gmao/tests/integration/test_request_security.py

"""Régressions sur les protections des requêtes qui écrivent."""
from app_new.config import DevelopmentConfig


def test_csrf_is_enabled_in_remote_development():
    assert DevelopmentConfig.WTF_CSRF_ENABLED is True


def test_login_post_without_csrf_is_rejected_when_enabled(client, app):
    previous = app.config["WTF_CSRF_ENABLED"]
    app.config["WTF_CSRF_ENABLED"] = True
    try:
        response = client.post("/auth/login", data={"username": "inconnu", "password": "inconnu"})
        assert response.status_code == 400
    finally:
        app.config["WTF_CSRF_ENABLED"] = previous


def test_mutating_routes_reject_get(client):
    # Le garde global deny-by-default traite d'abord l'anonyme : une route
    # privée redirige vers la connexion avant le contrôle de méthode HTTP.
    assert client.get("/equipments/1/status/hs").status_code == 302
    assert client.get("/pronote/sync-salles").status_code == 302
    assert client.get("/pronote/disconnect").status_code == 302
    assert client.get("/outlook/api/sync-folders/1").status_code == 302
    assert client.get("/outlook/api/sync-mails/1").status_code == 302
    assert client.get("/outlook/api/sync-attachments/inconnu").status_code == 302