peter
fc65b8ab83
The cooldown was checked before the list was found pushable and before its sync claim, so Watch later or a list another sync held used up the push allowance. It now counts only a push that runs. The docstring that called a YouTube mirror unpushable is corrected: its local edits sync back.
234 lines
10 KiB
Python
234 lines
10 KiB
Python
"""The route-level halves of SEC-12 and SEC-14.
|
|
|
|
`test_urlguard.py` pins the address judgement itself; this pins that the ENQUEUE route actually
|
|
consults it and answers in the structured `{code, reason}` shape the frontend localizes, and that a
|
|
manual sync trigger stops spending the instance-wide YouTube budget when held down.
|
|
|
|
DB-backed (the `as_user` fixture needs real rows) — skipped when no database is reachable.
|
|
"""
|
|
|
|
from app.downloads import urlguard
|
|
|
|
|
|
def test_enqueueing_a_loopback_url_is_refused_with_a_structured_detail(
|
|
db, as_user, make_user, monkeypatch
|
|
):
|
|
user = make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(
|
|
urlguard.socket, "getaddrinfo", lambda *a, **kw: [(None, None, None, "", ("127.0.0.1", 0))]
|
|
)
|
|
r = as_user(user).post("/api/downloads", json={"source": "http://redis.internal:6379/x"})
|
|
assert r.status_code == 422
|
|
# The shape matters as much as the refusal: a bare English string under a bilingual UI is the
|
|
# thing the canonical-patterns table forbids.
|
|
assert r.json()["detail"] == {"code": "url_blocked", "reason": urlguard.REASON_PRIVATE}
|
|
|
|
|
|
def test_a_public_url_gets_past_the_guard(db, as_user, make_user, monkeypatch):
|
|
# Mutation check for the test above: with a public answer the request must fail LATER (or
|
|
# succeed), never with url_blocked — otherwise the guard would be refusing everything and the
|
|
# first test would still pass.
|
|
user = make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(
|
|
urlguard.socket,
|
|
"getaddrinfo",
|
|
lambda *a, **kw: [(None, None, None, "", ("93.184.216.34", 0))],
|
|
)
|
|
# An inline spec, so nothing ELSE refuses it: without one the request stopped at the
|
|
# profile lookup (400 no_profile) and "not url_blocked" held for a request the guard never
|
|
# had to wave through.
|
|
r = as_user(user).post(
|
|
"/api/downloads", json={"source": "https://example.com/v", "spec": {"format": "best"}}
|
|
)
|
|
assert r.status_code == 200, r.text
|
|
assert r.json()["status"] == "queued"
|
|
|
|
|
|
def test_youtube_sources_never_consult_the_guard(db, as_user, make_user, monkeypatch):
|
|
# A YouTube job resolves to a fixed public host from an 11-char id, so there is no
|
|
# user-controlled destination — resolving one would be pure latency on every enqueue.
|
|
def boom(*a, **kw):
|
|
raise AssertionError("the URL guard resolved DNS for a YouTube source")
|
|
|
|
user = make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(urlguard.socket, "getaddrinfo", boom)
|
|
# The job must actually be created: a request refused for any other reason would never reach
|
|
# the guard either, and the test would pass without proving anything.
|
|
r = as_user(user).post(
|
|
"/api/downloads", json={"source": "dQw4w9WgXcQ", "spec": {"format": "best"}}
|
|
)
|
|
assert r.status_code == 200, r.text
|
|
assert r.json()["source_kind"] == "youtube"
|
|
|
|
|
|
def test_manual_subscription_sync_goes_on_cooldown(db, as_user, make_user, monkeypatch):
|
|
from app.routes import sync as syncroutes
|
|
|
|
user = make_user()
|
|
db.commit()
|
|
# Neither the YouTube grant nor the import itself is under test — the limiter is.
|
|
monkeypatch.setattr(syncroutes, "has_read_scope", lambda u: True)
|
|
monkeypatch.setattr(syncroutes, "import_subscriptions", lambda d, u: {"imported": 0})
|
|
|
|
c = as_user(user)
|
|
codes = [c.post("/api/sync/subscriptions").status_code for _ in range(4)]
