from __future__ import annotations from pathlib import Path import inspect import pytest pytest.importorskip("flask") pytest.importorskip("werkzeug") from asadb_server.app import create_app from asadb_server import __version__ from asadb_server.auth import AuthManager from asadb_server.cli import first_run from asadb_server.config import Settings from asadb_server.registry import DatabaseRegistry from asadb_server import panel as panel_module def test_health_and_password_login(monkeypatch, tmp_path: Path): repo = tmp_path / "repo" (repo / "src").mkdir(parents=True) (repo / "web").mkdir() (repo / "src" / "asadb_web.pl").write_text("% fake", encoding="utf-8") (repo / "src" / "asadb.pl").write_text("% fake", encoding="utf-8") (repo / "web" / "index.html").write_text("panel", encoding="utf-8") (repo / "web" / "assets").mkdir() (repo / "web" / "assets" / "style.css").write_text(":root {}", encoding="utf-8") (repo / "web" / "assets" / "asadb-logo.png").write_bytes(b"png") monkeypatch.setenv("ASADB_REPO_ROOT", str(repo)) monkeypatch.setenv("ASADB_DATA_DIR", str(tmp_path / "data")) monkeypatch.setenv("ASADB_STATE_DIR", str(tmp_path / "state")) monkeypatch.setenv("ASADB_TEMP_DIR", str(tmp_path / "temp")) monkeypatch.setenv("ASADB_SECRET_KEY", "test-secret-key") monkeypatch.setenv("ASADB_CLUSTER_KEY", "test-cluster-key") monkeypatch.setenv("ASADB_ALLOW_LOCAL_ONLY", "true") app = create_app({"TESTING": True}) auth = app.extensions["asadb_auth"] auth.bootstrap_admin("admin", "very-secure-password") app.extensions["asadb_registry"].register("main", "data.asa") client = app.test_client() health = client.get("/api/v1/health") assert health.status_code == 200 health_body = health.get_json() assert health_body["service"] == "asadb-flask-server" assert health_body["version"] == __version__ assert health_body["engineVersion"] == __version__ readiness = client.get("/api/v1/readiness") assert readiness.status_code == 200 assert readiness.get_json()["ready"] is True login = client.post( "/api/v1/auth/login", json={"username": "admin", "password": "very-secure-password"}, ) assert login.status_code == 200 assert login.get_json()["user"]["username"] == "admin" metrics = client.get("/api/v1/metrics") assert metrics.status_code == 200 assert metrics.get_json()["databases"] == 1 user_id = login.get_json()["user"]["id"] session_record = app.extensions["asadb_sessions"].create(user_id, "main") logout = client.post("/api/v1/auth/logout") assert logout.status_code == 200 assert app.extensions["asadb_sessions"].store.read(session_record["id"]) is None # The browser flow is intentionally login-first. Server Workspace is the # safe backend default after credentials are accepted, and Local Workspace # is never a remote authentication bypass. browser_login = client.post( "/login", data={"username": "admin", "password": "very-secure-password"}, ) assert browser_login.status_code == 302 assert browser_login.headers["Location"].endswith("/") default_panel = client.get("/") assert default_panel.status_code == 200 assert b"Server Workspace" in default_panel.data mode_page = client.get("/mode") assert mode_page.status_code == 200 assert b"Local Workspace" in mode_page.data select_local = client.post("/mode", data={"mode": "local"}) assert select_local.status_code == 302 panel = client.get("/") assert panel.status_code == 200 assert b"Local Workspace" in panel.data assert b'
\n