Agent Zero
7fbbe420bd
Check Cross-Plugin Imports / check (push) Has been cancelled
CRITICAL: - Fix SQL injection in prestart.sh (parameterized query) - Fix secret key validation (always validate, not just production) - Fix workspace model partial index bug (func.text -> text) - Fix HealthResponse schema (add checks field) - Fix Tenant import in permissions.py (NameError on every auth request) - Fix README tech stack (React instead of Alpine.js) - Delete broken test_cross_tenant_security_v2.py - Add fail-closed RLS migration 0084 (48 tenant tables) HIGH: - Add GeneralRateLimitMiddleware for all API routes - Add file type blocklist for DMS and attachment uploads - Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass - Fix CSRF bypass path matching (in -> endswith) - Add worker healthcheck in docker-compose.yml - Add ARQ max_tries=3 for job retries - Fix 28 bare pass in mail services (-> logger.debug) - Fix print() -> logger in main.py and ai_assistant - Fix duplicate email handling (catch IntegrityError -> 409) - Add session revocation (invalidate_all_user_sessions) - Add resource limits to all containers - Fix CORS default (localhost -> production domain) - Fix SameSite=Lax -> Strict - Fix Redis password visibility in healthcheck - Fix npm vulnerabilities (19 -> 9) - Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP) MEDIUM: - Localize ErrorBoundary to German - Wire Mail.tsx save/delete filter to API - Document system_notif plugin (no routes needed) - Fix datetime.utcnow() -> datetime.now(UTC) - Pin litellm version (>=1.0,<2.0) - Move CSRF token from sessionStorage to in-memory - Fix restore_backup error handling and transaction - Fix Dms.tsx useEffect cleanup - Add skip-to-content link for accessibility - Add selectinload imports to 3 services - Add .env.example missing variables - Fix AppShell/TopBar/Sidebar test mocks NEW TESTS: - test_guest_auth.py (6 tests) - test_user_service.py (8 tests) - test_backup_service.py (5 tests) NEW SCHEMAS: - saved_filter, saved_view, user_preference, workspace, entity_policy Tests: 22/22 PASSED
65 lines
2.4 KiB
Python
65 lines
2.4 KiB
Python
"""Tests for backup_service — backup creation, restore, data integrity.
|
|
|
|
Security-critical: Backup/restore must maintain tenant isolation.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
from httpx import AsyncClient
|
|
|
|
from tests.conftest import ORIGIN_HEADER, seed_tenant_and_users, login_client
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
class TestBackupService:
|
|
"""Backup service integration tests."""
|
|
|
|
async def test_backup_endpoint_requires_admin(self, client: AsyncClient, db_session):
|
|
"""Backup creation requires admin permissions."""
|
|
seed = await seed_tenant_and_users(db_session)
|
|
await login_client(client, "viewer@tenanta.com")
|
|
|
|
resp = await client.post("/api/v1/backups", json={}, headers=ORIGIN_HEADER)
|
|
assert resp.status_code == 403
|
|
|
|
async def test_backup_list_requires_auth(self, client: AsyncClient, db_session):
|
|
"""Backup list requires authentication."""
|
|
resp = await client.get("/api/v1/backups", headers=ORIGIN_HEADER)
|
|
assert resp.status_code == 401
|
|
|
|
async def test_backup_list_as_admin(self, client: AsyncClient, db_session):
|
|
"""Admin can list backups."""
|
|
seed = await seed_tenant_and_users(db_session)
|
|
await login_client(client, "admin@tenanta.com")
|
|
|
|
resp = await client.get("/api/v1/backups", headers=ORIGIN_HEADER)
|
|
# May be 200 (empty list) or 403 if no backup permission
|
|
assert resp.status_code in (200, 403)
|
|
|
|
async def test_backup_create_invalid_payload(self, client: AsyncClient, db_session):
|
|
"""Backup with invalid payload returns validation error."""
|
|
seed = await seed_tenant_and_users(db_session)
|
|
await login_client(client, "admin@tenanta.com")
|
|
|
|
resp = await client.post(
|
|
"/api/v1/backups",
|
|
json={"invalid_field": True},
|
|
headers=ORIGIN_HEADER,
|
|
)
|
|
# Should accept or reject based on schema
|
|
assert resp.status_code in (200, 201, 400, 422)
|
|
|
|
async def test_backup_delete_nonexistent(self, client: AsyncClient, db_session):
|
|
"""Deleting non-existent backup returns 404."""
|
|
seed = await seed_tenant_and_users(db_session)
|
|
await login_client(client, "admin@tenanta.com")
|
|
|
|
import uuid
|
|
fake_id = str(uuid.uuid4())
|
|
resp = await client.delete(
|
|
f"/api/v1/backups/{fake_id}",
|
|
headers=ORIGIN_HEADER,
|
|
)
|
|
assert resp.status_code in (404, 403, 400)
|