64f3f8769f
All checks were successful
CI Trade-In / changes (pull_request) Successful in 11s
CI / changes (pull_request) Successful in 12s
CI Trade-In / frontend-checks (pull_request) Has been skipped
CI Trade-In / backend-tests (pull_request) Successful in 5m27s
CI / backend-tests (pull_request) Has been skipped
CI / frontend-tests (pull_request) Has been skipped
CI / openapi-codegen-check (pull_request) Has been skipped
test_rbac.py and test_internal_auth_secret.py each kept a hand-maintained
"MIRROR of app.main" copy of rbac_guard. The copies had already drifted:
test_rbac.py's copy was missing the #2213 X-Internal-Auth-Secret
defense-in-depth check entirely, so a regression in the real guard would not
have failed CI. Extracted rbac_guard (+ its constants) into app/core/rbac.py
(no DB/lifespan side effects) so app/main.py and both test files import and
exercise the exact same production code path instead of copies.
Verified the fix actually catches regressions: temporarily neutered the
secret-gate check in app/core/rbac.py, confirmed
test_internal_auth_secret.py went red (2 failures), then reverted — suite
back to green (31/31).
Also added tests/test_pdf_real_render.py: test_pdf_security.py stubs
WeasyPrint entirely, so it structurally cannot catch a real pagination
regression like the one just fixed in commit 42a50cf8 (extra trailing blank
5th page from the running @page header/footer). The new module renders the
REAL PDF via generate_trade_in_pdf and asserts the documented "4 pages, no
blank" invariant directly. It needs WeasyPrint's native Pango/cairo/GObject
libs (absent on this Windows sandbox and on ci-tradein.yml's bare
ubuntu-latest runner), so it self-skips via
pytest.skip(allow_module_level=True) wherever those aren't present, and runs
for real only where they are (e.g. `docker exec tradein-backend python -m
pytest -m pdf_render tests/test_pdf_real_render.py`) — see its docstring.
Existing mocked security tests are untouched (they check different things).
tests/conftest.py added (didn't exist before) to register the pdf_render
marker cleanly.
18 lines
688 B
Python
18 lines
688 B
Python
"""Repo-wide test config for tradein-mvp/backend.
|
|
|
|
Currently only registers custom pytest markers so they don't emit
|
|
PytestUnknownMarkWarning when used (`--strict-markers` is not enabled in
|
|
pyproject.toml, so an unregistered marker would only warn, not fail — this
|
|
just keeps output clean and documents intent in one place).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
|
|
def pytest_configure(config) -> None:
|
|
config.addinivalue_line(
|
|
"markers",
|
|
"pdf_render: real (non-mocked) WeasyPrint render — needs native "
|
|
"Pango/cairo/GObject libs, self-skips where unavailable (see "
|
|
"tests/test_pdf_real_render.py docstring for how to run it for real).",
|
|
)
|