mivanchenko
24d9aca812
Test backoffice (smb-crm) / test (push) Has been cancelled
Each client now gets their own clients.ics_token (lazily generated on first /owner/settings visit), which both authenticates and scopes /api/bookings.ics -- closing the gap where any shared-token holder could view another client's bookings by swapping the client_id query param. The owner settings page now surfaces a copyable subscribe URL. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
121 lines
4.2 KiB
Python
121 lines
4.2 KiB
Python
"""Flask test client / real-DB integration tests for the per-client ICS
|
|
calendar feed (#22): each client's clients.ics_token gates and scopes
|
|
/api/bookings.ics, replacing the old shared ICS_TOKEN + client_id query
|
|
param. Same testing decision as #20/#21: assert on HTTP response + DB state.
|
|
"""
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
import pytest
|
|
|
|
import booking_db as bdb
|
|
from app import app as flask_app
|
|
|
|
CLIENT_A = "C-TEST-ICS-A"
|
|
CLIENT_B = "C-TEST-ICS-B"
|
|
|
|
|
|
@pytest.fixture
|
|
def client():
|
|
flask_app.config["TESTING"] = True
|
|
flask_app.secret_key = "test-secret"
|
|
return flask_app.test_client()
|
|
|
|
|
|
def _setup(client_id, business_name):
|
|
with bdb.db.connect() as conn, conn.cursor() as cur:
|
|
cur.execute(
|
|
"INSERT INTO clients (client_id, business_name, timezone, auto_confirm, ics_token) "
|
|
"VALUES (%s, %s, %s, %s, NULL) ON CONFLICT (client_id) DO UPDATE SET "
|
|
"business_name = EXCLUDED.business_name, ics_token = NULL",
|
|
(client_id, business_name, "Europe/Berlin", True))
|
|
conn.commit()
|
|
resource = bdb.create_resource(client_id, "Chair 1")
|
|
start = datetime.now(timezone.utc).replace(microsecond=0) + timedelta(days=1)
|
|
booking = bdb.create_booking(
|
|
client_id, resource["resource_id"], "Ivy", "ivy@example.com",
|
|
"Haircut", start, start + timedelta(minutes=30))
|
|
return resource, booking
|
|
|
|
|
|
def _login(client, client_id, email="owner@example.com", password="correct horse"):
|
|
bdb.create_user(client_id, email, password)
|
|
client.post("/owner/login", data={"email": email, "password": password})
|
|
|
|
|
|
# ---- token gating ----
|
|
|
|
def test_missing_token_is_forbidden(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
resp = client.get("/api/bookings.ics")
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_bogus_token_is_forbidden(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
resp = client.get("/api/bookings.ics", query_string={"token": "not-a-real-token"})
|
|
assert resp.status_code == 403
|
|
|
|
|
|
def test_valid_token_returns_only_that_clients_bookings(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
_setup(CLIENT_B, "Cafe Lichtblick")
|
|
token_a = bdb.ensure_ics_token(CLIENT_A)
|
|
resp = client.get("/api/bookings.ics", query_string={"token": token_a})
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
assert "Ivy" in body
|
|
assert CLIENT_A in body
|
|
assert CLIENT_B not in body
|
|
|
|
|
|
def test_swapping_client_id_query_param_has_no_effect(client):
|
|
"""The old feed let any token holder view another client's bookings by
|
|
changing client_id -- the new feed resolves the client from the token
|
|
alone, so a client_id param (even another tenant's) is simply ignored."""
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
resource_b, booking_b = _setup(CLIENT_B, "Cafe Lichtblick")
|
|
token_a = bdb.ensure_ics_token(CLIENT_A)
|
|
resp = client.get("/api/bookings.ics", query_string={
|
|
"token": token_a, "client_id": CLIENT_B})
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
assert CLIENT_B not in body
|
|
assert CLIENT_A in body
|
|
|
|
|
|
# ---- token provisioning ----
|
|
|
|
def test_ensure_ics_token_generates_and_persists(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
assert bdb.get_client(CLIENT_A)["ics_token"] is None
|
|
token = bdb.ensure_ics_token(CLIENT_A)
|
|
assert token
|
|
assert bdb.get_client(CLIENT_A)["ics_token"] == token
|
|
|
|
|
|
def test_ensure_ics_token_is_stable_across_calls(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
first = bdb.ensure_ics_token(CLIENT_A)
|
|
second = bdb.ensure_ics_token(CLIENT_A)
|
|
assert first == second
|
|
|
|
|
|
def test_ensure_ics_token_differs_per_client(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
_setup(CLIENT_B, "Cafe Lichtblick")
|
|
assert bdb.ensure_ics_token(CLIENT_A) != bdb.ensure_ics_token(CLIENT_B)
|
|
|
|
|
|
# ---- owner dashboard surfacing ----
|
|
|
|
def test_settings_page_shows_subscribe_url_with_own_token(client):
|
|
_setup(CLIENT_A, "Happy Nails")
|
|
_login(client, CLIENT_A)
|
|
resp = client.get("/owner/settings")
|
|
assert resp.status_code == 200
|
|
body = resp.get_data(as_text=True)
|
|
token = bdb.get_client(CLIENT_A)["ics_token"]
|
|
assert token
|
|
assert f"token={token}" in body
|
|
assert "bookings.ics" in body
|