chore(v2): restructure monorepo to src/ layout with uv
Aligns the repo with the python-project-spec-design.md template chosen for V2.0.0. Big move, no logic changes. The 3 pre-existing test failures (test_recipes::test_update_recipe, test_recipes:: test_recipe_versioning, test_tasks::test_reorder_tasks, plus the client test_save_measurement_proxy) survive unchanged. Layout changes - server/ -> src/backend/ - server/middleware/ -> src/backend/api/middleware/ - server/routers/ -> src/backend/api/routers/ - server/models/ -> src/backend/models/orm/ - server/schemas/ -> src/backend/models/api/ - server/uploads/ -> uploads/ (project root, mounted volume) - server/tests/ -> src/backend/tests/ - client/ -> src/frontend/flask_app/ (Flask kept; React deroga is documented in CLAUDE.md, justified by tablet UX, USB caliper/barcode workflow and Fabric.js integration) Tooling - pyproject.toml: monorepo with [project] core deps and optional-dependencies server / client / dev. Replaces both server/requirements.txt and client/requirements.txt. - uv.lock + .python-version (3.11) committed for reproducible builds. - Dockerfile (root, backend) and Dockerfile.frontend rewritten to use uv sync --frozen --no-dev --extra server|client; legacy Dockerfiles preserved as Dockerfile.legacy for reference but excluded from build context via .dockerignore. - docker-compose.dev.yml + docker-compose.yml: build context now ".", dockerfile pointing to the root files. Code adjustments forced by the move - Every "from config|database|models|schemas|services|routers|middleware import ..." rewritten to its src.backend.* equivalent (50+ files including indented inline imports inside test bodies). - src/backend/migrations/env.py: insert project root into sys.path so alembic can resolve src.backend.* imports regardless of cwd. - src/backend/config.py: env_file ../../.env (was ../.env), upload_path resolves project root via parents[2]. - src/backend/tests/conftest.py + tests: import ... from src.backend.* instead of bare names; old per-directory pytest.ini files removed in favor of root pyproject.toml [tool.pytest.ini_options]. - .gitignore: uploads/ at root, src/frontend/flask_app/static/css/ tailwind.css path; .dockerignore tightened. - CLAUDE.md: rewrote sections "Layout del repository", "Comandi di Sviluppo", "Database & Migrations", "Test", "i18n", and all path references throughout the architecture sections. Verified - uv lock resolves 77 packages; uv sync --extra server --extra client --extra dev installs cleanly. - uv run pytest: 171 passed, 4 pre-existing failures. - uv run alembic -c src/backend/migrations/alembic.ini check loads config and metadata (errors only on the absent local MySQL). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,161 @@
|
||||
"""Security integration tests for FastAPI server.
|
||||
|
||||
Covers CORS, rate limiting, security headers, API key auth,
|
||||
path traversal protection, filename sanitization, and OPTIONS preflight.
|
||||
"""
|
||||
import time
|
||||
from unittest.mock import patch
|
||||
|
||||
import pytest
|
||||
from httpx import AsyncClient
|
||||
|
||||
from src.backend.tests.conftest import _create_user, auth_headers
|
||||
|
||||
|
||||
class TestCORSHeaders:
|
||||
"""CORS header tests."""
|
||||
|
||||
async def test_cors_headers_present(self, client: AsyncClient):
|
||||
"""Response includes CORS headers for allowed origin."""
|
||||
resp = await client.get(
|
||||
"/api/health",
|
||||
headers={"Origin": "http://localhost:5000"},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert "access-control-allow-origin" in resp.headers
|
||||
|
||||
|
||||
class TestSecurityHeaders:
|
||||
"""Security header tests."""
|
||||
|
||||
async def test_security_headers_present(self, client: AsyncClient):
|
||||
"""Response includes all standard security headers."""
|
||||
resp = await client.get("/api/health")
|
||||
assert resp.status_code == 200
|
||||
assert resp.headers.get("x-content-type-options") == "nosniff"
|
||||
assert resp.headers.get("x-frame-options") == "DENY"
|
||||
assert resp.headers.get("x-xss-protection") == "1; mode=block"
|
||||
assert "strict-origin" in resp.headers.get("referrer-policy", "")
|
||||
assert "default-src" in resp.headers.get("content-security-policy", "")
|
||||
|
||||
|
||||
class TestAPIKeyAuth:
|
||||
"""API key authentication tests."""
|
||||
|
||||
async def test_protected_endpoint_requires_api_key(self, client: AsyncClient):
|
||||
"""Protected endpoint returns 401 without API key."""
