fix(audit): fermer les frontieres restantes
This commit is contained in:
GGThed
@@ -0,0 +1,281 @@
|
||||
"""Regression tests for compact POST forms that bypassed the shared schemas."""
|
||||
|
||||
from datetime import date, time
|
||||
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
from app.models import (
|
||||
Match,
|
||||
OneOnOneRequest,
|
||||
OrgTeam,
|
||||
PersonalNote,
|
||||
Team,
|
||||
TeamMember,
|
||||
TeamPlayer,
|
||||
Tryout,
|
||||
TryoutRegistration,
|
||||
UserGamertag,
|
||||
)
|
||||
|
||||
|
||||
def _tryout(db, owner_id, *, coach_id=None):
|
||||
row = Tryout(
|
||||
title='Boundary tryout',
|
||||
game='Valorant',
|
||||
date=date(2030, 4, 1),
|
||||
created_by=owner_id,
|
||||
coach_id=coach_id,
|
||||
)
|
||||
db.session.add(row)
|
||||
db.session.commit()
|
||||
return row.id
|
||||
|
||||
|
||||
def _give_coach_a_player(db, coach_id, player_id, owner_id):
|
||||
org_team = OrgTeam(
|
||||
name=f'Org {coach_id}-{player_id}',
|
||||
created_by=owner_id,
|
||||
coach_id=coach_id,
|
||||
)
|
||||
db.session.add(org_team)
|
||||
db.session.flush()
|
||||
db.session.add(TeamPlayer(org_team_id=org_team.id, player_id=player_id))
|
||||
db.session.commit()
|
||||
return org_team.id
|
||||
|
||||
|
||||
def test_tryout_team_name_is_bounded(app, client, as_role):
|
||||
admin_id = as_role('admin')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
tryout_id = _tryout(db, admin_id)
|
||||
|
||||
response = client.post(
|
||||
f'/tryouts/{tryout_id}/team/create',
|
||||
data={'team_name': 'x' * 101},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert Team.query.filter_by(tryout_id=tryout_id).count() == 0
|
||||
|
||||
|
||||
def test_registration_decisions_lock_the_tryout_row():
|
||||
from app.routes.tryouts import registration_lock_statement
|
||||
|
||||
sql = str(registration_lock_statement(42).compile(dialect=postgresql.dialect()))
|
||||
|
||||
assert 'FOR UPDATE' in sql
|
||||
|
||||
|
||||
def test_tryout_team_position_is_bounded(app, client, as_role, make_user):
|
||||
admin_id = as_role('admin')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
tryout_id = _tryout(db, admin_id)
|
||||
team = Team(tryout_id=tryout_id, name='Blue', created_by=admin_id)
|
||||
db.session.add(team)
|
||||
db.session.flush()
|
||||
team_id = team.id
|
||||
db.session.add(TryoutRegistration(tryout_id=tryout_id, player_id=player_id))
|
||||
db.session.commit()
|
||||
|
||||
response = client.post(
|
||||
f'/tryouts/{tryout_id}/team/{team_id}/add',
|
||||
data={'player_id': player_id, 'position': 'x' * 51},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert TeamMember.query.filter_by(team_id=team_id, player_id=player_id).first() is None
|
||||
|
||||
|
||||
def test_a_coach_cannot_open_an_unrelated_tryout_note_form(app, client, as_role, make_user):
|
||||
coach_id = as_role('coach')
|
||||
other_coach_id = make_user('coach')
|
||||
admin_id = make_user('admin')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
tryout_id = _tryout(db, admin_id, coach_id=other_coach_id)
|
||||
db.session.add(TryoutRegistration(tryout_id=tryout_id, player_id=player_id))
|
||||
db.session.commit()
|
||||
|
||||
response = client.get(f'/users/personal-notes/tryout/{tryout_id}')
|
||||
|
||||
assert response.status_code == 302
|
||||
assert response.headers['Location'].endswith('/users/notes-dashboard')
|
||||
assert coach_id != other_coach_id
|
||||
|
||||
|
||||
def test_a_note_cannot_claim_a_team_that_does_not_contain_the_player(
|
||||
app, client, as_role, make_user
|
||||
):
|
||||
coach_id = as_role('coach')
|
||||
admin_id = make_user('admin')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
_give_coach_a_player(db, coach_id, player_id, admin_id)
|
||||
tryout_id = _tryout(db, admin_id, coach_id=coach_id)
|
