36 lines
1.3 KiB
Python
36 lines
1.3 KiB
Python
from __future__ import annotations
|
|
|
|
|
|
def _login(client, email: str, password: str) -> dict[str, str]:
|
|
response = client.post("/api/v1/auth/login", json={"email": email, "password": password})
|
|
assert response.status_code == 200
|
|
return {"Authorization": f"Bearer {response.json()['access_token']}"}
|
|
|
|
|
|
def test_superuser_can_read_install_secrets(client):
|
|
headers = _login(client, "admin@compton.example", "Admin1234")
|
|
response = client.get("/api/v1/admin/secrets", headers=headers)
|
|
assert response.status_code == 200
|
|
payload = response.json()
|
|
assert "secrets_status" in payload
|
|
assert payload["secrets_status"]["postgres_password"] in {"configured", "missing"}
|
|
assert "POSTGRES_PASSWORD" not in str(payload)
|
|
|
|
|
|
def test_non_superuser_cannot_read_install_secrets(client):
|
|
headers = _login(client, "ops@compton.example", "OpsAdmin1234")
|
|
response = client.get("/api/v1/admin/secrets", headers=headers)
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_superuser_can_reveal_db_password(client):
|
|
headers = _login(client, "admin@compton.example", "Admin1234")
|
|
response = client.post(
|
|
"/api/v1/admin/secrets/reveal",
|
|
headers=headers,
|
|
json={"key": "database_password"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["key"] == "database_password"
|
|
assert "value" in response.json()
|