1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
"""
Auth-flow integration tests for genenetwork2 protected endpoints.
Part 1 — Unauthenticated redirect checks:
GN2's @login_required decorator redirects unauthenticated requests to the
home page ("/"). These tests verify that all protected endpoints in the
metadata-edit blueprint enforce that guard. No credentials are required.
Part 2 — gn-auth contract tests (auth_flow, credentials required):
GN2 calls back to gn-auth's POST /auth/data/authorisation and
GET /auth/resource/system/roles per-request. These tests verify the
contracts that gn2 depends on.
Blueprint prefix: /datasets/ (registered in wqflask/__init__.py)
Run all:
pytest -m "gn2 and auth_flow"
Run unauthenticated only (no credentials needed):
pytest -m "gn2 and auth_flow" -k "unauthenticated"
"""
import pytest
pytestmark = [pytest.mark.gn2, pytest.mark.auth_flow]
# Known-good values reused from the smoke test suite.
_DATASET_ID = "HC_M2_0606_P"
_TRAIT_NAME = "1435395_s_at"
_RESOURCE_ID = "00000000-0000-0000-0000-000000000000" # arbitrary; rejected before DB lookup
_DIFF_NAME = "some-diff-name"
# ---------------------------------------------------------------------------
# Part 1: unauthenticated redirect — @login_required enforcement
# ---------------------------------------------------------------------------
def test_unauthenticated_display_phenotype_redirects(gn2_url, http):
"""GET /datasets/<dataset_id>/traits/<name> redirects to / without a session."""
resp = http.get(
f"{gn2_url}/datasets/{_DATASET_ID}/traits/{_TRAIT_NAME}",
timeout=30,
allow_redirects=False,
)
assert resp.status_code in (301, 302), (
f"Expected redirect for unauthenticated phenotype-display, "
f"got {resp.status_code}: {resp.text[:200]}"
)
def test_unauthenticated_update_phenotype_redirects(gn2_url, http):
"""POST /datasets/<dataset_id>/traits/<name> redirects to / without a session."""
resp = http.post(
f"{gn2_url}/datasets/{_DATASET_ID}/traits/{_TRAIT_NAME}",
data={},
timeout=30,
allow_redirects=False,
)
assert resp.status_code in (301, 302), (
f"Expected redirect for unauthenticated phenotype-update, "
f"got {resp.status_code}: {resp.text[:200]}"
)
def test_unauthenticated_list_diffs_redirects(gn2_url, http):
"""GET /datasets/diffs redirects to / without a session."""
resp = http.get(
f"{gn2_url}/datasets/diffs",
timeout=30,
allow_redirects=False,
)
assert resp.status_code in (301, 302), (
f"Expected redirect for unauthenticated diffs listing, "
f"got {resp.status_code}: {resp.text[:200]}"
)
def test_unauthenticated_show_diff_redirects(gn2_url, http):
"""GET /datasets/diffs/<name> redirects to / without a session."""
resp = http.get(
f"{gn2_url}/datasets/diffs/{_DIFF_NAME}",
timeout=30,
allow_redirects=False,
)
assert resp.status_code in (301, 302), (
f"Expected redirect for unauthenticated diff display, "
f"got {resp.status_code}: {resp.text[:200]}"
)
def test_unauthenticated_approve_diff_redirects(gn2_url, http):
"""POST /datasets/<resource_id>/diffs/<name>/approve redirects to / without a session."""
resp = http.post(
f"{gn2_url}/datasets/{_RESOURCE_ID}/diffs/{_DIFF_NAME}/approve",
data={},
timeout=30,
allow_redirects=False,
)
assert resp.status_code in (301, 302), (
f"Expected redirect for unauthenticated diff approval, "
f"got {resp.status_code}: {resp.text[:200]}"
)
def test_unauthenticated_reject_diff_redirects(gn2_url, http):
"""POST /datasets/<resource_id>/diffs/<name>/reject redirects to / without a session."""
resp = http.post(
f"{gn2_url}/datasets/{_RESOURCE_ID}/diffs/{_DIFF_NAME}/reject",
data={},
timeout=30,
allow_redirects=False,
)
assert resp.status_code in (301, 302), (
f"Expected redirect for unauthenticated diff rejection, "
f"got {resp.status_code}: {resp.text[:200]}"
)
|
