0ed20bb838
- FastAPI + PostgreSQL + Alembic + React/Vite skeleton, Docker Compose, healthcheck - Google OAuth (single allowed account), encrypted refresh token storage - Subscriptions sync with pagination, uploads playlist batch fetch - Categories CRUD, many-to-many channel assignment, category filtering - Video sync (playlistItems + videos.list batching), cached feed with cursor pagination, background scheduler (APScheduler) - Video detail page with YouTube embed player - SPA fallback routing, optimistic UI updates, client-side query caching 40 backend tests covering OAuth allow-list, sync idempotency, cascade deletes, cursor pagination, and category filtering. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
79 lines
2.7 KiB
Python
79 lines
2.7 KiB
Python
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.api import auth as auth_module
|
|
from app.db import get_db
|
|
from app.main import app
|
|
from app.services import google_oauth
|
|
|
|
|
|
@pytest.fixture
|
|
def client(monkeypatch, db_session):
|
|
def _get_db_override():
|
|
yield db_session
|
|
|
|
app.dependency_overrides[get_db] = _get_db_override
|
|
monkeypatch.setattr(auth_module, "_run_initial_sync", lambda: None)
|
|
monkeypatch.setattr(
|
|
google_oauth, "build_authorization_url", lambda: ("https://accounts.google.com/fake", "fixed-state")
|
|
)
|
|
with TestClient(app) as test_client:
|
|
yield test_client
|
|
del app.dependency_overrides[get_db]
|
|
|
|
|
|
class FakeCredentials:
|
|
token = "fake-access-token"
|
|
refresh_token = "fake-refresh-token"
|
|
expiry = None
|
|
|
|
|
|
def _start_oauth(client):
|
|
response = client.get("/api/auth/google/start", follow_redirects=False)
|
|
assert response.status_code in (302, 307)
|
|
return "fixed-state"
|
|
|
|
|
|
def test_callback_rejects_disallowed_email(client, monkeypatch):
|
|
state = _start_oauth(client)
|
|
|
|
monkeypatch.setattr(google_oauth, "exchange_code", lambda code, state: FakeCredentials())
|
|
monkeypatch.setattr(google_oauth, "fetch_userinfo", lambda token: {"email": "stranger@example.com"})
|
|
revoked = {}
|
|
monkeypatch.setattr(google_oauth, "revoke_token", lambda token: revoked.setdefault("called", True))
|
|
|
|
response = client.get(f"/api/auth/google/callback?code=abc&state={state}", follow_redirects=False)
|
|
|
|
assert response.status_code in (302, 307)
|
|
assert "account_not_allowed" in response.headers["location"]
|
|
assert revoked.get("called") is True
|
|
|
|
status = client.get("/api/auth/status").json()
|
|
assert status["authenticated"] is False
|
|
assert status["connected"] is False
|
|
|
|
|
|
def test_callback_accepts_allowed_email(client, monkeypatch):
|
|
state = _start_oauth(client)
|
|
|
|
monkeypatch.setattr(google_oauth, "exchange_code", lambda code, state: FakeCredentials())
|
|
monkeypatch.setattr(google_oauth, "fetch_userinfo", lambda token: {"email": "owner@example.com"})
|
|
|
|
response = client.get(f"/api/auth/google/callback?code=abc&state={state}", follow_redirects=False)
|
|
|
|
assert response.status_code in (302, 307)
|
|
assert "auth_error" not in response.headers["location"]
|
|
|
|
status = client.get("/api/auth/status").json()
|
|
assert status["authenticated"] is True
|
|
assert status["connected"] is True
|
|
assert status["email"] == "owner@example.com"
|
|
|
|
|
|
def test_callback_rejects_invalid_state(client, monkeypatch):
|
|
_start_oauth(client)
|
|
|
|
response = client.get("/api/auth/google/callback?code=abc&state=wrong-state", follow_redirects=False)
|
|
|
|
assert response.status_code in (302, 307)
|
|
assert "invalid_state" in response.headers["location"]
|