mivanchenko
b895663c3a
Adds the customer-facing /book/<slug> page: service/slot picker, booking form, and confirmation screen, built on #16's existing booking JSON API. Includes iframe auto-fit height reporting (mirroring deploy/booking/booking_layout.js's eaBookingHeight message), brand-color theming via a ?color= query param, a honeypot field with a fake-success response indistinguishable from a real booking, and a clear "just taken" message on slot-conflict. Caddy per-IP rate limiting is documented in deploy/booking/RATE_LIMIT.md for manual application (no Caddyfile is tracked in this repo). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
121 lines
4.4 KiB
Python
121 lines
4.4 KiB
Python
"""Flask test client / real-DB integration tests for the public booking page
|
|
and its honeypot abuse-protection (#17), per #14's testing decision: assert on
|
|
HTTP response + resulting DB state.
|
|
"""
|
|
from datetime import date, time, timedelta
|
|
|
|
import pytest
|
|
|
|
import booking_db as bdb
|
|
from app import app as flask_app
|
|
|
|
CLIENT_A = "C-TEST-PUBLIC-A"
|
|
CLIENT_B = "C-TEST-PUBLIC-B"
|
|
|
|
|
|
@pytest.fixture
|
|
def client():
|
|
flask_app.config["TESTING"] = True
|
|
return flask_app.test_client()
|
|
|
|
|
|
def _next_monday(after):
|
|
d = after + timedelta(days=1)
|
|
while d.weekday() != 0:
|
|
d += timedelta(days=1)
|
|
return d
|
|
|
|
|
|
def _make_client(client_id=CLIENT_A, slug="happynails", business_name="Happy Nails"):
|
|
with bdb.db.connect() as conn, conn.cursor() as cur:
|
|
cur.execute(
|
|
"INSERT INTO clients (client_id, business_name, slug, timezone, auto_confirm) "
|
|
"VALUES (%s, %s, %s, %s, %s) "
|
|
"ON CONFLICT (client_id) DO UPDATE SET business_name = EXCLUDED.business_name, "
|
|
"slug = EXCLUDED.slug, timezone = EXCLUDED.timezone, "
|
|
"auto_confirm = EXCLUDED.auto_confirm",
|
|
(client_id, business_name, slug, "Europe/Berlin", True))
|
|
conn.commit()
|
|
|
|
|
|
def _setup_bookable_client(client_id=CLIENT_A, slug="happynails"):
|
|
_make_client(client_id, slug)
|
|
resource = bdb.create_resource(client_id, "Chair 1", min_notice_minutes=0,
|
|
max_advance_days=365)
|
|
bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
|
|
service = bdb.create_service(client_id, "Haircut", 60, price=25)
|
|
return resource, service
|
|
|
|
|
|
def test_book_page_renders_for_known_slug_with_services_and_resources(client):
|
|
resource, service = _setup_bookable_client()
|
|
resp = client.get("/book/happynails")
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
assert "Happy Nails" in body
|
|
assert "Haircut" in body
|
|
assert resource["resource_id"] in body
|
|
|
|
|
|
def test_book_page_404s_for_unknown_slug(client):
|
|
resp = client.get("/book/does-not-exist")
|
|
assert resp.status_code == 404
|
|
|
|
|
|
def test_book_page_404s_when_client_has_no_active_service(client):
|
|
_make_client(CLIENT_B, slug="no-services-client")
|
|
bdb.create_resource(CLIENT_B, "Chair 1")
|
|
# No services created for this client.
|
|
resp = client.get("/book/no-services-client")
|
|
assert resp.status_code == 404
|
|
|
|
|
|
def test_book_page_404s_when_client_has_only_inactive_service(client):
|
|
_make_client(CLIENT_B, slug="inactive-service-client")
|
|
bdb.create_resource(CLIENT_B, "Chair 1")
|
|
bdb.create_service(CLIENT_B, "Haircut", 60, active=False)
|
|
resp = client.get("/book/inactive-service-client")
|
|
assert resp.status_code == 404
|
|
|
|
|
|
def test_honeypot_filled_silently_rejects_booking(client):
|
|
resource, service = _setup_bookable_client()
|
|
day = _next_monday(date.today())
|
|
slot = client.get("/api/booking/slots", query_string={
|
|
"client_id": CLIENT_A, "resource_id": resource["resource_id"],
|
|
"service_id": service["service_id"],
|
|
"date_from": day.isoformat(), "date_to": day.isoformat()}).get_json()["slots"]
|
|
assert slot
|
|
|
|
resp = client.post("/api/booking", json={
|
|
"client_id": CLIENT_A, "resource_id": resource["resource_id"],
|
|
"service_id": service["service_id"], "start_time": slot[0],
|
|
"customer_name": "Bot", "customer_contact": "bot@example.com",
|
|
"website": "https://spam.example"})
|
|
|
|
# Looks like an ordinary success to the caller...
|
|
assert resp.status_code == 201
|
|
body = resp.get_json()
|
|
assert body["status"] == "confirmed"
|
|
assert "token" in body
|
|
# ...but no booking was actually created.
|
|
assert bdb.list_bookings(CLIENT_A) == []
|
|
|
|
|
|
def test_honeypot_empty_creates_a_real_booking(client):
|
|
resource, service = _setup_bookable_client()
|
|
day = _next_monday(date.today())
|
|
slot = client.get("/api/booking/slots", query_string={
|
|
"client_id": CLIENT_A, "resource_id": resource["resource_id"],
|
|
"service_id": service["service_id"],
|
|
"date_from": day.isoformat(), "date_to": day.isoformat()}).get_json()["slots"]
|
|
|
|
resp = client.post("/api/booking", json={
|
|
"client_id": CLIENT_A, "resource_id": resource["resource_id"],
|
|
"service_id": service["service_id"], "start_time": slot[0],
|
|
"customer_name": "Real Customer", "customer_contact": "real@example.com",
|
|
"website": ""})
|
|
|
|
assert resp.status_code == 201
|
|
assert len(bdb.list_bookings(CLIENT_A)) == 1
|