kawaandClaude Haiku 4.5
ed41f7f520
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
123 lines
4.4 KiB
Python
123 lines
4.4 KiB
Python
"""Integration tests for the .ps1-suffixed script download routes."""
|
|
import io
|
|
import json
|
|
import zipfile
|
|
|
|
import pytest
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Fixtures (same pattern as tests/test_packages.py)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@pytest.fixture
|
|
def driver_zip_bytes():
|
|
"""Create a minimal valid driver ZIP with a fake INF and CAT file."""
|
|
buf = io.BytesIO()
|
|
with zipfile.ZipFile(buf, "w", compression=zipfile.ZIP_DEFLATED) as zf:
|
|
zf.writestr("printer.inf", "[Version]\nSignature=$WINDOWS NT$\n")
|
|
zf.writestr("printer.cat", "FAKE_CAT")
|
|
return buf.getvalue()
|
|
|
|
|
|
@pytest.fixture
|
|
def setup_printer_with_driver(tmp_data_dir, driver_zip_bytes, owner):
|
|
"""Create Driver record (with ZIP on disk) and Printer record linked to it."""
|
|
import hashlib
|
|
import os
|
|
|
|
import imptune.config as cfg
|
|
from imptune.db.models import Driver, Printer
|
|
|
|
sha = hashlib.sha256(driver_zip_bytes).hexdigest()
|
|
drivers_dir = cfg.DRIVERS_DIR
|
|
os.makedirs(drivers_dir, exist_ok=True)
|
|
zip_path = os.path.join(drivers_dir, f"{sha}.zip")
|
|
with open(zip_path, "wb") as f:
|
|
f.write(driver_zip_bytes)
|
|
|
|
driver = Driver.create(
|
|
sha256=sha,
|
|
original_filename="printer_driver.zip",
|
|
size_bytes=len(driver_zip_bytes),
|
|
driver_desc=json.dumps(["HP LaserJet Pro"]),
|
|
inf_filename="printer.inf",
|
|
)
|
|
printer = Printer.create(
|
|
name="Test Printer",
|
|
ip_address="192.168.1.100",
|
|
port_name="IP_192.168.1.100",
|
|
driver=driver,
|
|
owner=owner,
|
|
duplex_mode="OneSided",
|
|
color_mode=True,
|
|
paper_size="A4",
|
|
collate=True,
|
|
)
|
|
return printer, driver
|
|
|
|
|
|
@pytest.fixture
|
|
def printer_no_driver(tmp_data_dir, owner):
|
|
"""Create Printer record with no driver assigned."""
|
|
from imptune.db.models import Printer
|
|
|
|
return Printer.create(
|
|
name="No Driver Printer",
|
|
ip_address="10.0.0.1",
|
|
port_name="IP_10.0.0.1",
|
|
driver=None,
|
|
owner=owner,
|
|
)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# .ps1 route tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestPs1Routes:
|
|
def test_install_ps1_route(self, client, setup_printer_with_driver):
|
|
"""GET /printers/{id}/scripts/install.ps1 returns 200 with attachment and PowerShell content."""
|
|
printer, _ = setup_printer_with_driver
|
|
resp = client.get(f"/printers/{printer.id}/scripts/install.ps1")
|
|
assert resp.status_code == 200
|
|
assert 'attachment' in resp.headers["content-disposition"]
|
|
assert 'filename="install.ps1"' in resp.headers["content-disposition"]
|
|
body = resp.text
|
|
assert len(body) > 0
|
|
assert "Add-Printer" in body or "$PSScriptRoot" in body
|
|
|
|
def test_uninstall_ps1_route(self, client, setup_printer_with_driver):
|
|
"""GET /printers/{id}/scripts/uninstall.ps1 returns 200 with attachment and uninstall content."""
|
|
printer, _ = setup_printer_with_driver
|
|
resp = client.get(f"/printers/{printer.id}/scripts/uninstall.ps1")
|
|
assert resp.status_code == 200
|
|
assert 'attachment' in resp.headers["content-disposition"]
|
|
assert 'filename="uninstall.ps1"' in resp.headers["content-disposition"]
|
|
body = resp.text
|
|
assert len(body) > 0
|
|
assert "Remove-Printer" in body
|
|
|
|
def test_detect_ps1_route(self, client, setup_printer_with_driver):
|
|
"""GET /printers/{id}/scripts/detect.ps1 returns 200 with attachment and detect content."""
|
|
printer, _ = setup_printer_with_driver
|
|
resp = client.get(f"/printers/{printer.id}/scripts/detect.ps1")
|
|
assert resp.status_code == 200
|
|
assert 'attachment' in resp.headers["content-disposition"]
|
|
assert 'filename="detect.ps1"' in resp.headers["content-disposition"]
|
|
body = resp.text
|
|
assert len(body) > 0
|
|
assert "Get-Printer" in body
|
|
|
|
def test_ps1_routes_missing_printer(self, client, tmp_data_dir):
|
|
"""GET for non-existent printer returns 404."""
|
|
resp = client.get("/printers/99999/scripts/install.ps1")
|
|
assert resp.status_code == 404
|
|
|
|
def test_ps1_routes_no_driver(self, client, printer_no_driver):
|
|
"""GET for printer without driver returns 422."""
|
|
resp = client.get(f"/printers/{printer_no_driver.id}/scripts/install.ps1")
|
|
assert resp.status_code == 422
|