peter/siftlode
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(auth)!: remove the public access-request endpoint

Browse Source 
POST /auth/request-access had no caller left: the login page's form was
gone, and registration and a refused Google sign-in already land in the
same admin approval. A third public write path with no protection of
its own (owner decision, E34).

Its one guard moves to where every path passes: upsert_pending_invite no
longer opens a pending row for an address the env already lets in. The
registration path lacked it — registering b.ob@gmail.com beside an
env-granted bob@gmail.com opened a pending row, and is_allowed answers
from the invite rows once any exist, so the real owner was locked out.
The tests that drove the endpoint now drive registration or the shared
function.
This commit is contained in:
peter
2026-10-05 00:19:19 +02:00
parent a499f00209
commit 7f08c510bf
5 changed files with 39 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_mail_language.py
+17 -42
View File
@@ -131,6 +131,12 @@ def test_the_lookup_is_canonical_like_every_other_identity_match(db, make_user):
# --- capturing the signal at the one moment it exists ---------------------------------------------
def _ask(db, lang: str) -> None:
"""A pending request carrying the language it was made in — what a refused Google sign-in records
(with the locale Google reported), through the one function every entry point shares."""
auth_routes.upsert_pending_invite(db, "asking@example.com", lang)
def test_registration_records_the_language_of_the_sign_up_page(db, client):
r = client.post(
"/auth/register", json={"email": "signup@example.com", "password": _PW, "lang": "hu"}
@@ -141,31 +147,16 @@ def test_registration_records_the_language_of_the_sign_up_page(db, client):
assert (user.preferences or {}).get("language") == "hu"
def test_an_access_request_records_the_language_it_was_made_in(db, client):
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
).status_code
== 200
)
def test_an_access_request_records_the_language_it_was_made_in(db):
_ask(db, "hu")
inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
assert inv.lang == "hu"
def test_asking_again_from_another_language_updates_the_row(db, client):
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "en"}
).status_code
== 200
)
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
).status_code
== 200
)
def test_asking_again_from_another_language_updates_the_row(db):
_ask(db, "en")
_ask(db, "hu")
db.expire_all()
inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
@@ -174,13 +165,8 @@ def test_asking_again_from_another_language_updates_the_row(db, client):
assert db.execute(select(Invite)).scalars().all() == [inv]
def test_an_unsupported_language_is_ignored_rather_than_stored(db, client):
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "../../etc"}
).status_code
== 200
)
def test_an_unsupported_language_is_ignored_rather_than_stored(db):
_ask(db, "../../etc")
inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
assert inv.lang is None
@@ -222,21 +208,15 @@ def test_the_confirmation_mail_is_written_in_the_accounts_language(db, client, m
def test_the_approval_mail_answers_in_the_language_the_request_was_made_in(
db, client, make_user, as_user, monkeypatch
db, make_user, as_user, monkeypatch
):
from app import email as email_mod
monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
sent = _bodies(monkeypatch)
admin = make_user(email="admin@example.com", role="admin")
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
).status_code
== 200
)
_ask(db, "hu")
inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
sent.clear() # drop the admin notification; this test is about the reply to the requester
r = as_user(admin).post(f"/api/admin/invites/{inv.id}/approve")
@@ -246,18 +226,13 @@ def test_the_approval_mail_answers_in_the_language_the_request_was_made_in(
assert subject == mailtext.MAIL_TEXT["access_approved.subject"]["hu"]
def test_a_denial_answers_in_that_language_too(db, client, make_user, as_user, monkeypatch):
def test_a_denial_answers_in_that_language_too(db, make_user, as_user, monkeypatch):
from app import email as email_mod
monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
sent = _bodies(monkeypatch)
admin = make_user(email="admin@example.com", role="admin")
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
).status_code
== 200
)
_ask(db, "hu")
inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
sent.clear()
backend/tests/test_review_round.py
+9 -14
View File
@@ -175,7 +175,7 @@ def test_a_stripped_account_keeps_its_recovery_stamp(db, client, smtp_on, make_u
assert row.password_hash is None and row.password_revoked_at is not None
def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db, client):
def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db):
# Canonical siblings exist on prod. Picking the denied one reopens it and re-notifies every
# admin, putting one person in the queue twice — and the exact-spelling tie-break made that
# deterministic rather than merely possible.
@@ -187,9 +187,7 @@ def test_a_denied_sibling_is_not_reopened_while_a_pending_row_exists(db, client)
)
db.commit()
assert (
client.post("/auth/request-access", json={"email": "pairone@gmail.com"}).status_code == 200
)
auth_routes.upsert_pending_invite(db, "pairone@gmail.com")
db.expire_all()
rows = {i.email: i.status for i in db.execute(select(Invite)).scalars().all()}
@@ -210,12 +208,13 @@ def test_the_env_allow_list_is_matched_canonically(db, monkeypatch):
def test_an_env_granted_address_cannot_be_shadowed_by_a_stranger(db, client, monkeypatch):
# `is_allowed` short-circuits on ANY invite row for the canonical form, so before this an
# unauthenticated caller could request access under a sibling spelling and permanently shadow an
# env grant. With the env list matched canonically the request never opens a row.
# `is_allowed` short-circuits on ANY invite row for the canonical form, so an unauthenticated
# caller registering under a sibling spelling would open a pending row and permanently shadow an
# env grant. The env list is matched canonically, so the registration never opens a row.
monkeypatch.setattr(settings, "allowed_emails", "bob@gmail.com")
assert client.post("/auth/request-access", json={"email": "b.ob@gmail.com"}).status_code == 200
r = client.post("/auth/register", json={"email": "b.ob@gmail.com", "password": _PW})
assert r.status_code == 200
assert db.execute(select(Invite)).scalars().all() == []
assert auth_core.is_allowed(db, "bob@gmail.com") is True
@@ -351,12 +350,8 @@ def test_two_admins_two_languages_two_mails(db, client, make_user, smtp_on, wire
make_user(email="hu.admin@example.com", role="admin", preferences={"language": "hu"})
make_user(email="en.admin@example.com", role="admin", preferences={"language": "en"})
assert (
client.post(
"/auth/request-access", json={"email": "asking@example.com", "lang": "en"}
).status_code
== 200
)
r = client.post("/auth/register", json={"email": "asking@example.com", "password": _PW})
assert r.status_code == 200
notices = [w for w in wire if "asking@example.com" in w[1]]
assert len(notices) == 2