peter
4aaaaa7860
The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").
Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.
Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).
One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.
100 lines
3.7 KiB
Python
100 lines
3.7 KiB
Python
"""`users.last_login_at`, DB-lane.
|
|
|
|
The roadmap assumed stamping it in `_establish_session` would cover Google and password alike. It
|
|
would not have: only password login called it, and the Google callback carried its own copy of the
|
|
same four lines. So these pin BOTH doors through the real routes — plus the one that must not stamp
|
|
(a refused password) and the admin list that shows it.
|
|
"""
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from app.config import settings
|
|
from app.routes import auth as auth_routes
|
|
|
|
_PW = "correct horse battery"
|
|
|
|
|
|
def _recent(ts: datetime | None) -> bool:
|
|
return ts is not None and datetime.now(timezone.utc) - ts < timedelta(minutes=1)
|
|
|
|
|
|
def test_a_password_sign_in_stamps_last_login(client, db, make_user):
|
|
user = make_user(email="pw@example.com", password=_PW)
|
|
assert user.last_login_at is None
|
|
|
|
r = client.post("/auth/password-login", json={"email": "pw@example.com", "password": _PW})
|
|
|
|
assert r.status_code == 200
|
|
db.refresh(user)
|
|
assert _recent(user.last_login_at)
|
|
|
|
|
|
def test_a_refused_password_does_not_stamp(client, db, make_user):
|
|
user = make_user(email="wrong@example.com", password=_PW)
|
|
|
|
r = client.post(
|
|
"/auth/password-login", json={"email": "wrong@example.com", "password": "not it"}
|
|
)
|
|
|
|
assert r.status_code == 401
|
|
db.refresh(user)
|
|
assert user.last_login_at is None
|
|
|
|
|
|
class _FakeGoogle:
|
|
"""authlib's client, reduced to the one call the callback makes after Google redirects back."""
|
|
|
|
def __init__(self, userinfo: dict):
|
|
self._userinfo = userinfo
|
|
|
|
async def authorize_access_token(self, _request):
|
|
return {"userinfo": self._userinfo, "access_token": "at", "scope": "openid email profile"}
|
|
|
|
|
|
def test_a_google_sign_in_stamps_last_login(client, db, make_user, monkeypatch):
|
|
from cryptography.fernet import Fernet
|
|
|
|
from app import security
|
|
|
|
# The callback stores the OAuth grant encrypted; a throwaway key stands in for TOKEN_ENCRYPTION_KEY.
|
|
monkeypatch.setattr(security, "_fernet", Fernet(Fernet.generate_key()))
|
|
user = make_user(email="g@example.com", password=None, google_sub="sub-g")
|
|
monkeypatch.setattr(settings, "admin_emails", "g@example.com") # the bootstrap allow-list
|
|
fake = _FakeGoogle({"sub": "sub-g", "email": "g@example.com", "email_verified": True})
|
|
monkeypatch.setattr(auth_routes, "google_oauth", lambda _db: fake)
|
|
|
|
r = client.get("/auth/callback", follow_redirects=False)
|
|
|
|
assert r.status_code in (302, 307) and r.headers["location"] == "/"
|
|
db.refresh(user)
|
|
assert _recent(user.last_login_at)
|
|
# …and it is a real sign-in, not only a stamp: the session now answers as this account.
|
|
assert client.get("/api/me").json()["id"] == user.id
|
|
|
|
|
|
def test_the_admin_user_list_carries_last_login(as_user, db, make_user):
|
|
admin = make_user(email="boss@example.com", role="admin")
|
|
never = make_user(email="never@example.com")
|
|
admin.last_login_at = datetime(2026, 9, 16, 8, 30, tzinfo=timezone.utc)
|
|
db.commit()
|
|
|
|
rows = {u["email"]: u for u in as_user(admin).get("/api/admin/users").json()}
|
|
|
|
assert rows["boss@example.com"]["last_login_at"].startswith("2026-09-16T08:30")
|
|
assert rows[never.email]["last_login_at"] is None
|
|
|
|
|
|
def test_the_account_sees_its_own_last_sign_in(client, db, make_user):
|
|
# Settings → Account shows it (prod UAT 2026-09-19: only the admin's user list did).
|
|
make_user(email="me@example.com", password=_PW)
|
|
assert (
|
|
client.post(
|
|
"/auth/password-login", json={"email": "me@example.com", "password": _PW}
|
|
).status_code
|
|
== 200
|
|
)
|
|
|
|
stamp = client.get("/api/me").json()["last_login_at"]
|
|
|
|
assert _recent(datetime.fromisoformat(stamp))
|