kawaandClaude Haiku 4.5
ed41f7f520
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
71 lines
2.6 KiB
Python
71 lines
2.6 KiB
Python
"""UIE-01: E2E test for printer edit modal — open, pre-fill, submit, list update."""
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
|
|
def test_printer_edit_modal_open_and_prefill(page, live_server: str, _e2e_owner_key: str) -> None:
|
|
"""Edit button opens modal with printer's current name pre-filled."""
|
|
import httpx
|
|
|
|
from imptune.services.session import COOKIE_NAME
|
|
|
|
# Create a printer via API, under the same owner the page's cookie is seeded with
|
|
with httpx.Client(
|
|
base_url=live_server, follow_redirects=True, cookies={COOKIE_NAME: _e2e_owner_key}
|
|
) as api:
|
|
api.post(
|
|
"/printers",
|
|
data={
|
|
"name": "EditTest Printer",
|
|
"ip_address": "10.0.5.1",
|
|
"port_name": "IP_10_0_5_1",
|
|
},
|
|
)
|
|
|
|
page.goto(f"{live_server}/printers", wait_until="domcontentloaded")
|
|
page.wait_for_selector("button:has-text('Edit')")
|
|
page.click("button:has-text('Edit')")
|
|
|
|
# Dialog should be open
|
|
page.wait_for_selector("dialog[open]")
|
|
# Name input should be pre-filled
|
|
name_val = page.input_value("dialog[open] input[name='name']")
|
|
assert name_val == "EditTest Printer"
|
|
|
|
|
|
def test_printer_edit_submit_updates_list(page, live_server: str, _e2e_owner_key: str) -> None:
|
|
"""Submitting the edit form updates the printer name in the list (no page reload)."""
|
|
import httpx
|
|
|
|
from imptune.services.session import COOKIE_NAME
|
|
|
|
with httpx.Client(
|
|
base_url=live_server, follow_redirects=True, cookies={COOKIE_NAME: _e2e_owner_key}
|
|
) as api:
|
|
resp = api.post(
|
|
"/printers",
|
|
data={
|
|
"name": "OriginalName",
|
|
"ip_address": "10.0.5.2",
|
|
"port_name": "IP_10_0_5_2",
|
|
},
|
|
)
|
|
|
|
# Find the printer ID from the DB via API — target the specific Edit button by printer ID
|
|
page.goto(f"{live_server}/printers", wait_until="domcontentloaded")
|
|
# Find the row containing "OriginalName" and click its Edit button
|
|
row = page.locator("tr", has=page.locator("a", has_text="OriginalName"))
|
|
row.wait_for()
|
|
row.locator("button:has-text('Edit')").click()
|
|
page.wait_for_selector("dialog[open]")
|
|
|
|
# Clear and update the name field
|
|
page.fill("dialog[open] input[name='name']", "UpdatedName")
|
|
page.click("dialog[open] button[type='submit']")
|
|
|
|
# Wait for HTMX to swap the updated list — the anchor for the printer should show new name
|
|
page.wait_for_selector("a:has-text('UpdatedName')")
|
|
assert page.locator("a:has-text('UpdatedName')").is_visible()
|
|
assert page.locator("a:has-text('OriginalName')").count() == 0
|