kawaandClaude Opus 5
b397d3dc3d
Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
79 lines
3.0 KiB
Python
79 lines
3.0 KiB
Python
"""UIE-01: E2E test for printer edit modal — open, pre-fill, submit, list update."""
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
# The Edit button's label goes through the i18n store, which follows
|
|
# navigator.language — on a French-locale machine it reads "Modifier", so a
|
|
# has-text('Edit') locator only ever matched on English hosts. Target the
|
|
# showModal() hook instead: it is the same in every language.
|
|
# showModal(), not just edit-modal: the dialog's own close buttons reference
|
|
# the same element id via .close().
|
|
EDIT_BUTTON = "button[onclick*='showModal']"
|
|
|
|
|
|
def test_printer_edit_modal_open_and_prefill(page, live_server: str, _e2e_owner_key: str) -> None:
|
|
"""Edit button opens modal with printer's current name pre-filled."""
|
|
import httpx
|
|
|
|
from imptune.services.session import COOKIE_NAME
|
|
|
|
# Create a printer via API, under the same owner the page's cookie is seeded with
|
|
with httpx.Client(
|
|
base_url=live_server, follow_redirects=True, cookies={COOKIE_NAME: _e2e_owner_key}
|
|
) as api:
|
|
api.post(
|
|
"/printers",
|
|
data={
|
|
"name": "EditTest Printer",
|
|
"ip_address": "10.0.5.1",
|
|
"port_name": "IP_10_0_5_1",
|
|
},
|
|
)
|
|
|
|
page.goto(f"{live_server}/printers", wait_until="domcontentloaded")
|
|
page.wait_for_selector(EDIT_BUTTON)
|
|
page.click(EDIT_BUTTON)
|
|
|
|
# Dialog should be open
|
|
page.wait_for_selector("dialog[open]")
|
|
# Name input should be pre-filled
|
|
name_val = page.input_value("dialog[open] input[name='name']")
|
|
assert name_val == "EditTest Printer"
|
|
|
|
|
|
def test_printer_edit_submit_updates_list(page, live_server: str, _e2e_owner_key: str) -> None:
|
|
"""Submitting the edit form updates the printer name in the list (no page reload)."""
|
|
import httpx
|
|
|
|
from imptune.services.session import COOKIE_NAME
|
|
|
|
with httpx.Client(
|
|
base_url=live_server, follow_redirects=True, cookies={COOKIE_NAME: _e2e_owner_key}
|
|
) as api:
|
|
resp = api.post(
|
|
"/printers",
|
|
data={
|
|
"name": "OriginalName",
|
|
"ip_address": "10.0.5.2",
|
|
"port_name": "IP_10_0_5_2",
|
|
},
|
|
)
|
|
|
|
# Find the printer ID from the DB via API — target the specific Edit button by printer ID
|
|
page.goto(f"{live_server}/printers", wait_until="domcontentloaded")
|
|
# Find the row containing "OriginalName" and click its Edit button
|
|
row = page.locator("tr", has=page.locator("a", has_text="OriginalName"))
|
|
row.wait_for()
|
|
row.locator(EDIT_BUTTON).click()
|
|
page.wait_for_selector("dialog[open]")
|
|
|
|
# Clear and update the name field
|
|
page.fill("dialog[open] input[name='name']", "UpdatedName")
|
|
page.click("dialog[open] button[type='submit']")
|
|
|
|
# Wait for HTMX to swap the updated list — the anchor for the printer should show new name
|
|
page.wait_for_selector("a:has-text('UpdatedName')")
|
|
assert page.locator("a:has-text('UpdatedName')").is_visible()
|
|
assert page.locator("a:has-text('OriginalName')").count() == 0
|