kawa/ImpTune
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
Files
main
ImpTune/tests/test_printer_crud.py
T
kawaandClaude Opus 5 b397d3dc3d feat: memory-only sessions on HTTP, streamed exports, UI refresh 
Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 17:58:49 +02:00

483 lines
15 KiB
Python
Raw Permalink Blame History

"""Integration tests for printer and client CRUD endpoints."""
import json
import pytest
from fastapi.testclient import TestClient
# ---------------------------------------------------------------------------
# Task 1: RED state — routes do not exist yet, tests should fail
# ---------------------------------------------------------------------------
def test_create_printer_persisted(client: TestClient) -> None:
"""POST /printers with required fields returns 303; GET /printers contains printer name."""
from imptune.db.models import Printer
resp = client.post(
"/printers",
data={
"name": "Test Printer",
"ip_address": "192.168.1.100",
"port_name": "IP_192_168_1_100",
},
follow_redirects=False,
)
assert resp.status_code == 303
# GET /printers page contains the printer name
page = client.get("/printers")
assert page.status_code == 200
assert "Test Printer" in page.text
# Verify DB persistence
count = Printer.select().where(Printer.name == "Test Printer").count()
assert count == 1
def test_create_printer_duplex(client: TestClient) -> None:
"""POST /printers with duplex_mode=LongEdge persists correctly."""
from imptune.db.models import Printer
resp = client.post(
"/printers",
data={
"name": "Duplex Printer",
"ip_address": "192.168.1.101",
"port_name": "IP_192_168_1_101",
"duplex_mode": "LongEdge",
},
follow_redirects=False,
)
assert resp.status_code == 303
printers = list(Printer.select().where(Printer.name == "Duplex Printer"))
assert len(printers) == 1
assert printers[0].duplex_mode == "LongEdge"
def test_create_printer_color_mode(client: TestClient) -> None:
"""POST /printers with color_mode not sent (unchecked) sets color_mode=False."""
from imptune.db.models import Printer
resp = client.post(
"/printers",
data={
"name": "Mono Printer",
"ip_address": "192.168.1.102",
"port_name": "IP_192_168_1_102",
# color_mode intentionally omitted (unchecked checkbox)
},
follow_redirects=False,
)
assert resp.status_code == 303
printers = list(Printer.select().where(Printer.name == "Mono Printer"))
assert len(printers) == 1
assert printers[0].color_mode is False
def test_create_printer_paper_size(client: TestClient) -> None:
"""POST /printers with paper_size=Letter persists correctly."""
from imptune.db.models import Printer
resp = client.post(
"/printers",
data={
"name": "Letter Printer",
"ip_address": "192.168.1.103",
"port_name": "IP_192_168_1_103",
"paper_size": "Letter",
},
follow_redirects=False,
)
assert resp.status_code == 303
printers = list(Printer.select().where(Printer.name == "Letter Printer"))
assert len(printers) == 1
assert printers[0].paper_size == "Letter"
def test_create_printer_collate(client: TestClient) -> None:
"""POST /printers with collate not sent (unchecked) sets collate=False."""
from imptune.db.models import Printer
resp = client.post(
"/printers",
data={
"name": "No Collate Printer",
"ip_address": "192.168.1.104",
"port_name": "IP_192_168_1_104",
# collate intentionally omitted (unchecked checkbox)
},
follow_redirects=False,
)
assert resp.status_code == 303
printers = list(Printer.select().where(Printer.name == "No Collate Printer"))
assert len(printers) == 1
assert printers[0].collate is False
def test_create_client(client: TestClient) -> None:
"""POST /clients with name=Contoso returns 200; GET /clients contains Contoso."""
resp = client.post("/clients", data={"name": "Contoso"})
assert resp.status_code == 200
page = client.get("/clients")
assert page.status_code == 200
assert "Contoso" in page.text
def test_printer_grouped_by_client(client: TestClient) -> None:
"""Printer assigned to a client appears under that client group heading."""
from imptune.db.models import Client, Printer
# Create client
resp = client.post("/clients", data={"name": "Contoso"})
assert resp.status_code == 200
contoso_list = list(Client.select().where(Client.name == "Contoso"))
assert len(contoso_list) == 1
contoso = contoso_list[0]
# Create printer assigned to that client
resp = client.post(
"/printers",
data={
"name": "Contoso Printer",
"ip_address": "10.0.0.1",
"port_name": "IP_10_0_0_1",
"client_id": str(contoso.id),
},
follow_redirects=False,
)
assert resp.status_code == 303
# GET /printers should show "Contoso" as a group header
page = client.get("/printers")
assert page.status_code == 200
html = page.text
assert "Contoso" in html
# Client name should appear in a heading element
assert "<h3" in html
def test_create_printer_missing_name(client: TestClient) -> None:
"""POST /printers with empty name returns 400."""
