65 lines
3.1 KiB
Python
65 lines
3.1 KiB
Python
"""Offline owned exports; no Hermes/LiveKit/deployment calls."""
|
|
import pytest
|
|
from fastapi import FastAPI, HTTPException
|
|
from fastapi.testclient import TestClient
|
|
|
|
from control.accounts import Accounts
|
|
from control.app import Settings
|
|
from control.chat_exports import create_export_router, export_conversation
|
|
from control.chat_store import ChatStore
|
|
|
|
|
|
@pytest.fixture
|
|
def env(tmp_path):
|
|
accounts = Accounts(str(tmp_path / 'accounts.db'))
|
|
users = [accounts.create(name, name, 'user', 'correct-horse-password') for name in ('alice', 'bob')]
|
|
tokens = [accounts.issue_session(u['id'], 3600, u['password_hash'])[0] for u in users]
|
|
store = ChatStore(accounts)
|
|
conversation = store.create_conversation(users[0]['id'], title='Private')
|
|
store.add_message(users[0]['id'], conversation['id'], 'user', 'Original question')
|
|
store.add_message(users[0]['id'], conversation['id'], 'assistant', '<script>untrusted</script> [Source](https://example.test)')
|
|
app = FastAPI()
|
|
app.state.accounts = accounts
|
|
app.state.settings = Settings()
|
|
app.state.chat_store = store
|
|
app.include_router(create_export_router())
|
|
with TestClient(app) as client:
|
|
yield accounts, store, client, users, tokens, conversation
|
|
accounts.close()
|
|
|
|
|
|
def test_full_projection_and_safe_markdown(env):
|
|
accounts, store, client, users, tokens, conversation = env
|
|
headers = {'Authorization': 'Bearer ' + tokens[0]}
|
|
url = '/api/conversations/' + conversation['id'] + '/export'
|
|
response = client.get(url, headers=headers)
|
|
assert response.status_code == 200
|
|
document = response.json()
|
|
assert len(document['messages']) == 2
|
|
assert document['messages'][0]['content'] == 'Original question'
|
|
assert 'hermes_session_id' not in response.text
|
|
assert response.headers['cache-control'] == 'no-store'
|
|
assert response.headers['content-disposition'].startswith('attachment;')
|
|
markdown = client.get(url + '?format=markdown', headers=headers)
|
|
assert markdown.status_code == 200
|
|
assert markdown.headers['content-type'].startswith('text/plain')
|
|
assert '[Source](https://example.test)' in markdown.text
|
|
assert '<script>untrusted</script>' in markdown.text
|
|
assert client.get(url + '?format=html', headers=headers).status_code == 422
|
|
|
|
|
|
def test_owned_revoked_deleted_and_bounded(env):
|
|
accounts, store, client, users, tokens, conversation = env
|
|
url = '/api/conversations/' + conversation['id'] + '/export'
|
|
assert client.get(url).status_code == 401
|
|
assert client.get(url, headers={'Authorization': 'Bearer ' + tokens[1]}).status_code == 404
|
|
with pytest.raises(HTTPException) as error:
|
|
export_conversation(store, users[0]['id'], conversation['id'], byte_limit=4)
|
|
assert error.value.status_code == 413
|
|
accounts.revoke(tokens[0])
|
|
assert client.get(url, headers={'Authorization': 'Bearer ' + tokens[0]}).status_code == 401
|
|
store.delete_conversation(users[0]['id'], conversation['id'])
|
|
with pytest.raises(HTTPException) as error:
|
|
export_conversation(store, users[0]['id'], conversation['id'])
|
|
assert error.value.status_code == 404
|