bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
67 lines
2.3 KiB
Python
67 lines
2.3 KiB
Python
import pytest
|
|
import bcrypt
|
|
from unittest.mock import AsyncMock, patch
|
|
from steward.models.users import User, UserRole
|
|
|
|
|
|
def make_user(role=UserRole.admin):
|
|
return User(
|
|
id="test-id",
|
|
username="admin",
|
|
email="admin@example.com",
|
|
password_hash=bcrypt.hashpw(b"password", bcrypt.gensalt()).decode(),
|
|
role=role,
|
|
is_active=True,
|
|
)
|
|
|
|
|
|
async def with_csrf(client) -> dict:
|
|
"""Seed the session's forged-request token; returns the header to send."""
|
|
async with client.session_transaction() as sess:
|
|
sess["_csrf"] = "test-token"
|
|
return {"X-CSRF-Token": "test-token"}
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_page_returns_200(client):
|
|
response = await client.get("/login")
|
|
assert response.status_code == 200
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_redirects_to_setup_when_no_users(client, app):
|
|
with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=0)):
|
|
response = await client.get("/login")
|
|
assert response.status_code == 302
|
|
assert "/setup" in response.headers["Location"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_success_redirects_to_dashboard(client, app):
|
|
user = make_user()
|
|
headers = await with_csrf(client)
|
|
with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
|
|
patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
|
|
response = await client.post("/login", form={"username": "admin", "password": "password"},
|
|
headers=headers)
|
|
assert response.status_code == 302
|
|
assert "/" in response.headers["Location"]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_login_failure_returns_400(client, app):
|
|
user = make_user()
|
|
headers = await with_csrf(client)
|
|
with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
|
|
patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
|
|
response = await client.post("/login", form={"username": "admin", "password": "wrong"},
|
|
headers=headers)
|
|
assert response.status_code == 400
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_require_role_redirects_unauthenticated(client):
|
|
response = await client.get("/")
|
|
assert response.status_code == 302
|
|
assert "/login" in response.headers["Location"]
|