Ruben/Onyscribe-Admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sicherheit: Live-Aktionen nur mit aktivem Login; Seitenleiste warnt rot bei ausgeschaltetem Login

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
RubenRWU
2026-10-15 15:57:27 +02:00
parent e663b007d4
commit 8c3795ec8c
7 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/test_core_contract.py
View File

@@ -441,3 +441,17 @@ def test_live_deploy_requires_admin_public_url_for_admin_source(client, live_env
d = client.get(f"/api/deployments/{deploy.start('pf2', 'deploy', 't', http=FakeMW(), health=lambda *a: None, wait=True)}").json()
assert d["status"] == "failed" and "Öffentliche URL der Admin-Plattform" in d["log"]
assert client.get("/api/tenants/pf2/preflight").status_code == 200
def test_live_actions_are_locked_without_login(client, monkeypatch):
"""Ohne aktiven Login der Admin-Plattform bleibt alles im Dry-Run – auch mit DEPLOY_LIVE=true / OIDC_SYNC_LIVE=true."""
from app.services import onyva_login
monkeypatch.setenv("DEPLOY_LIVE", "true")
monkeypatch.setenv("OIDC_SYNC_LIVE", "true")
monkeypatch.setenv("DEPLOY_ALLOWED_TENANTS", "*")
assert deploy.live_enabled() and onyva_login.writes_allowed()
monkeypatch.delenv("ALLOW_NO_AUTH_LIVE") # kein Login, keine Ausnahme
assert not deploy.live_enabled() and not onyva_login.writes_allowed()
assert client.post("/api/tenants/sprinz/deploy", json={"dry_run": False}).status_code == 403
assert client.post("/api/tenants/sprinz/oidc/sync", json={"apply": True}).status_code == 403
assert client.get("/api/deploy/mode").json()["live"] is False