44 lines
1.4 KiB
Python
44 lines
1.4 KiB
Python
PW = "correct-horse-battery-staple"
|
|
|
|
|
|
def test_login_success_sets_cookie(client):
|
|
r = client.post("/login", data={"username": "admin", "password": PW})
|
|
assert r.status_code == 303
|
|
set_cookie = r.headers.get("set-cookie", "")
|
|
assert "bike_session=" in set_cookie
|
|
assert "httponly" in set_cookie.lower()
|
|
|
|
|
|
def test_login_failure_generic_error(client):
|
|
r = client.post("/login", data={"username": "admin", "password": "wrong"})
|
|
assert r.status_code == 200
|
|
# Generic error - does not reveal whether the user exists.
|
|
assert "Invalid username or password" in r.text
|
|
|
|
|
|
def test_login_failure_unknown_user_same_message(client):
|
|
r = client.post("/login", data={"username": "ghost", "password": "x"})
|
|
assert r.status_code == 200
|
|
assert "Invalid username or password" in r.text
|
|
|
|
|
|
def test_dashboard_requires_auth(client):
|
|
r = client.get("/", follow_redirects=False)
|
|
assert r.status_code == 303
|
|
assert r.headers["location"].startswith("/login")
|
|
|
|
|
|
def test_dashboard_when_authed(client):
|
|
client.post("/login", data={"username": "admin", "password": PW})
|
|
r = client.get("/")
|
|
assert r.status_code == 200
|
|
assert "Your bikes" in r.text
|
|
|
|
|
|
def test_logout_clears_session(client):
|
|
client.post("/login", data={"username": "admin", "password": PW})
|
|
r = client.get("/logout")
|
|
assert r.status_code == 200
|
|
# Session cookie should be cleared (max-age 0).
|
|
assert "bike_session=" in r.headers.get("set-cookie", "")
|