50 lines
1.8 KiB
Python
50 lines
1.8 KiB
Python
from fastapi import HTTPException
|
|
|
|
from app.api.upload import build_object_key, is_owned_upload_key, validate_image_upload
|
|
from app.config import settings, validate_security_settings
|
|
|
|
|
|
USER_ID = "a2d4447f-7b67-4304-ad9a-953007e75ef2"
|
|
|
|
|
|
def test_build_object_key_is_scoped_to_the_authenticated_user():
|
|
object_key = build_object_key(USER_ID, "jpg")
|
|
|
|
assert is_owned_upload_key(object_key, USER_ID)
|
|
assert not is_owned_upload_key(object_key, "cf610b28-51a7-423d-a55a-730e193c9971")
|
|
|
|
|
|
def test_upload_rejects_non_image_content_type():
|
|
try:
|
|
validate_image_upload("payload.exe", "application/octet-stream")
|
|
except HTTPException as exc:
|
|
assert exc.status_code == 400
|
|
else:
|
|
raise AssertionError("non-image uploads must be rejected")
|
|
|
|
|
|
def test_upload_rejects_an_invalid_filename_extension():
|
|
try:
|
|
validate_image_upload("payload.txt", "image/jpeg")
|
|
except HTTPException as exc:
|
|
assert exc.status_code == 400
|
|
else:
|
|
raise AssertionError("invalid extensions must be rejected")
|
|
|
|
|
|
def test_production_rejects_placeholder_database_configuration(monkeypatch):
|
|
monkeypatch.setattr(settings, "ENVIRONMENT", "production")
|
|
monkeypatch.setattr(settings, "SECRET_KEY", "a" * 32)
|
|
monkeypatch.setattr(settings, "DATABASE_URL", "postgresql+asyncpg://qiji_app:invalid@localhost:5432/qiji")
|
|
monkeypatch.setattr(settings, "MINIO_ENDPOINT", "minio.example.test:9000")
|
|
monkeypatch.setattr(settings, "MINIO_ACCESS_KEY", "qiji-app")
|
|
monkeypatch.setattr(settings, "MINIO_SECRET_KEY", "a-secure-minio-secret")
|
|
monkeypatch.setattr(settings, "MINIO_SECURE", True)
|
|
|
|
try:
|
|
validate_security_settings()
|
|
except RuntimeError as exc:
|
|
assert "DATABASE_URL" in str(exc)
|
|
else:
|
|
raise AssertionError("production configuration must reject placeholders")
|