Merge remote-tracking branch 'origin/main' into wilm

tests/test_plugins/test_tools_securesend.py

@@ -159,3 +159,86 @@ def test_an_unknown_token_answers_the_same_as_a_spent_one(client, auth_headers):
     assert spent.status_code == never.status_code == 404
     assert (spent.get_json()['data']['error']['message']
             == never.get_json()['data']['error']['message'])
+
+
+# ------------------------------------------------- guests, when a site allows
+
+def _allow_guests(db, allowed=True):
+    from shopdb.core.models import Setting
+    row = Setting.query.filter_by(key='securesend_allow_guests').first()
+    if row is None:
+        row = Setting(key='securesend_allow_guests', valuetype='boolean',
+                      category='tools')
+        db.session.add(row)
+    row.value = 'true' if allowed else 'false'
+    db.session.commit()
+
+
+def test_a_guest_is_refused_by_default(client, db):
+    """Default OFF. An unauthenticated write endpoint is not something to get
+    by accident."""
+    _allow_guests(db, False)
+    resp = client.post('/api/tools/secrets', json={'ciphertext': CIPHER, 'iv': IV})
+    assert resp.status_code in (401, 403, 422)
+
+
+def test_a_guest_can_create_once_a_site_allows_it(client, db):
+    _allow_guests(db, True)
+    resp = client.post('/api/tools/secrets', json={'ciphertext': CIPHER, 'iv': IV})
+    assert resp.status_code in (200, 201), resp.get_data(as_text=True)[:300]
+    assert resp.get_json()['data']['token']
+
+
+def test_a_guest_secret_has_no_creator(client, db):
+    """The cost of the setting, pinned: the audit trail can say when and from
+    where, but never who."""
+    _allow_guests(db, True)
+    token = client.post('/api/tools/secrets',
+                        json={'ciphertext': CIPHER, 'iv': IV}
+                        ).get_json()['data']['token']
+    secret = SecureSecret.query.filter_by(token=token).first()
+    assert secret.createdbyuserid is None
+
+
+def test_guest_creation_is_rate_limited(client, db):
+    """An open endpoint must not be an easy place to park data."""
+    from plugins.tools.api.routes import GUEST_CREATE_MAX
+    _allow_guests(db, True)
+    codes = [client.post('/api/tools/secrets',
+                         json={'ciphertext': CIPHER, 'iv': IV}).status_code
+             for _ in range(GUEST_CREATE_MAX + 2)]
+    assert 429 in codes, codes
+
+
+def test_a_signed_in_user_still_needs_the_permission(client, db, member_headers):
+    """Opening the door to guests is a decision about the DOOR, not about
+    revoking what a role holds."""
+    _allow_guests(db, True)
+    resp = client.post('/api/tools/secrets',
+                       json={'ciphertext': CIPHER, 'iv': IV},
+                       headers=member_headers)
+    assert resp.status_code == 403
+
+
+# ----------------------------------------------------------------- retention
+
+def test_an_expired_secret_nobody_opened_is_swept(client, db, auth_headers):
+    """Nothing removed a secret that was never clicked: the recipient goes on
+    holiday and the ciphertext sits there for good."""
+    from datetime import datetime, timedelta, timezone
+    token = _create(client, auth_headers).get_json()['data']['token']
+    secret = SecureSecret.query.filter_by(token=token).first()
+    secret.expiresat = (datetime.now(timezone.utc).replace(tzinfo=None)
+                        - timedelta(hours=1))
+    db.session.commit()
+
+    # Any later create sweeps it, without a scheduler existing anywhere.
+    _create(client, auth_headers)
+    assert SecureSecret.query.filter_by(token=token).first() is None
+
+
+def test_a_custom_view_count_is_allowed(client, auth_headers):
+    from plugins.tools.api.routes import MAX_VIEWS
+    assert _create(client, auth_headers, views=25).status_code in (200, 201)
+    assert _create(client, auth_headers, views=MAX_VIEWS).status_code in (200, 201)
+    assert _create(client, auth_headers, views=MAX_VIEWS + 1).status_code == 400