mirror of
https://github.com/0xWheatyz/handler.git
synced 2026-08-30 08:06:25 +00:00
Claude
24e6cf5ca8
The Next.js export is a generated artifact and deliberately untracked
(82183d9 stopped tracking it; the Docker image builds it in its own
node stage), but three tests still asserted its presence — failing on
every fresh clone. They now skip with a clear reason when
src/handler/api/static/ was never built, and keep guarding any
environment that has it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01731mKtVzsfeT4Vi3TvkR48
123 lines
4.7 KiB
Python
123 lines
4.7 KiB
Python
"""Phase 3 UI serving: the bundled web UI (a Next.js static export) is served same-origin
|
|
and, critically, is *additive* — it must not shadow any existing API route, and both the
|
|
toggle (UI_ENABLED) and the optional CORS behave as documented. The frontend itself has no
|
|
test runner (by design) and is verified via the manual e2e walkthrough in docs/PLAN.md.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
_STATIC_DIR = Path(__file__).resolve().parents[1] / "src" / "handler" / "api" / "static"
|
|
|
|
# The export is a generated artifact and deliberately untracked (it caused guaranteed
|
|
# merge conflicts — see .gitignore): the Docker image builds it in its own node stage,
|
|
# and a source checkout only has it after `npm run export`. The serving tests still
|
|
# guard any environment that *has* the export; a fresh clone just skips them.
|
|
_needs_export = pytest.mark.skipif(
|
|
not (_STATIC_DIR / "index.html").is_file(),
|
|
reason="web UI export not built (frontend: npm run export); "
|
|
"generated artifact, untracked by design",
|
|
)
|
|
|
|
|
|
def _reset_caches() -> None:
|
|
from handler import config
|
|
from handler.db import engine
|
|
|
|
config.get_settings.cache_clear()
|
|
engine.get_engine.cache_clear()
|
|
|
|
|
|
def _fresh_client(monkeypatch, **overrides) -> TestClient:
|
|
"""Build an app after applying env overrides — the shared `client` fixture bakes in
|
|
defaults, so toggle tests need their own app constructed post-setenv."""
|
|
for key, value in overrides.items():
|
|
monkeypatch.setenv(key, value)
|
|
_reset_caches()
|
|
from handler.api.app import create_app
|
|
|
|
return TestClient(create_app())
|
|
|
|
|
|
# --- shell + assets are served, unauthenticated -------------------------------------
|
|
|
|
|
|
@_needs_export
|
|
def test_index_served_unauthenticated(client):
|
|
res = client.get("/") # no Authorization header
|
|
assert res.status_code == 200
|
|
assert res.headers["content-type"].startswith("text/html")
|
|
assert "<title>Handler" in res.text
|
|
# the shell must never inline data or a token
|
|
assert "Bearer" not in res.text
|
|
|
|
|
|
@_needs_export
|
|
def test_next_assets_served_unauthenticated(client):
|
|
# The export references its hashed bundles under /_next/. Discover one from the shell
|
|
# and confirm it's served same-origin without auth (filenames are content-hashed, so
|
|
# we can't hardcode a path).
|
|
index = client.get("/").text
|
|
asset = re.search(r"/_next/static/[^\"']+\.js", index)
|
|
assert asset, "index.html should reference a /_next/static JS bundle"
|
|
res = client.get(asset.group(0)) # no auth
|
|
assert res.status_code == 200
|
|
assert res.headers["content-type"].startswith(("application/javascript", "text/javascript"))
|
|
|
|
|
|
@_needs_export
|
|
def test_static_export_is_bundled():
|
|
# The built export ships inside the package tree so `pip install .` bundles it.
|
|
assert (_STATIC_DIR / "index.html").is_file()
|
|
assert (_STATIC_DIR / "_next").is_dir()
|
|
|
|
|
|
# --- the static surface must NOT shadow the API ------------------------------------
|
|
|
|
|
|
def test_api_routes_not_shadowed(client, auth):
|
|
# /health still open
|
|
assert client.get("/health").json() == {"status": "ok"}
|
|
# /projects still requires auth (the static mount didn't swallow it)
|
|
assert client.get("/projects").status_code == 401
|
|
res = client.get("/projects", headers=auth)
|
|
assert res.status_code == 200
|
|
assert res.json() == []
|
|
# The "/" static mount is a fallback, not a catch-all rewrite: a path with no matching
|
|
# file still 404s (it does not fall back to index.html), so the API contract is intact.
|
|
assert client.get("/does-not-exist").status_code == 404
|
|
|
|
|
|
# --- CORS: off by default, on when configured --------------------------------------
|
|
|
|
|
|
def test_cors_absent_by_default(client):
|
|
res = client.get("/health", headers={"Origin": "https://example.com"})
|
|
assert res.status_code == 200
|
|
assert "access-control-allow-origin" not in {k.lower() for k in res.headers}
|
|
|
|
|
|
def test_cors_present_when_configured(env, monkeypatch):
|
|
origin = "https://handler.example.ts.net"
|
|
client = _fresh_client(monkeypatch, CORS_ORIGINS=origin)
|
|
res = client.get("/health", headers={"Origin": origin})
|
|
assert res.status_code == 200
|
|
assert res.headers.get("access-control-allow-origin") == origin
|
|
|
|
|
|
# --- UI_ENABLED=false => headless, API intact --------------------------------------
|
|
|
|
|
|
def test_ui_disabled_serves_no_shell_but_api_works(env, monkeypatch, auth):
|
|
client = _fresh_client(monkeypatch, UI_ENABLED="false")
|
|
assert client.get("/").status_code == 404
|
|
assert client.get("/_next/static/anything.js").status_code == 404
|
|
# API is untouched
|
|
assert client.get("/health").status_code == 200
|
|
assert client.get("/projects", headers=auth).status_code == 200
|