kawaandClaude Haiku 4.5
ed41f7f520
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
118 lines
3.7 KiB
Python
118 lines
3.7 KiB
Python
import re
|
|
from pathlib import Path
|
|
|
|
|
|
CDN_PATTERNS = re.compile(
|
|
r"(cdn\.jsdelivr\.net|unpkg\.com|cdnjs\.com)",
|
|
re.IGNORECASE,
|
|
)
|
|
|
|
# Matches href="https://..." or src="https://..."
|
|
EXTERNAL_URL_PATTERN = re.compile(
|
|
r'(?:href|src)=["\']https?://',
|
|
re.IGNORECASE,
|
|
)
|
|
|
|
|
|
def test_no_cdn_urls_in_templates():
|
|
"""All .html templates use /static/ paths only — no CDN URLs in href/src attributes."""
|
|
templates_dir = Path(__file__).parent.parent / "imptune" / "templates"
|
|
html_files = list(templates_dir.glob("**/*.html"))
|
|
assert html_files, "No HTML templates found — check templates directory path"
|
|
|
|
violations = []
|
|
for html_file in html_files:
|
|
content = html_file.read_text(encoding="utf-8")
|
|
if CDN_PATTERNS.search(content):
|
|
violations.append(f"{html_file.name}: contains CDN domain reference")
|
|
if EXTERNAL_URL_PATTERN.search(content):
|
|
violations.append(f"{html_file.name}: contains external https:// in href/src")
|
|
|
|
assert not violations, "CDN/external URL violations found:\n" + "\n".join(violations)
|
|
|
|
|
|
def test_dashboard_returns_200(client):
|
|
"""GET / returns 200 (dashboard page)."""
|
|
response = client.get("/")
|
|
assert response.status_code == 200
|
|
|
|
|
|
def test_packages_returns_200(client):
|
|
"""GET /packages returns 200 (packages listing page)."""
|
|
response = client.get("/packages")
|
|
assert response.status_code == 200
|
|
|
|
|
|
|
|
def test_theme_toggle_present(client):
|
|
"""GET / contains a theme toggle button (data-theme cycling control)."""
|
|
response = client.get("/")
|
|
assert response.status_code == 200
|
|
# The button's @click should reference $store.theme.cycle
|
|
assert "theme" in response.text
|
|
assert "cycle" in response.text or "store.theme" in response.text
|
|
|
|
|
|
def test_dashboard_shows_recent_printers(client, owner):
|
|
"""Dashboard renders names of recently-created printers from DB."""
|
|
from imptune.db.models import Printer
|
|
|
|
Printer.create(
|
|
name="TestPrinter-Alpha",
|
|
ip_address="10.0.0.1",
|
|
port_name="IP_10.0.0.1",
|
|
owner=owner,
|
|
)
|
|
Printer.create(
|
|
name="TestPrinter-Beta",
|
|
ip_address="10.0.0.2",
|
|
port_name="IP_10.0.0.2",
|
|
owner=owner,
|
|
)
|
|
|
|
response = client.get("/")
|
|
assert response.status_code == 200
|
|
assert "TestPrinter-Alpha" in response.text
|
|
assert "TestPrinter-Beta" in response.text
|
|
# Use class-specific check: the string also appears in the i18n store JS
|
|
assert 'class="empty-state">No printers configured yet' not in response.text
|
|
|
|
|
|
def test_theme_toggle_present(client):
|
|
"""GET / contains a theme toggle button (data-theme cycling control)."""
|
|
response = client.get("/")
|
|
assert response.status_code == 200
|
|
# The button's @click should reference $store.theme.cycle
|
|
assert "theme" in response.text
|
|
assert "cycle" in response.text or "store.theme" in response.text
|
|
|
|
|
|
def test_dashboard_shows_recent_packages(client, owner):
|
|
"""Dashboard recent-packages section shows only printers with a driver assigned."""
|
|
from imptune.db.models import Driver, Printer
|
|
|
|
driver = Driver.create(
|
|
sha256="abc123",
|
|
original_filename="test.zip",
|
|
size_bytes=1000,
|
|
driver_desc='["TestDriver"]',
|
|
)
|
|
Printer.create(
|
|
name="PkgPrinter-Assigned",
|
|
ip_address="10.0.0.2",
|
|
port_name="IP_10.0.0.2",
|
|
driver=driver,
|
|
owner=owner,
|
|
)
|
|
Printer.create(
|
|
name="PkgPrinter-NoDriver",
|
|
ip_address="10.0.0.3",
|
|
port_name="IP_10.0.0.3",
|
|
owner=owner,
|
|
)
|
|
|
|
response = client.get("/")
|
|
assert response.status_code == 200
|
|
assert "PkgPrinter-Assigned" in response.text
|
|
assert 'class="empty-state">No packages exported yet' not in response.text
|