74 lines
2.5 KiB
Python
74 lines
2.5 KiB
Python
import pytest
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.core.config import Settings
|
|
|
|
|
|
ALLOWED_ORIGINS = [
|
|
"https://next-demo.waternetwork.cn",
|
|
"http://192.168.1.133",
|
|
"https://192.168.1.133",
|
|
"http://192.168.1.110",
|
|
"https://192.168.1.110",
|
|
]
|
|
|
|
|
|
@pytest.mark.parametrize("origins", ["*", " *, http://localhost:5173", "http://localhost:5173,*"])
|
|
def test_wildcard_origins_are_rejected(origins: str):
|
|
with pytest.raises(ValueError, match="must list explicit origins"):
|
|
Settings(_env_file=None, CORS_ALLOWED_ORIGINS=origins).cors_allowed_origins
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"origin",
|
|
ALLOWED_ORIGINS + [
|
|
"http://192.168.1.114",
|
|
"http://192.168.1.133:5173",
|
|
"https://demo.waternetwork.cn",
|
|
"http://192.168.1.133.evil.example",
|
|
"null",
|
|
],
|
|
)
|
|
def test_explicit_origin_preflight(origin: str):
|
|
settings = Settings(_env_file=None, CORS_ALLOWED_ORIGINS=", ".join(ALLOWED_ORIGINS))
|
|
app = FastAPI()
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.cors_allowed_origins,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
with TestClient(app) as client:
|
|
response = client.options(
|
|
"/api/v1/projects",
|
|
headers={
|
|
"Origin": origin,
|
|
"Access-Control-Request-Method": "GET",
|
|
"Access-Control-Request-Headers": "authorization,x-project-id",
|
|
},
|
|
)
|
|
allowed = origin in ALLOWED_ORIGINS
|
|
assert response.status_code == (200 if allowed else 400)
|
|
assert response.headers.get("access-control-allow-origin") == (origin if allowed else None)
|
|
if allowed:
|
|
assert response.headers["access-control-allow-credentials"] == "true"
|
|
assert "authorization" in response.headers["access-control-allow-headers"]
|
|
|
|
|
|
def test_default_origins_are_explicit_local_sources(monkeypatch):
|
|
monkeypatch.delenv("CORS_ALLOWED_ORIGINS", raising=False)
|
|
settings = Settings(_env_file=None)
|
|
assert settings.cors_allowed_origins == [
|
|
"http://127.0.0.1:5173", "http://localhost:5173",
|
|
"http://127.0.0.1:15173", "http://localhost:15173",
|
|
]
|
|
|
|
|
|
def test_environment_controls_origins(monkeypatch):
|
|
monkeypatch.setenv("CORS_ALLOWED_ORIGINS", "http://192.168.1.133,https://192.168.1.110")
|
|
settings = Settings(_env_file=None)
|
|
assert settings.cors_allowed_origins == ["http://192.168.1.133", "https://192.168.1.110"]
|