|
|
# 3 per 10 minutes: the first three pass, the fourth is refused.
|
|
assert codes[:3] == [200, 200, 200]
|
|
assert codes[3] == 429
|
|
assert c.post("/api/sync/subscriptions").json()["detail"] == {"code": "sync_cooldown"}
|
|
|
|
|
|
def test_the_cooldown_is_per_user_not_global(db, as_user, make_user, monkeypatch):
|
|
# Keyed by user id on purpose: the shared YouTube budget is spent per account, and one user
|
|
# exhausting their allowance must not lock everyone else out of their own sync button.
|
|
from app.routes import sync as syncroutes
|
|
|
|
a, b = make_user(), make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(syncroutes, "has_read_scope", lambda u: True)
|
|
monkeypatch.setattr(syncroutes, "import_subscriptions", lambda d, u: {"imported": 0})
|
|
|
|
ca = as_user(a)
|
|
assert [ca.post("/api/sync/subscriptions").status_code for _ in range(4)] == [
|
|
200,
|
|
200,
|
|
200,
|
|
429,
|
|
]
|
|
assert ca.post("/api/sync/subscriptions").status_code == 429
|
|
assert as_user(b).post("/api/sync/subscriptions").status_code == 200
|
|
|
|
|
|
def test_the_single_playlist_repull_shares_the_pull_cooldown(db, as_user, make_user, monkeypatch):
|
|
# SEC-14, the sweep half: `revert-youtube` spends under the SAME QuotaAction.PLAYLISTS_PULL key
|
|
# as the bulk `sync-youtube`, so limiting only one of them left the identical drain open one
|
|
# route over. Both must draw on the one allowance.
|
|
from app.reader.models import Playlist
|
|
from app.routes import playlists as plroutes
|
|
|
|
user = make_user()
|
|
pl = Playlist(user_id=user.id, name="Linked", source="youtube", yt_playlist_id="PL123")
|
|
db.add(pl)
|
|
db.commit()
|
|
monkeypatch.setattr(plroutes, "has_read_scope", lambda u: True)
|
|
monkeypatch.setattr(plroutes, "repull_playlist", lambda d, u, p: {"ok": True})
|
|
monkeypatch.setattr(plroutes, "pull_user_playlists", lambda d, u: {"ok": True})
|
|
|
|
c = as_user(user)
|
|
codes = [c.post(f"/api/playlists/{pl.id}/revert-youtube").status_code for _ in range(4)]
|
|
assert codes[:3] == [200, 200, 200]
|
|
assert codes[3] == 429
|
|
# One allowance, not one each: the bulk route is now on cooldown too.
|
|
r = c.post("/api/playlists/sync-youtube")
|
|
assert r.status_code == 429
|
|
assert r.json()["detail"] == {"code": "sync_cooldown"}
|
|
|
|
|
|
def _pushable_list(db, make_user, monkeypatch, plroutes):
|
|
"""A local (never exported) list and a user with the write scope; the merge itself is stubbed —
|
|
the limiter is under test, not the YouTube round trip."""
|
|
from app import auth
|
|
from app.reader.models import Playlist
|
|
|
|
user = make_user()
|
|
pl = Playlist(user_id=user.id, name="Local", source="local")
|
|
db.add(pl)
|
|
db.commit()
|
|
monkeypatch.setattr(auth, "has_write_scope", lambda u: True)
|
|
monkeypatch.setattr(plroutes, "plan_merge", lambda d, u, p, live=None: {"units_estimate": 0})
|
|
monkeypatch.setattr(plroutes, "merge_playlist", lambda d, u, p, live=None: {"added": 0})
|
|
return user, pl
|
|
|
|
|
|
def test_the_push_side_goes_on_cooldown_after_its_allowance(db, as_user, make_user, monkeypatch):
