afce24379c
A sweep of the URL map found 165 GET routes that answered anybody, with no token at all: the whole asset inventory, every machine, PC, printer and network device, the USB checkout history and who is holding which drive, the staff directory with its photographs, every core report. Guest access had been argued about one feature-flag at a time while the front door stood open. Each of those now carries the read permission it belongs to. That also makes the guest role mean something: a site can open exactly the reads it chooses, and nothing follows by accident. Thirty-three endpoints stay public, and each is named with its reason rather than left to be inferred: the app shell and its bootstrap, the settings allowlist (the handler already filters an anonymous caller down to branding and a few keys), images fetched by <img src> which carries no Authorization header, what a display kiosk renders before anybody signs in, the parts and USB kiosks, the client scripts that run as SYSTEM before a user session exists, and a secure-send link whose unguessable token IS the authorisation. tests/test_core/test_public_read_surface.py is the standing gate, the companion to the mutating-route sweep that has guarded writes for months. A new public read fails CI until somebody adds it to that list in front of a reviewer. Four further reads need a login but no permission, because the handler decides from who you are - your own user record, your own API tokens, the role catalogue the grid renders - and the same test proves each still refuses an anonymous caller. Verified not vacuous by ungating one route and watching the sweep name it. The employees plugin gained employees.view; the directory is names, SSOs, photographs and reporting lines, and it had no permission of any kind. Around ninety tests asserted payload shapes against endpoints that answered anybody. They are about what the answer says, not about who may ask, so they are signed in now rather than the gate being loosened. The ones that assert an anonymous caller is refused were left exactly as they were.
164 lines
6.1 KiB
Python
164 lines
6.1 KiB
Python
"""Dualpath single-machine collapse (site setting dualpath_single_machine).
|
|
|
|
A Dualpath pair is one physical dual-bay machine recorded as two asset rows.
|
|
With the setting on (default), the machines list, dashboard machine count, and
|
|
the floor map collapse the pair to the PRIMARY bay (lower natural-sort
|
|
assetnumber) and annotate it with its hidden partner. With the setting off,
|
|
both bays list and count separately. The data model always keeps both rows.
|
|
|
|
Settings are cached, so each test invalidates the cache after seeding.
|
|
"""
|
|
|
|
from shopdb.extensions import db as _db
|
|
from shopdb.core.models import Asset, AssetType, Setting
|
|
from shopdb.core.models.relationship import RelationshipType, AssetRelationship
|
|
from shopdb.core.api.settings import invalidate_settings_cache
|
|
|
|
from plugins.machines.models import Machine
|
|
|
|
|
|
def _seed_dualpath_pair():
|
|
"""Create a 'machine' AssetType, two machine assets (2007, 2008) placed on
|
|
the map, and an active Dualpath relationship between them. 2007 is PRIMARY
|
|
(lower natural-sort). Returns (primary_machine, secondary_machine)."""
|
|
machinetype = AssetType(assettype='machine')
|
|
_db.session.add(machinetype)
|
|
_db.session.flush()
|
|
|
|
dualpath = RelationshipType(relationshiptype='Dualpath', isdirectional=False)
|
|
_db.session.add(dualpath)
|
|
_db.session.flush()
|
|
|
|
primary_asset = Asset(assetnumber='2007', assettypeid=machinetype.assettypeid,
|
|
mapx=100, mapy=100)
|
|
secondary_asset = Asset(assetnumber='2008', assettypeid=machinetype.assettypeid,
|
|
mapx=110, mapy=110)
|
|
_db.session.add_all([primary_asset, secondary_asset])
|
|
_db.session.flush()
|
|
|
|
primary_machine = Machine(assetid=primary_asset.assetid)
|
|
secondary_machine = Machine(assetid=secondary_asset.assetid)
|
|
_db.session.add_all([primary_machine, secondary_machine])
|
|
_db.session.flush()
|
|
|
|
_db.session.add(AssetRelationship(
|
|
sourceassetid=primary_asset.assetid,
