1445043649
50 lines
1.4 KiB
Python
50 lines
1.4 KiB
Python
"""CSRF bearer-skip tests (Stage 1 PR3)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from starlette.testclient import TestClient
|
|
|
|
|
|
def _make_app():
|
|
from fastapi import FastAPI
|
|
|
|
from app.gateway.csrf_middleware import CSRFMiddleware
|
|
|
|
app = FastAPI()
|
|
app.add_middleware(CSRFMiddleware)
|
|
|
|
@app.post("/api/echo")
|
|
async def echo():
|
|
return {"ok": True}
|
|
|
|
return app
|
|
|
|
|
|
def test_bearer_post_skips_csrf():
|
|
client = TestClient(_make_app())
|
|
# No X-CSRF-Token / csrf cookie, but bearer header present → allowed.
|
|
r = client.post("/api/echo", headers={"Authorization": "Bearer dfk_live_anything"})
|
|
assert r.status_code == 200
|
|
|
|
|
|
def test_cookie_post_still_requires_csrf():
|
|
client = TestClient(_make_app())
|
|
# No bearer, no CSRF token → 403 (regression: cookie path unchanged).
|
|
r = client.post("/api/echo")
|
|
assert r.status_code == 403
|
|
assert "CSRF token missing" in r.json()["detail"]
|
|
|
|
|
|
def test_has_bearer_header_detection():
|
|
from starlette.requests import Request
|
|
|
|
from app.gateway.csrf_middleware import has_bearer_header
|
|
|
|
def _req(headers):
|
|
scope = {"type": "http", "headers": [(k.lower().encode(), v.encode()) for k, v in headers.items()]}
|
|
return Request(scope)
|
|
|
|
assert has_bearer_header(_req({"authorization": "Bearer x"})) is True
|
|
assert has_bearer_header(_req({"authorization": "Basic x"})) is False
|
|
assert has_bearer_header(_req({})) is False
|