69 lines
2.7 KiB
Python
69 lines
2.7 KiB
Python
import base64
|
|
import hashlib
|
|
from pathlib import Path
|
|
from urllib.parse import parse_qs, urlparse
|
|
|
|
import pytest
|
|
from django.core.management import call_command
|
|
from django.core.exceptions import ImproperlyConfigured
|
|
|
|
from apps.attachments.delivery import signed_media_redirect
|
|
from apps.integrations.bale.providers import get_bale_provider
|
|
|
|
|
|
def test_signed_media_redirect_matches_nginx_secure_link(settings):
|
|
settings.MEDIA_SIGNING_SECRET = "deployment-test-secret-with-enough-entropy"
|
|
response = signed_media_redirect("tickets/2026/09/example.pdf", lifetime=300)
|
|
parsed = urlparse(response.url)
|
|
query = parse_qs(parsed.query)
|
|
expires = query["expires"][0]
|
|
expected = hashlib.md5(
|
|
f"{expires}{parsed.path} {settings.MEDIA_SIGNING_SECRET}".encode(),
|
|
usedforsecurity=False,
|
|
).digest()
|
|
expected = base64.urlsafe_b64encode(expected).rstrip(b"=").decode()
|
|
assert response.status_code == 302
|
|
assert query["md5"] == [expected]
|
|
|
|
|
|
def test_bale_missing_token_is_not_silently_successful(settings):
|
|
settings.DEBUG = False
|
|
settings.BALE_BOT_TOKEN = ""
|
|
with pytest.raises(ImproperlyConfigured, match="BALE_BOT_TOKEN"):
|
|
get_bale_provider()
|
|
|
|
|
|
def test_nginx_serves_assets_without_proxying_django():
|
|
root = Path(__file__).resolve().parents[1]
|
|
nginx = (root / "docker" / "nginx.conf").read_text(encoding="utf-8")
|
|
compose = (root / "docker-compose.yml").read_text(encoding="utf-8")
|
|
assert "location /static/" in nginx
|
|
assert "location ^~ /media/branding/" in nginx
|
|
assert "location /protected-media/" in nginx
|
|
assert "secure_link_md5" in nginx
|
|
assert "proxy_pass" not in nginx
|
|
assert "media_data:/app/media:ro" in compose
|
|
assert "notification-worker:" in compose
|
|
assert " db:" not in compose
|
|
assert "PathPrefix(`/static/`)" in compose
|
|
assert "PathPrefix(`/media/branding/`)" in compose
|
|
assert "PathPrefix(`/protected-media/`)" in compose
|
|
assert "priority=1000" in compose
|
|
assert "stripprefix" not in compose.lower()
|
|
assert "Set MEDIA_SIGNING_SECRET in Coolify" not in compose
|
|
|
|
|
|
def test_startup_imports_production_seed_only_when_database_has_no_seed_marker():
|
|
root = Path(__file__).resolve().parents[1]
|
|
entrypoint = (root / "docker" / "entrypoint.sh").read_text(encoding="utf-8")
|
|
marker_check = "ProductionSeedState.objects.exists()"
|
|
import_command = 'python manage.py import_production_seed "$seed_dir"'
|
|
assert marker_check in entrypoint
|
|
assert entrypoint.index(marker_check) < entrypoint.index(import_command)
|
|
assert "Production seed was already applied; skipping seed import." in entrypoint
|
|
|
|
|
|
@pytest.mark.django_db
|
|
def test_notification_worker_command_starts_and_exits_in_once_mode():
|
|
call_command("process_notifications", once=True)
|