87 lines
3.0 KiB
Python
87 lines
3.0 KiB
Python
"""CORS preflight + response headers for moz-extension:// + chrome-extension://.
|
|
|
|
Operator-flagged 2026-05-26: extension's first 'Test connection' tap
|
|
returned `NetworkError` because /api/credentials had no OPTIONS handler
|
|
and no Access-Control-Allow-Origin response header. Browser preflight
|
|
failed → fetch blocked.
|
|
|
|
These tests pin the contract: any request from a moz-extension:// or
|
|
chrome-extension:// origin gets the right ACL headers. Plain browser
|
|
requests (no Origin header, or a regular https:// Origin) get nothing
|
|
— we don't want to open CORS up generally.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
from backend.app import create_app
|
|
|
|
pytestmark = pytest.mark.integration
|
|
|
|
|
|
@pytest.fixture
|
|
async def client():
|
|
app = create_app()
|
|
async with app.test_client() as c:
|
|
yield c
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_extension_preflight_returns_204_with_acl_headers(client):
|
|
resp = await client.options(
|
|
"/api/credentials",
|
|
headers={
|
|
"Origin": "moz-extension://abcd1234-uuid-fake",
|
|
"Access-Control-Request-Method": "GET",
|
|
"Access-Control-Request-Headers": "X-Extension-Key",
|
|
},
|
|
)
|
|
assert resp.status_code == 204
|
|
assert resp.headers["Access-Control-Allow-Origin"] == "moz-extension://abcd1234-uuid-fake"
|
|
assert "OPTIONS" in resp.headers["Access-Control-Allow-Methods"]
|
|
assert "X-Extension-Key" in resp.headers["Access-Control-Allow-Headers"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_extension_get_carries_acl_headers(client):
|
|
# The actual response (post-preflight) also needs ACL headers — the
|
|
# browser checks them again before exposing the response body.
|
|
resp = await client.get(
|
|
"/api/credentials",
|
|
headers={"Origin": "moz-extension://abcd1234-uuid-fake"},
|
|
)
|
|
# 200 with empty list (no creds seeded) — what matters here is the
|
|
# CORS header is present.
|
|
assert resp.headers["Access-Control-Allow-Origin"] == "moz-extension://abcd1234-uuid-fake"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_chrome_extension_origin_also_allowed(client):
|
|
resp = await client.options(
|
|
"/api/credentials",
|
|
headers={
|
|
"Origin": "chrome-extension://abcd1234-uuid-fake",
|
|
"Access-Control-Request-Method": "POST",
|
|
},
|
|
)
|
|
assert resp.status_code == 204
|
|
assert resp.headers["Access-Control-Allow-Origin"] == "chrome-extension://abcd1234-uuid-fake"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_normal_browser_request_gets_no_cors_headers(client):
|
|
# A regular browser tab (https://example.com / file:// / no Origin
|
|
# at all) should NOT get any Access-Control-Allow-* — the extension
|
|
# whitelist is intentionally narrow.
|
|
resp = await client.get(
|
|
"/api/credentials",
|
|
headers={"Origin": "https://evil.example.com"},
|
|
)
|
|
assert "Access-Control-Allow-Origin" not in resp.headers
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_no_origin_header_unaffected(client):
|
|
# Same-origin requests (no Origin header) — unaffected.
|
|
resp = await client.get("/api/credentials")
|
|
assert "Access-Control-Allow-Origin" not in resp.headers
|