Colin Maudry
42 lines
1.1 KiB
Python
42 lines
1.1 KiB
Python
import pytest
|
|
from flask import Flask
|
|
from flask_login import current_user
|
|
|
|
from src.auth.setup import init_auth, safe_next
|
|
|
|
|
|
def test_safe_next_allows_relative_path():
|
|
assert safe_next("/acheteur?id=1") == "/acheteur?id=1"
|
|
|
|
|
|
def test_safe_next_rejects_absolute_urls():
|
|
assert safe_next("https://evil.com/phish") == "/"
|
|
|
|
|
|
def test_safe_next_rejects_protocol_relative():
|
|
assert safe_next("//evil.com") == "/"
|
|
|
|
|
|
def test_safe_next_rejects_empty():
|
|
assert safe_next("") == "/"
|
|
assert safe_next(None) == "/"
|
|
|
|
|
|
def test_safe_next_custom_fallback():
|
|
assert safe_next("", fallback="/compte") == "/compte"
|
|
|
|
|
|
def test_init_auth_requires_secret_key(monkeypatch, users_db_path):
|
|
monkeypatch.delenv("SECRET_KEY", raising=False)
|
|
app = Flask(__name__)
|
|
with pytest.raises(RuntimeError, match="SECRET_KEY"):
|
|
init_auth(app)
|
|
|
|
|
|
def test_init_auth_anonymous_user_not_authenticated(users_db_path):
|
|
app = Flask(__name__)
|
|
app.config["SECRET_KEY"] = "test"
|
|
init_auth(app)
|
|
with app.test_request_context("/"):
|
|
assert current_user.is_authenticated is False
|