Ruben/Onyscribe-Admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sicherheit: Live-Aktionen nur mit aktivem Login; Seitenleiste warnt rot bei ausgeschaltetem Login

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
RubenRWU
2026-10-15 15:57:27 +02:00
parent e663b007d4
commit 8c3795ec8c
7 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tests/conftest.py
View File

@@ -2,7 +2,8 @@
import os
import tempfile
os.environ["ONYSCRIBE_SKIP_DOTENV"] = "1" # .env nicht einlesen
os.environ["ONYSCRIBE_SKIP_DOTENV"] = "1"
os.environ["ALLOW_NO_AUTH_LIVE"] = "true" # Tests laufen ohne Login; der Guard wird separat getestet # .env nicht einlesen
for var in ("CORTECS_API_KEY", "ONYVA_LOGIN_API_KEY", "MITTWALD_API_TOKEN", "MITTWALD_API_BASE", "DEPLOY_LIVE", "OIDC_SYNC_LIVE",
"AUTH_ENABLED", "OIDC_CLIENT_ID", "OIDC_CLIENT_SECRET", "OIDC_REDIRECT_URI", "OIDC_LOGOUT_REDIRECT_URI", "OIDC_ISSUER",
"ADMIN_ALLOWED_EMAILS", "DEPLOY_ALLOWED_TENANTS", "CORE_RELEASE_TOKEN", "ADMIN_REQUIRED_ROLE", "SECRET_KEY", "APP_COOKIE_SECURE"):

14
tests/test_core_contract.py
View File

@@ -441,3 +441,17 @@ def test_live_deploy_requires_admin_public_url_for_admin_source(client, live_env
d = client.get(f"/api/deployments/{deploy.start('pf2', 'deploy', 't', http=FakeMW(), health=lambda *a: None, wait=True)}").json()
assert d["status"] == "failed" and "Öffentliche URL der Admin-Plattform" in d["log"]
assert client.get("/api/tenants/pf2/preflight").status_code == 200
def test_live_actions_are_locked_without_login(client, monkeypatch):
"""Ohne aktiven Login der Admin-Plattform bleibt alles im Dry-Run – auch mit DEPLOY_LIVE=true / OIDC_SYNC_LIVE=true."""
from app.services import onyva_login
monkeypatch.setenv("DEPLOY_LIVE", "true")
monkeypatch.setenv("OIDC_SYNC_LIVE", "true")
monkeypatch.setenv("DEPLOY_ALLOWED_TENANTS", "*")
assert deploy.live_enabled() and onyva_login.writes_allowed()
monkeypatch.delenv("ALLOW_NO_AUTH_LIVE") # kein Login, keine Ausnahme
assert not deploy.live_enabled() and not onyva_login.writes_allowed()
assert client.post("/api/tenants/sprinz/deploy", json={"dry_run": False}).status_code == 403
assert client.post("/api/tenants/sprinz/oidc/sync", json={"apply": True}).status_code == 403
assert client.get("/api/deploy/mode").json()["live"] is False