fe16c08daa
- MeTubeClient encapsulates all MeTube HTTP/Socket.IO calls (verified against
the real MeTube source: /add returns no job id, GET /history gives a queue
snapshot for reconciliation, filenames arrive already relative, percent is
a 0-100 float)
- download_jobs table + service: request/dedup active downloads, apply live
Socket.IO events (added/updated/completed/canceled/cleared) matched by
canonical YouTube URL, safe relative-path -> public media URL construction
- Reconciliation on startup against MeTube's live queue/done state (section 19):
non-terminal jobs recovered where possible, else marked "unknown"; already
completed jobs are left untouched
- POST/GET /api/videos/{id}/download(-status), recheck-local; feed/video
detail now report real local availability instead of a stub
- Frontend: download button with live status polling (queued/downloading %/
postprocessing/completed/failed+retry), local <video> playback with
YouTube fallback on playback error
- health.py now delegates to MeTubeClient (single place for MeTube calls)
26 new backend tests (63 total). Verified live: Socket.IO connects
successfully to the real MeTube instance on deploy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
80 lines
2.8 KiB
Python
80 lines
2.8 KiB
Python
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.api import auth as auth_module
|
|
from app.db import get_db
|
|
from app.main import app
|
|
from app.services import google_oauth
|
|
|
|
|
|
@pytest.fixture
|
|
def client(monkeypatch, db_session):
|
|
def _get_db_override():
|
|
yield db_session
|
|
|
|
app.dependency_overrides[get_db] = _get_db_override
|
|
monkeypatch.setattr(auth_module, "_run_initial_sync", lambda: None)
|
|
monkeypatch.setattr(
|
|
google_oauth, "build_authorization_url", lambda: ("https://accounts.google.com/fake", "fixed-state")
|
|
)
|
|
# Deliberately not using `with TestClient(app)`: that runs the app's
|
|
# lifespan, which would try to reach the real MeTube instance and DB.
|
|
yield TestClient(app)
|
|
del app.dependency_overrides[get_db]
|
|
|
|
|
|
class FakeCredentials:
|
|
token = "fake-access-token"
|
|
refresh_token = "fake-refresh-token"
|
|
expiry = None
|
|
|
|
|
|
def _start_oauth(client):
|
|
response = client.get("/api/auth/google/start", follow_redirects=False)
|
|
assert response.status_code in (302, 307)
|
|
return "fixed-state"
|
|
|
|
|
|
def test_callback_rejects_disallowed_email(client, monkeypatch):
|
|
state = _start_oauth(client)
|
|
|
|
monkeypatch.setattr(google_oauth, "exchange_code", lambda code, state: FakeCredentials())
|
|
monkeypatch.setattr(google_oauth, "fetch_userinfo", lambda token: {"email": "stranger@example.com"})
|
|
revoked = {}
|
|
monkeypatch.setattr(google_oauth, "revoke_token", lambda token: revoked.setdefault("called", True))
|
|
|
|
response = client.get(f"/api/auth/google/callback?code=abc&state={state}", follow_redirects=False)
|
|
|
|
assert response.status_code in (302, 307)
|
|
assert "account_not_allowed" in response.headers["location"]
|
|
assert revoked.get("called") is True
|
|
|
|
status = client.get("/api/auth/status").json()
|
|
assert status["authenticated"] is False
|
|
assert status["connected"] is False
|
|
|
|
|
|
def test_callback_accepts_allowed_email(client, monkeypatch):
|
|
state = _start_oauth(client)
|
|
|
|
monkeypatch.setattr(google_oauth, "exchange_code", lambda code, state: FakeCredentials())
|
|
monkeypatch.setattr(google_oauth, "fetch_userinfo", lambda token: {"email": "owner@example.com"})
|
|
|
|
response = client.get(f"/api/auth/google/callback?code=abc&state={state}", follow_redirects=False)
|
|
|
|
assert response.status_code in (302, 307)
|
|
assert "auth_error" not in response.headers["location"]
|
|
|
|
status = client.get("/api/auth/status").json()
|
|
assert status["authenticated"] is True
|
|
assert status["connected"] is True
|
|
assert status["email"] == "owner@example.com"
|
|
|
|
|
|
def test_callback_rejects_invalid_state(client, monkeypatch):
|
|
_start_oauth(client)
|
|
|
|
response = client.get("/api/auth/google/callback?code=abc&state=wrong-state", follow_redirects=False)
|
|
|
|
assert response.status_code in (302, 307)
|
|
assert "invalid_state" in response.headers["location"]
|