stroblme
3758415f21
The enrolment exemption covered any *.local host, which mDNS answers with whoever claims it; it is now localhost, 127.0.0.0/8 and ::1. /docs, /redoc and openapi.json stay closed in production and otherwise answer only a loopback caller unless API_DOCS_ENABLED is set, which the dev compose does, so `fluksio serve --host 0.0.0.0` no longer hands the schema to the network.
30 lines
1.0 KiB
Python
30 lines
1.0 KiB
Python
"""The interactive schema: for this machine, or whoever API_DOCS_ENABLED names."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
from fluksio.core.config import settings
|
|
from fluksio.main import app
|
|
|
|
SCHEMA = f"{settings.API_V1_STR}/openapi.json"
|
|
|
|
|
|
def test_the_schema_is_served_only_on_this_machine_by_default(
|
|
client: TestClient,
|
|
) -> None:
|
|
"""`fluksio serve --host 0.0.0.0` keeps ENVIRONMENT=local, and the network."""
|
|
for path in (SCHEMA, "/docs", "/redoc"):
|
|
assert client.get(path).status_code == 404 # "testclient" is not loopback
|
|
|
|
here = TestClient(app, client=("127.0.0.1", 50000))
|
|
assert here.get(SCHEMA).status_code == 200
|
|
assert here.get("/docs").status_code == 200
|
|
|
|
# Through a proxy on this machine, the caller is what counts.
|
|
forwarded = {"x-forwarded-for": "203.0.113.7"}
|
|
assert here.get(SCHEMA, headers=forwarded).status_code == 404
|
|
|
|
with patch("fluksio.core.config.settings.API_DOCS_ENABLED", True):
|
|
assert client.get(SCHEMA).status_code == 200
|