|
||||
resp = await client.get("/api/users")
|
||||
assert resp.status_code == 401
|
||||
detail = resp.json().get("detail", "")
|
||||
assert "API key" in detail or "Missing" in detail
|
||||
|
||||
async def test_invalid_api_key_returns_401(self, client: AsyncClient):
|
||||
"""Invalid API key returns 401."""
|
||||
resp = await client.get(
|
||||
"/api/users",
|
||||
headers={"X-API-Key": "totally-invalid-key-12345"},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
detail = resp.json().get("detail", "")
|
||||
assert "Invalid" in detail or "inactive" in detail
|
||||
|
||||
|
||||
class TestRateLimiting:
|
||||
"""Rate limiting tests."""
|
||||
|
||||
async def test_login_rate_limit_returns_429(self, client: AsyncClient, db_session):
|
||||
"""Exceeding login rate limit returns 429."""
|
||||
# Default rate_limit_login = 5 per minute
|
||||
# Send 6 requests to exceed the limit
|
||||
for i in range(6):
|
||||
resp = await client.post(
|
||||
"/api/auth/login",
|
||||
json={"username": f"user{i}", "password": "pass"},
|
||||
)
|
||||
|
||||
# The 6th request (or beyond) should be rate limited
|
||||
# Send one more to be sure
|
||||
resp = await client.post(
|
||||
"/api/auth/login",
|
||||
json={"username": "overflow", "password": "pass"},
|
||||
)
|
||||
assert resp.status_code == 429
|
||||
assert "Too many" in resp.json().get("detail", "")
|
||||
|
||||
async def test_rate_limit_retry_after_header(self, client: AsyncClient):
|
||||
"""429 response includes Retry-After header."""
|
||||
# Exhaust login rate limit
|
||||
for i in range(7):
|
||||
resp = await client.post(
|
||||
"/api/auth/login",
|
||||
json={"username": f"retry{i}", "password": "pass"},
|
||||
)
|
||||
|
||||
# Final request should be 429 with Retry-After
|
||||
resp = await client.post(
|
||||
"/api/auth/login",
|
||||
json={"username": "retrycheck", "password": "pass"},
|
||||
)
|
||||
assert resp.status_code == 429
|
||||
assert "retry-after" in resp.headers
|
||||
retry_val = int(resp.headers["retry-after"])
|
||||
assert retry_val >= 1
|
||||
|
||||
|
||||
class TestPathTraversal:
|
||||
"""Path traversal protection in file endpoints."""
|
||||
|
||||
async def test_path_traversal_blocked(self, client: AsyncClient, db_session):
|
||||
"""Path traversal in file endpoint is blocked (403 or 404)."""
|
||||
user = await _create_user(
|
||||
db_session,
|
||||
username="fileuser",
|
||||
roles=["Maker", "MeasurementTec"],
|
||||
)
|
||||
|
||||
resp = await client.get(
|
||||
"/api/files/../../etc/passwd",
|
||||
headers=auth_headers(user),
|
||||
)
|
||||
# Should be 403 (access denied) or 404 (not found), never 200
|
||||
assert resp.status_code in (403, 404)
|
||||
|
||||
|
||||
class TestFilenameSanitization:
|
||||
"""Filename sanitization tests."""
|
||||
|
||||
async def test_dotfile_rejected(self, client: AsyncClient, db_session):
|
||||
"""Filenames starting with '.' are rejected."""
|
||||
from src.backend.api.routers.files import sanitize_filename
|
||||
from fastapi import HTTPException
|
||||
|
||||
with pytest.raises(HTTPException) as exc_info:
|
||||
sanitize_filename(".htaccess")
|
||||
assert exc_info.value.status_code == 400
|
||||
assert "." in exc_info.value.detail
|
||||
|
||||
async def test_empty_filename_rejected(self, client: AsyncClient, db_session):
|
||||
"""Empty filenames are rejected."""
|
||||
from src.backend.api.routers.files import sanitize_filename
|
||||
from fastapi import HTTPException
|
||||
|
||||
with pytest.raises(HTTPException) as exc_info:
|
||||
sanitize_filename("///")
|
||||
assert exc_info.value.status_code == 400
|
||||
|
||||
|
||||
class TestOptionsPreflight:
|
||||
"""OPTIONS preflight request tests."""
|
||||
|
||||
async def test_options_preflight(self, client: AsyncClient):
|
||||
"""OPTIONS request returns CORS preflight headers."""
|
||||
resp = await client.options(
|
||||
"/api/health",
|
||||
headers={
|
||||
"Origin": "http://localhost:5000",
|
||||
"Access-Control-Request-Method": "GET",
|
||||
"Access-Control-Request-Headers": "X-API-Key",
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert "access-control-allow-methods" in resp.headers
|
||||
Reference in New Issue
Block a user