resp = client.post(
"/printers",
data={
"name": "",
"ip_address": "192.168.1.100",
"port_name": "IP_192_168_1_100",
},
)
assert resp.status_code == 400
def test_create_printer_invalid_ip(client: TestClient) -> None:
"""POST /printers with empty ip_address returns 400."""
resp = client.post(
"/printers",
data={
"name": "Valid Name",
"ip_address": "",
"port_name": "SOME_PORT",
},
)
assert resp.status_code == 400
def test_printer_detail_shows_driver(client: TestClient, owner) -> None:
"""GET /printers/{id} returns 200 with all printer fields and driver name."""
from imptune.db.models import Driver, Printer
driver_obj = Driver.create(
sha256="abc123",
original_filename="hp_universal.zip",
size_bytes=1000,
driver_desc=json.dumps(["HP Universal"]),
)
printer = Printer.create(
name="HP Office Printer",
ip_address="10.0.1.1",
port_name="IP_10_0_1_1",
driver=driver_obj,
owner=owner,
)
resp = client.get(f"/printers/{printer.id}")
assert resp.status_code == 200
html = resp.text
assert "HP Office Printer" in html
assert "10.0.1.1" in html
assert "HP Universal" in html
def test_printer_detail_not_found(client: TestClient) -> None:
"""GET /printers/9999 returns 404."""
resp = client.get("/printers/9999")
assert resp.status_code == 404
def test_printer_detail_no_driver(client: TestClient, owner) -> None:
"""GET /printers/{id} for printer with no driver returns 200 with 'No driver assigned'."""
from imptune.db.models import Printer
printer = Printer.create(
name="Driverless Printer",
ip_address="10.0.1.2",
port_name="IP_10_0_1_2",
driver=None,
owner=owner,
)
resp = client.get(f"/printers/{printer.id}")
assert resp.status_code == 200
html = resp.text
assert "No driver assigned" in html
def test_delete_printer(client: TestClient) -> None:
"""DELETE /printers/{id} removes the printer; GET /printers no longer shows it."""
from imptune.db.models import Printer
# Create a printer
resp = client.post(
"/printers",
data={
"name": "To Delete",
"ip_address": "192.168.1.200",
"port_name": "IP_192_168_1_200",
},
follow_redirects=False,
)
assert resp.status_code == 303
# Find its ID
printers = list(Printer.select().where(Printer.name == "To Delete"))
assert len(printers) == 1
printer_id = printers[0].id
# Delete it
resp = client.delete(f"/printers/{printer_id}")
assert resp.status_code == 200
# Confirm it's gone from the DB
count = Printer.select().where(Printer.id == printer_id).count()
assert count == 0
# GET /printers should no longer show it
page = client.get("/printers")
assert "To Delete" not in page.text
# ---------------------------------------------------------------------------
# Wave 0 scaffolds — UIE-01 (PATCH), UIE-02 (separated form/list), UIE-03 (client detail)
# These tests are RED until plan 01 task 2 and plans 02-03 implement the routes.
# ---------------------------------------------------------------------------
def test_printers_new_returns_200(client: TestClient) -> None:
"""GET /printers/new returns 200 with the add printer form markup."""
resp = client.get("/printers/new")
assert resp.status_code == 200
html = resp.text
# Must contain form fields
assert 'name="name"' in html or "Printer Name" in html
def test_create_printer_redirects(client: TestClient) -> None:
"""POST /printers (no HX-Request header) returns 303 redirect to /printers."""
resp = client.post(
"/printers",
data={
"name": "Redirect Printer",
"ip_address": "192.168.2.1",
"port_name": "IP_192_168_2_1",
},
follow_redirects=False,
)
assert resp.status_code == 303
assert resp.headers["location"] == "/printers"
def test_printers_library_no_form(client: TestClient) -> None:
"""GET /printers does NOT contain the inline add-printer form markup."""
resp = client.get("/printers")
assert resp.status_code == 200
html = resp.text
# The inline form must be gone — check for the actual form element, not UI label strings
assert 'hx-post="/printers"' not in html
assert 'action="/printers" method="post"' not in html
def test_patch_printer(client: TestClient, owner) -> None:
"""PATCH /printers/{id} with updated name returns 200, updated name in response, DB updated."""
