5c6a2e78cf
Register all active platform services and base features in core DB so admin can manage them, add delivery/hospitality/sports-center backend phases, update apps catalog and production deploy tooling. Co-authored-by: Cursor <cursoragent@cursor.com>
42 lines
1.3 KiB
Python
42 lines
1.3 KiB
Python
"""Security validation — anonymous denial when auth required."""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
import pytest
|
|
from httpx import ASGITransport, AsyncClient
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_auth_required_denies_anonymous(db_setup):
|
|
os.environ["AUTH_REQUIRED"] = "true"
|
|
from app.core.config import get_settings
|
|
|
|
get_settings.cache_clear()
|
|
# Re-import settings binding used by security
|
|
import app.core.config as config_mod
|
|
import app.core.security as security_mod
|
|
import app.api.permissions as perm_mod
|
|
|
|
config_mod.settings = get_settings()
|
|
security_mod.settings = config_mod.settings
|
|
perm_mod.settings = config_mod.settings
|
|
|
|
from app.main import create_app
|
|
|
|
app = create_app()
|
|
transport = ASGITransport(app=app)
|
|
try:
|
|
async with AsyncClient(transport=transport, base_url="http://testserver") as client:
|
|
res = await client.get(
|
|
"/api/v1/organizations",
|
|
headers={"X-Tenant-ID": "11111111-1111-1111-1111-111111111111"},
|
|
)
|
|
assert res.status_code == 401
|
|
finally:
|
|
os.environ["AUTH_REQUIRED"] = "false"
|
|
get_settings.cache_clear()
|
|
config_mod.settings = get_settings()
|
|
security_mod.settings = config_mod.settings
|
|
perm_mod.settings = config_mod.settings
|