|
|
# SEC-18: push-plan reads the live list and push writes it, both against the instance-wide
|
|
# YouTube budget. A press in the UI is one plan + one push, so the allowance is generous — but a
|
|
# scripted loop stops at it, with a reason the UI can say.
|
|
from app.routes import playlists as plroutes
|
|
|
|
user, pl = _pushable_list(db, make_user, monkeypatch, plroutes)
|
|
c = as_user(user)
|
|
allowance = plroutes.PUSH_ALLOWANCE
|
|
codes = [c.get(f"/api/playlists/{pl.id}/push-plan").status_code for _ in range(allowance)]
|
|
assert codes == [200] * allowance
|
|
r = c.get(f"/api/playlists/{pl.id}/push-plan")
|
|
assert r.status_code == 429
|
|
assert r.json()["detail"] == {"code": "playlist", "reason": "push_cooldown"}
|
|
|
|
|
|
def test_plan_and_push_draw_on_one_allowance(db, as_user, make_user, monkeypatch):
|
|
# The asymmetric fix again, avoided up front: a limit on one of the two routes leaves the same
|
|
# drain open next door.
|
|
from app.routes import playlists as plroutes
|
|
|
|
user, pl = _pushable_list(db, make_user, monkeypatch, plroutes)
|
|
c = as_user(user)
|
|
for i in range(plroutes.PUSH_ALLOWANCE):
|
|
if i % 2:
|
|
r = c.get(f"/api/playlists/{pl.id}/push-plan")
|
|
else:
|
|
r = c.post(f"/api/playlists/{pl.id}/push")
|
|
assert r.status_code == 200, (i, r.json())
|
|
r = c.post(f"/api/playlists/{pl.id}/push")
|
|
assert r.status_code == 429
|
|
assert r.json()["detail"] == {"code": "playlist", "reason": "push_cooldown"}
|
|
|
|
|
|
def test_a_refused_push_spends_no_allowance(db, as_user, make_user, monkeypatch):
|
|
# The allowance counts pushes that run: Watch later (never pushable) and a list another sync
|
|
# holds are refused before any YouTube call, so they must not leave the next real press at 429.
|
|
from contextlib import contextmanager
|
|
|
|
from app.reader.models import Playlist
|
|
from app.routes import playlists as plroutes
|
|
|
|
user, pl = _pushable_list(db, make_user, monkeypatch, plroutes)
|
|
wl = Playlist(user_id=user.id, name="Watch later", kind="watch_later")
|
|
db.add(wl)
|
|
db.commit()
|
|
c = as_user(user)
|
|
over = plroutes.PUSH_ALLOWANCE + 1
|
|
assert {c.get(f"/api/playlists/{wl.id}/push-plan").status_code for _ in range(over)} == {400}
|
|
assert {c.post(f"/api/playlists/{wl.id}/push").status_code for _ in range(over)} == {400}
|
|
|
|
@contextmanager
|
|
def busy(_db, _id):
|
|
yield False
|
|
|
|
with monkeypatch.context() as m:
|
|
m.setattr(plroutes, "sync_claim", busy)
|
|
assert {c.post(f"/api/playlists/{pl.id}/push").status_code for _ in range(over)} == {409}
|
|
assert c.post(f"/api/playlists/{pl.id}/push").status_code == 200
|
|
|
|
|
|
def test_a_mirrored_youtube_list_is_pushable(db, as_user, make_user, monkeypatch):
|
|
# A mirror of the user's own YouTube list takes local edits (`dirty`) and syncs them back; only
|
|
# Watch later is refused.
|
|
from app.reader.models import Playlist
|
|
from app.routes import playlists as plroutes
|
|
|
|
user, _ = _pushable_list(db, make_user, monkeypatch, plroutes)
|
|
mirror = Playlist(
|
|
user_id=user.id, name="Mine", source="youtube", yt_playlist_id="PLx", dirty=True
|
|
)
|
|
db.add(mirror)
|
|
db.commit()
|
|
assert as_user(user).get(f"/api/playlists/{mirror.id}/push-plan").status_code == 200
|
|
|
|
|
|
def test_the_push_cooldown_is_per_user(db, as_user, make_user, monkeypatch):
|
|
from app.routes import playlists as plroutes
|
|
|
|
a, pa = _pushable_list(db, make_user, monkeypatch, plroutes)
|
|
b, pb = _pushable_list(db, make_user, monkeypatch, plroutes)
|
|
ca = as_user(a)
|
|
codes = [
|
|
ca.get(f"/api/playlists/{pa.id}/push-plan").status_code
|
|
for _ in range(plroutes.PUSH_ALLOWANCE + 1)
|
|
]
|
|
assert codes == [200] * plroutes.PUSH_ALLOWANCE + [429]
|
|
assert as_user(b).get(f"/api/playlists/{pb.id}/push-plan").status_code == 200
|