StormRunner06106
6e3779e500
Dropbox file IDs are saved with the article in Supabase. Banners appear in thumbnails and behind the article title/subtitle. Additional images and files appear below the article text.
90 lines
4.1 KiB
Python
90 lines
4.1 KiB
Python
"""OAuth setup must not persist a grant that cannot support article media."""
|
|
import io
|
|
import tempfile
|
|
import unittest
|
|
from contextlib import ExitStack, redirect_stdout
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
from unittest.mock import patch
|
|
from urllib.parse import parse_qs, urlparse
|
|
|
|
from dotenv import dotenv_values
|
|
from dropbox import DropboxOAuth2FlowNoRedirect
|
|
|
|
from backend import connect_dropbox
|
|
|
|
|
|
class DropboxSetupTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.stack = ExitStack()
|
|
self.addCleanup(self.stack.close)
|
|
folder = Path(self.stack.enter_context(tempfile.TemporaryDirectory()))
|
|
self.env = folder / ".env"
|
|
self.env.write_text(
|
|
"DROPBOX_APP_KEY=file-key\nDROPBOX_APP_SECRET=file-secret\n"
|
|
"DROPBOX_REFRESH_TOKEN=existing-token\n", encoding="utf-8"
|
|
)
|
|
self.stack.enter_context(patch.object(connect_dropbox, "__file__", str(folder / "connect_dropbox.py")))
|
|
self.stack.enter_context(patch.dict("os.environ", {
|
|
"DROPBOX_APP_KEY": "stale-shell-key", "DROPBOX_APP_SECRET": "stale-shell-secret"
|
|
}))
|
|
self.stack.enter_context(patch.object(connect_dropbox.getpass, "getpass", return_value="auth-code"))
|
|
self.browser = self.stack.enter_context(patch.object(connect_dropbox.webbrowser, "open"))
|
|
self.output = self.stack.enter_context(redirect_stdout(io.StringIO()))
|
|
# Exercise real SDK URL generation, but never exchange a real code.
|
|
self.finish = self.stack.enter_context(patch.object(DropboxOAuth2FlowNoRedirect, "finish"))
|
|
self.finish.return_value = SimpleNamespace(
|
|
refresh_token="new-token", scope=["files.content.read", "files.content.write"]
|
|
)
|
|
|
|
def test_opens_default_permissions_offline_url_for_env_file_app(self):
|
|
connect_dropbox.main()
|
|
url = urlparse(self.browser.call_args.args[0])
|
|
self.assertEqual(url.hostname, "www.dropbox.com")
|
|
self.assertEqual(parse_qs(url.query), {
|
|
"client_id": ["file-key"], "response_type": ["code"], "token_access_type": ["offline"]
|
|
})
|
|
settings = dotenv_values(self.env)
|
|
self.assertEqual(settings["DROPBOX_REFRESH_TOKEN"], "new-token")
|
|
self.assertEqual(settings["JOURNAL_MEDIA_STORAGE"], "dropbox")
|
|
for secret in ("new-token", "existing-token", "file-secret", "auth-code"):
|
|
self.assertNotIn(secret, self.output.getvalue())
|
|
|
|
def test_missing_permissions_preserves_existing_credentials(self):
|
|
original = self.env.read_bytes()
|
|
self.finish.return_value.scope = ["account_info.read"]
|
|
with self.assertRaisesRegex(SystemExit, "files.content.read, files.content.write"):
|
|
connect_dropbox.main()
|
|
self.assertEqual(self.env.read_bytes(), original)
|
|
|
|
def test_unknown_permissions_preserves_existing_credentials(self):
|
|
original = self.env.read_bytes()
|
|
self.finish.return_value.scope = None
|
|
with self.assertRaisesRegex(SystemExit, "did not grant"):
|
|
connect_dropbox.main()
|
|
self.assertEqual(self.env.read_bytes(), original)
|
|
|
|
def test_string_scopes_are_accepted(self):
|
|
self.finish.return_value.scope = "files.content.read files.content.write"
|
|
connect_dropbox.main()
|
|
self.assertEqual(dotenv_values(self.env)["DROPBOX_REFRESH_TOKEN"], "new-token")
|
|
|
|
def test_exchange_failure_does_not_print_secret_or_overwrite_token(self):
|
|
original = self.env.read_bytes()
|
|
self.finish.side_effect = RuntimeError("sensitive-response-token")
|
|
with self.assertRaises(SystemExit) as error:
|
|
connect_dropbox.main()
|
|
self.assertNotIn("sensitive-response-token", str(error.exception))
|
|
self.assertEqual(self.env.read_bytes(), original)
|
|
|
|
def test_missing_refresh_token_preserves_existing_credentials(self):
|
|
original = self.env.read_bytes()
|
|
self.finish.return_value.refresh_token = None
|
|
with self.assertRaisesRegex(SystemExit, "did not issue a refresh token"):
|
|
connect_dropbox.main()
|
|
self.assertEqual(self.env.read_bytes(), original)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|