_csrf(html: str) -> str:
|
|
m = re.search(r'name="csrf_token" value="([^"]*)"', html)
|
|
return m.group(1) if m else ""
|
|
|
|
|
|
@pytest.fixture()
|
|
def prod_client(monkeypatch):
|
|
"""Client cu web_auth_required=True + require_login monkeypatched."""
|
|
tmp = tempfile.mkdtemp()
|
|
monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "csrf_err.db"))
|
|
monkeypatch.setenv("AUTOPASS_WEB_AUTH_REQUIRED", "true")
|
|
from app.config import get_settings
|
|
get_settings.cache_clear()
|
|
from app.main import app
|
|
with TestClient(app, follow_redirects=False) as c:
|
|
from app.db import get_connection
|
|
from app.accounts import create_account
|
|
conn = get_connection()
|
|
acct = create_account(conn, "Cont Test CSRF Erori")
|
|
monkeypatch.setattr("app.web.routes.require_login", lambda r: acct)
|
|
yield c, conn, acct
|
|
conn.close()
|
|
get_settings.cache_clear()
|
|
|
|
|
|
def test_confirma_batch_inexistent_contine_csrf(prod_client):
|
|
"""POST confirma cu batch inexistent re-randeaza _upload.html cu csrf_token negol.
|
|
|
|
Flux:
|
|
1. GET / -> initializeaza csrf_token in sesiune, extragem token
|
|
2. POST /_import/99999/confirma cu token valid -> batch nu exista -> _upload.html
|
|
3. Verificam ca _upload.html din eroare contine csrf_token negol
|
|
4. POST cu tokenul din eroare -> NU 403
|
|
"""
|
|
client, conn, acct = prod_client
|
|
|
|
# 1. GET dashboard: initializeaza CSRF token in sesiune
|
|
r_get = client.get("/")
|
|
assert r_get.status_code == 200
|
|
csrf = _extract_csrf(r_get.text)
|
|
assert csrf, "Dashboard nu a returnat csrf_token — problema de setup"
|
|
|
|
# 2. POST confirma cu batch inexistent (ID 99999 cu siguranta nu exista)
|
|
r_err = client.post(
|
|
"/_import/99999/confirma",
|
|
data={"n_confirmat": "1", "csrf_token": csrf},
|
|
)
|
|
assert r_err.status_code == 200
|
|
assert "inexistent" in r_err.text.lower() or "expirat" in r_err.text.lower()
|
|
|
|
# 3. csrf_token in raspunsul de eroare (_upload.html) trebuie sa fie NEGOL
|
|
csrf_in_error = _extract_csrf(r_err.text)
|
|
assert csrf_in_error, "csrf_token gol in _upload.html de eroare — lockout garantat in prod!"
|
|
|
|
# 4. Urmatorul POST cu token din eroare -> NU 403
|
|
r_retry = client.post(
|
|
"/_import/99999/confirma",
|
|
data={"n_confirmat": "1", "csrf_token": csrf_in_error},
|
|
)
|
|
assert r_retry.status_code != 403, f"CsrfError 403 dupa eroare — lockout confirmat! Status: {r_retry.status_code}"
|
|
assert r_retry.status_code == 200
|