peter
5883ea509d
A user can raise their diagnostics level to Részletes (DEBUG) or Teljes (TRACE) for 24 hours from a new Settings tab, after a consent box that says what is recorded, that the server keeps it and for how long (the instance's own retention), and that it lapses. Alap is the base and needs no consent. - users.diagnostics_level/_until (migration 0087), written only by PUT /api/me/diagnostics, which computes the expiry itself; the demo account cannot raise it. /api/me reports the level in force. - The server logs an elevated user's requests at that level and stores every line of them (logs.LevelGate on the stdout handler and the sink; the root is lowered only while an elevation is active). Teljes adds the redacted query string to the request line. - POST /api/diagnostics/events stores the browser's log as source=web rows: account from the session, body capped while streaming, events/attrs capped, re-redacted, events under the consented level dropped, timestamps clamped, 30 batches a minute, 409 once the level lapsed. - lib/diagnostics.ts applies the level to the tab and streams only what happens after consent, in batches, never its own request lines, with a keepalive flush on pagehide; stops on lapse (its own timer), on withdrawal and on 409. - Detail hooks at DEBUG: which control was clicked (test id, icon, app copy in English — never user text, input values or a link's query), visibility/bfcache/resize, filter changes (lib/filterLog.ts; typed search only at TRACE), player events (lib/mediaLog.ts; media errors are warnings at every level). Offline/online at the base level. - "Saját napló" viewer: live, newest first, level groups with counts, search, row details, copy the filtered events as JSON lines, clear. - Privacy policy and Terms exist in Hungarian and English (a contract test holds both languages to the same sections); the policy now describes the server logs and diagnostic logging, self-service deletion and password sign-in. Fixed on the way: - A sync auth dependency ran logs.set_user on a copied context, so the account never reached a handler's own log lines (measured); a per-request mutable scope carries it now. - The Settings tab rail left a phone no room (clipped labels, buttons over text): below `sm` it is a scrolling row above the content. - PUT /api/me/preferences took a bare dict body; it is a Pydantic model now.
93 lines
5.0 KiB
Python
93 lines
5.0 KiB
Python
"""The shared demo account's refusal says WHY, in the reader's language (deep-review round 6).
|
|
|
|
`require_human` answered `403 "Not available in the demo account."` — a plain string. `req` leaves
|
|
403 to the caller, and round 5 taught `notifyActionError` to discard a plain-string detail in favour
|
|
of the caller's already-translated fallback, so from that commit on the demo user got a generic
|
|
"couldn't do that" and no hint that the demo account was the reason. Not every affordance behind
|
|
this gate is UI-gated on `is_demo` either — the comfort shelf is not, so the pin button is live.
|
|
|
|
A structured `{code: "demo"}` is what `localizeDetail` can turn into `errors.demo` in both locales.
|
|
Pinned at every site: the shared dependency, the two auth routes that hand-roll the same check,
|
|
the account-delete route in `routes/me.py` — which round 6 missed while its docstring claimed
|
|
all the sites were covered, so the next reader had no reason to look (round 7). An asymmetric fix is
|
|
the smell this repo bans, and a docstring asserting symmetry it does not have is worse than none.
|
|
|
|
The list is derived from the source, not typed out: `test_every_is_demo_refusal_is_on_the_list`
|
|
below fails when a fifth `is_demo` 403 appears anywhere in `app/`, so this file cannot fall behind
|
|
the code the way round 6's did. (E22 S5 added the fifth: raising the diagnostics level.) Needs the DB.
|
|
"""
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
from app.models import User
|
|
|
|
|
|
def test_every_demo_refusal_carries_the_same_structured_reason(db, make_user, as_user):
|
|
demo = make_user(email="demo@example.com", is_demo=True)
|
|
client = as_user(demo)
|
|
for method, url, body in [
|
|
# `require_human` itself, through an affordance the UI does NOT gate on is_demo.
|
|
("post", "/api/discover/pins", {"kind": "video", "ref": "v1"}),
|
|
# The three routes that repeat the check inline rather than depending on the gate.
|
|
("post", "/auth/logout-others", None),
|
|
("post", "/auth/set-password", {"password": "a long enough password"}),
|
|
("delete", "/api/me/account", None),
|
|
# E22 S5: the shared account's log would interleave every visitor's session.
|
|
("put", "/api/me/diagnostics", {"level": "DEBUG"}),
|
|
]:
|
|
r = getattr(client, method)(url, **({"json": body} if body is not None else {}))
|
|
assert r.status_code == 403, (url, r.text)
|
|
detail = r.json()["detail"]
|
|
# Every one of them is a dict whose `code` the frontend can localize; the delete route adds
|
|
# a `reason` so its refusal can be worded specifically.
|
|
assert isinstance(detail, dict), (url, detail)
|
|
assert detail["code"] == "demo", (url, detail)
|
|
|
|
|
|
def test_every_is_demo_refusal_is_on_the_list():
|
|
"""A fifth site must not be able to appear unnoticed.
|
|
|
|
Round 6 converted three of four `is_demo` 403s and wrote a docstring saying it had converted
|
|
them all; the fourth kept answering a bare English string for another round because nothing
|
|
counted them. So count them here: every `is_demo`-guarded 403 in `app/` has to raise a
|
|
structured detail, and the number of them has to match what this file exercises."""
|
|
app_dir = Path(__file__).resolve().parents[1] / "app"
|
|
sites = []
|
|
for path in sorted(app_dir.rglob("*.py")):
|
|
lines = path.read_text(encoding="utf-8").splitlines()
|
|
for i, line in enumerate(lines):
|
|
# `if user.is_demo:` / `if u.is_demo and …:` — the hand-rolled gate, not the ORM
|
|
# filters (`User.is_demo.is_(False)`) and not the column definition.
|
|
if not re.search(r"^\s*if\s+\w+\.is_demo\b[^:]*:", line):
|
|
continue
|
|
block = "\n".join(lines[i : i + 6])
|
|
if "403" not in block:
|
|
continue
|
|
sites.append(f"{path.relative_to(app_dir)}:{i + 1}")
|
|
assert 'detail={"code": "demo"' in block, (
|
|
f"{path.relative_to(app_dir)}:{i + 1} refuses the demo account with an "
|
|
f"unstructured detail — the frontend cannot localize it:\n{block}"
|
|
)
|
|
# auth.py's shared gate + routes/auth.py's two + routes/me.py's delete and diagnostics level. A
|
|
# new one is welcome, but it has to be added to the loop above in the same commit.
|
|
assert len(sites) == 5, sites
|
|
|
|
|
|
def test_a_real_account_is_not_refused_by_the_gate(db, make_user, as_user):
|
|
"""The other half: the structured detail must not come from having broken the gate open the
|
|
other way. A non-demo account gets past `require_human` and fails (or succeeds) on its own
|
|
merits — anything but a 403 demo refusal."""
|
|
client = as_user(make_user(email="real@example.com"))
|
|
r = client.post("/auth/logout-others")
|
|
assert r.status_code == 200, r.text
|
|
assert not isinstance(r.json().get("detail"), dict)
|
|
|
|
|
|
def test_the_gate_reads_the_flag_and_not_the_email(db):
|
|
"""`is_demo` is a column, not a convention about the address — a real account that happens to
|
|
be called demo@ must not be refused."""
|
|
from app.auth import require_human
|
|
|
|
assert require_human(User(email="demo@example.com", is_demo=False)) is not None
|