70 lines
2.9 KiB
Python
70 lines
2.9 KiB
Python
"""Test the first-time admin setup flow with an injected test credential."""
|
|
import os
|
|
import sys
|
|
import tempfile
|
|
import warnings
|
|
from pathlib import Path
|
|
|
|
warnings.filterwarnings("ignore", message="The HMAC key is")
|
|
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
|
|
|
|
tempdir = tempfile.mkdtemp(prefix="st_setup_")
|
|
os.environ["DATA_DIR"] = tempdir
|
|
os.environ["JWT_SECRET"] = "test-secret-key-0123456789abcdef"
|
|
os.environ["APP_ENV"] = "test"
|
|
os.environ["BOOTSTRAP_ADMIN_PASSWORD"] = "test-bootstrap-password"
|
|
|
|
from app.factory import create_app # noqa: E402
|
|
from app.config import Config # noqa: E402
|
|
|
|
Config.DATA_DIR = Path(tempdir)
|
|
Config.LLM_API_KEY = ""
|
|
Config.LLM_BASE_URL = ""
|
|
|
|
|
|
def main():
|
|
app = create_app()
|
|
client = app.test_client()
|
|
|
|
# 1. Default admin logs in with the injected test password and must_setup is true
|
|
r = client.post("/api/auth/login", json={"username": "admin", "password": "test-bootstrap-password"})
|
|
assert r.status_code == 200, r.get_json()
|
|
assert r.get_json()["must_setup"] is True, "default admin should require setup"
|
|
token = r.get_json()["token"]
|
|
H = {"Authorization": f"Bearer {token}"}
|
|
me = client.get("/api/auth/me", headers=H).get_json()["user"]
|
|
assert me.get("must_setup") is True
|
|
print("[ok] injected bootstrap credential -> must_setup=true")
|
|
|
|
# 2. Cannot set up with short password / bad email
|
|
r = client.post("/api/auth/setup", json={"username": "admin", "email": "bad", "password": "12"}, headers=H)
|
|
assert r.status_code == 400, r.get_json()
|
|
print("[ok] setup rejects bad email/short password")
|
|
|
|
# 3. Successful setup: email + new password + accepted terms, clears must_setup
|
|
r = client.post("/api/auth/setup", json={"username": "admin", "email": "admin@corp.com", "password": "NewPass!2026", "accepted_terms": True}, headers=H)
|
|
assert r.status_code == 200, r.get_json()
|
|
assert r.get_json()["must_setup"] is False
|
|
print("[ok] setup completes -> must_setup=false")
|
|
|
|
# 4. Old password no longer works; new one does
|
|
r = client.post("/api/auth/login", json={"username": "admin", "password": "test-bootstrap-password"})
|
|
assert r.status_code == 401, "old bootstrap password should be invalid"
|
|
r = client.post("/api/auth/login", json={"username": "admin", "password": "NewPass!2026"})
|
|
assert r.status_code == 200
|
|
new_token = r.get_json()["token"]
|
|
assert r.get_json()["must_setup"] is False
|
|
print("[ok] old password rejected; new password logs in")
|
|
|
|
# 5. Admin can now use the app (create user, etc.)
|
|
NH = {"Authorization": f"Bearer {new_token}"}
|
|
r = client.post("/api/admin/users", json={"name": "T1", "username": "t1", "password": "trainee-password", "role": "user"}, headers=NH)
|
|
assert r.status_code == 201, r.get_json()
|
|
print("[ok] admin can use the app after setup")
|
|
|
|
print("\nALL SETUP TESTS PASSED")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|