from imptune.db.models import Printer
printer = Printer.create(
name="Original Name",
ip_address="10.0.2.1",
port_name="IP_10_0_2_1",
owner=owner,
)
resp = client.patch(
f"/printers/{printer.id}",
data={"name": "Updated Name"},
)
assert resp.status_code == 200
assert "Updated Name" in resp.text
# Verify DB update
updated = Printer.get_by_id(printer.id)
assert updated.name == "Updated Name"
def test_patch_printer_not_found(client: TestClient) -> None:
"""PATCH /printers/9999 returns 404."""
resp = client.patch("/printers/9999", data={"name": "Ghost"})
assert resp.status_code == 404
def test_client_detail_returns_200(client: TestClient, owner) -> None:
"""GET /clients/{id} returns 200 with client name and assigned printer name."""
from imptune.db.models import Client, Printer
# Create client
cl = Client.create(name="Detail Client", owner=owner)
# Create printer assigned to that client
Printer.create(
name="Client Printer",
ip_address="10.0.3.1",
port_name="IP_10_0_3_1",
client=cl,
owner=owner,
)
resp = client.get(f"/clients/{cl.id}")
assert resp.status_code == 200
html = resp.text
assert "Detail Client" in html
assert "Client Printer" in html
def test_client_detail_not_found(client: TestClient) -> None:
"""GET /clients/9999 returns 404."""
resp = client.get("/clients/9999")
assert resp.status_code == 404
def test_client_links_in_printer_list(client: TestClient, owner) -> None:
"""GET /printers with a printer assigned to a client contains href to client detail."""
from imptune.db.models import Client, Printer
# Create client via POST /clients
resp = client.post("/clients", data={"name": "Link Client"})
assert resp.status_code == 200
cl = Client.get(Client.name == "Link Client")
# Create printer assigned to that client
Printer.create(
name="Linked Printer",
ip_address="10.0.4.1",
port_name="IP_10_0_4_1",
client=cl,
owner=owner,
)
resp = client.get("/printers")
assert resp.status_code == 200
assert f'href="/clients/{cl.id}"' in resp.text
# ---------------------------------------------------------------------------
# Malformed FK form fields — these used to escape as HTTP 500
# ---------------------------------------------------------------------------
def test_create_rejects_non_numeric_client_id(client: TestClient, owner) -> None:
"""A non-numeric client_id is a 400 fragment, not a ValueError traceback."""
resp = client.post(
"/printers",
data={
"name": "Bad FK",
"ip_address": "10.0.5.1",
"port_name": "IP_10_0_5_1",
"client_id": "abc",
},
follow_redirects=False,
)
assert resp.status_code == 400
assert "Invalid client id" in resp.text
def test_create_rejects_non_numeric_driver_id(client: TestClient, owner) -> None:
resp = client.post(
"/printers",
data={
"name": "Bad FK",
"ip_address": "10.0.5.2",
"port_name": "IP_10_0_5_2",
"driver_id": "not-an-id",
},
follow_redirects=False,
)
assert resp.status_code == 400
assert "Invalid driver id" in resp.text
def test_create_rejects_unknown_driver_id(client: TestClient, owner) -> None:
"""An unknown driver id is a 404 fragment, not a FOREIGN KEY IntegrityError."""
resp = client.post(
"/printers",
data={
"name": "Ghost Driver",
"ip_address": "10.0.5.3",
"port_name": "IP_10_0_5_3",
"driver_id": "9999",
},
follow_redirects=False,
)
assert resp.status_code == 404
assert "Driver 9999 not found" in resp.text
def test_update_rejects_unknown_driver_id(client: TestClient, owner) -> None:
from imptune.db.models import Printer
printer = Printer.create(
name="Patch Me",
ip_address="10.0.5.4",
port_name="IP_10_0_5_4",
owner=owner,
)
resp = client.patch(
f"/printers/{printer.id}",
data={"name": "Patch Me", "driver_id": "9999"},
)
assert resp.status_code == 404
assert "Driver 9999 not found" in resp.text
# The printer must be untouched
assert Printer.get_by_id(printer.id).driver is None
def test_update_rejects_non_numeric_driver_id(client: TestClient, owner) -> None:
from imptune.db.models import Printer
printer = Printer.create(
name="Patch Me Too",
ip_address="10.0.5.5",
port_name="IP_10_0_5_5",
owner=owner,
)
resp = client.patch(
f"/printers/{printer.id}",
data={"name": "Patch Me Too", "driver_id": "??"},
)
assert resp.status_code == 400
assert "Invalid driver id" in resp.text
Reference in New Issue View Git Blame Copy Permalink