Codex Release Bot
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
"""Regression tests for external attack-surface hardening (BL-01–BL-04)."""
|
||
|
||
import pytest
|
||
|
||
|
||
class TestPublicPathMatching:
|
||
def test_health_detail_not_public(self):
|
||
from server.api.auth_jwt import _is_public_path
|
||
|
||
assert _is_public_path("/health") is True
|
||
assert _is_public_path("/health/detail") is False
|
||
|
||
def test_bing_wallpapers_get_public_post_sync_protected(self):
|
||
from server.api.auth_jwt import _is_public_path
|
||
|
||
assert _is_public_path("/api/settings/bing-wallpapers", "GET") is True
|
||
assert _is_public_path("/api/settings/bing-wallpaper", "GET") is True
|
||
assert _is_public_path("/api/settings/bing-wallpapers/sync", "POST") is False
|
||
|
||
def test_openapi_docs_off_by_default(self):
|
||
from server.api.auth_jwt import _is_public_path
|
||
|
||
assert _is_public_path("/openapi.json") is False
|
||
assert _is_public_path("/docs") is False
|
||
assert _is_public_path("/redoc") is False
|
||
|
||
def test_agent_install_ws_prefixes_still_public(self):
|
||
from server.api.auth_jwt import _is_public_path
|
||
|
||
assert _is_public_path("/api/agent/heartbeat") is True
|
||
assert _is_public_path("/api/install/status") is True
|
||
assert _is_public_path("/ws/alerts") is True
|
||
|