|
|
targetassetid=secondary_asset.assetid,
|
|
relationshiptypeid=dualpath.relationshiptypeid,
|
|
))
|
|
_db.session.commit()
|
|
return primary_machine, secondary_machine
|
|
|
|
|
|
def _set_toggle(value):
|
|
Setting.set('dualpath_single_machine', value, valuetype='boolean',
|
|
category='site')
|
|
invalidate_settings_cache()
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Setting ON (default): pair collapses to the primary bay
|
|
# ---------------------------------------------------------------------------
|
|
|
|
def test_list_collapses_secondary_and_annotates_primary(client, db, auth_headers):
|
|
invalidate_settings_cache() # default on (no row)
|
|
_seed_dualpath_pair()
|
|
|
|
resp = client.get('/api/machines', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
payload = resp.get_json()
|
|
items = payload['data']
|
|
numbers = [i['assetnumber'] for i in items]
|
|
|
|
# secondary bay (2008) is hidden; total reflects the collapse
|
|
assert numbers == ['2007']
|
|
assert payload['meta']['pagination']['total'] == 1
|
|
|
|
# the visible primary carries its partner
|
|
partner = items[0]['dualpathpartner']
|
|
assert partner is not None
|
|
assert partner['assetnumber'] == '2008'
|
|
assert partner['assetid'] is not None
|
|
assert partner['machineid'] is not None
|
|
|
|
|
|
def test_dashboard_machine_count_collapses(client, db, auth_headers):
|
|
invalidate_settings_cache()
|
|
_seed_dualpath_pair()
|
|
|
|
resp = client.get('/api/dashboard', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
counts = resp.get_json()['data']
|
|
# two machine rows, one physical machine
|
|
assert counts['totalmachines'] == 1
|
|
assert counts['counts']['machines'] == 1
|
|
|
|
|
|
def test_map_excludes_secondary_marker(client, db, auth_headers):
|
|
invalidate_settings_cache()
|
|
_seed_dualpath_pair()
|
|
|
|
resp = client.get('/api/assets/map', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
assets = resp.get_json()['data']['assets']
|
|
numbers = [a['assetnumber'] for a in assets]
|
|
|
|
assert '2007' in numbers
|
|
assert '2008' not in numbers
|
|
primary = next(a for a in assets if a['assetnumber'] == '2007')
|
|
assert primary['dualpathpartner'] == '2008'
|
|
|
|
|
|
def test_detail_banner_partner_shown_regardless_of_toggle(client, db, auth_headers):
|
|
invalidate_settings_cache()
|
|
primary_machine, secondary_machine = _seed_dualpath_pair()
|
|
|
|
# banner data is present on BOTH bays even with the toggle off
|
|
_set_toggle(False)
|
|
for machine_id, expected in (
|
|
(primary_machine.machineid, '2008'),
|
|
(secondary_machine.machineid, '2007'),
|
|
):
|
|
resp = client.get(f'/api/machines/{machine_id}', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
partner = resp.get_json()['data']['dualpathpartner']
|
|
assert partner is not None
|
|
assert partner['assetnumber'] == expected
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Setting OFF: both bays list and count separately
|
|
# ---------------------------------------------------------------------------
|
|
|
|
def test_list_shows_both_bays_when_disabled(client, db, auth_headers):
|
|
_seed_dualpath_pair()
|
|
_set_toggle(False)
|
|
|
|
resp = client.get('/api/machines', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
payload = resp.get_json()
|
|
numbers = sorted(i['assetnumber'] for i in payload['data'])
|
|
|
|
assert numbers == ['2007', '2008']
|
|
assert payload['meta']['pagination']['total'] == 2
|
|
|
|
|
|
def test_dashboard_counts_both_bays_when_disabled(client, db, auth_headers):
|
|
_seed_dualpath_pair()
|
|
_set_toggle(False)
|
|
|
|
resp = client.get('/api/dashboard', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
assert resp.get_json()['data']['totalmachines'] == 2
|
|
|
|
|
|
def test_map_shows_both_bays_when_disabled(client, db, auth_headers):
|
|
_seed_dualpath_pair()
|
|
_set_toggle(False)
|
|
|
|
resp = client.get('/api/assets/map', headers=auth_headers)
|
|
assert resp.status_code == 200, resp.get_json()
|
|
numbers = [a['assetnumber'] for a in resp.get_json()['data']['assets']]
|
|
assert '2007' in numbers
|
|
assert '2008' in numbers
|