||||
team = Team(tryout_id=tryout_id, name='No player here', created_by=admin_id)
|
||||
db.session.add(team)
|
||||
db.session.commit()
|
||||
team_id = team.id
|
||||
|
||||
response = client.post(
|
||||
'/users/personal-notes/add',
|
||||
data={'player_id': player_id, 'content': 'Private note', 'team_id': team_id},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert PersonalNote.query.count() == 0
|
||||
|
||||
|
||||
def test_a_personal_note_is_bounded(app, client, as_role, make_user):
|
||||
coach_id = as_role('coach')
|
||||
admin_id = make_user('admin')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
_give_coach_a_player(db, coach_id, player_id, admin_id)
|
||||
|
||||
response = client.post(
|
||||
'/users/personal-notes/manage',
|
||||
data={'player_id': player_id, 'content': 'x' * 5001},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert PersonalNote.query.count() == 0
|
||||
|
||||
|
||||
def test_a_rejection_reason_is_bounded(app, client, as_role, make_user):
|
||||
coach_id = as_role('coach')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
request = OneOnOneRequest(
|
||||
player_id=player_id,
|
||||
coach_id=coach_id,
|
||||
date=date(2030, 4, 2),
|
||||
start_time=time(18, 0),
|
||||
end_time=time(18, 30),
|
||||
)
|
||||
db.session.add(request)
|
||||
db.session.commit()
|
||||
request_id = request.id
|
||||
|
||||
response = client.post(
|
||||
f'/users/one-on-one/{request_id}/reject',
|
||||
data={'rejection_reason': 'x' * 2001},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert db.session.get(OneOnOneRequest, request_id).status == 'pending'
|
||||
|
||||
|
||||
def test_a_match_context_must_contain_the_player(app, client, as_role, make_user):
|
||||
coach_id = as_role('coach')
|
||||
admin_id = make_user('admin')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
_give_coach_a_player(db, coach_id, player_id, admin_id)
|
||||
tryout_id = _tryout(db, admin_id, coach_id=coach_id)
|
||||
match = Match(
|
||||
tryout_id=tryout_id,
|
||||
title='Scrim',
|
||||
date=date(2030, 4, 2),
|
||||
match_type='player_vs_player',
|
||||
created_by=coach_id,
|
||||
)
|
||||
db.session.add(match)
|
||||
db.session.commit()
|
||||
match_id = match.id
|
||||
|
||||
response = client.post(
|
||||
'/users/personal-notes/add',
|
||||
data={'player_id': player_id, 'content': 'Private note', 'match_id': match_id},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert PersonalNote.query.count() == 0
|
||||
|
||||
|
||||
def test_the_note_dashboard_lists_tryout_teams_not_org_teams(app, client, as_role, make_user):
|
||||
coach_id = as_role('coach')
|
||||
admin_id = make_user('admin')
|
||||
player_id = make_user('player')
|
||||
from app.extensions import db
|
||||
|
||||
with app.app_context():
|
||||
_give_coach_a_player(db, coach_id, player_id, admin_id)
|
||||
tryout_id = _tryout(db, admin_id, coach_id=coach_id)
|
||||
team = Team(tryout_id=tryout_id, name='Tryout Alpha', created_by=admin_id)
|
||||
db.session.add(team)
|
||||
db.session.commit()
|
||||
team_id = team.id
|
||||
|
||||
body = client.get('/users/notes-dashboard').get_data(as_text=True)
|
||||
|
||||
assert f'<option value="{team_id}">Tryout Alpha</option>' in body
|
||||
assert f'>Org {coach_id}-{player_id}</option>' not in body
|
||||
|
||||
|
||||
def test_an_oversized_dynamic_gamertag_is_rejected(app, client, as_role):
|
||||
player_id = as_role('player')
|
||||
|
||||
response = client.post(
|
||||
'/users/profile/edit',
|
||||
data={
|
||||
'username': 'player1',
|
||||
'full_name': 'Player One',
|
||||
'email': '[email protected]',
|
||||
'games': 'Valorant',
|
||||
'gamertag_Valorant': 'x' * 121,
|
||||
},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert UserGamertag.query.filter_by(user_id=player_id).count() == 0
|
||||
|
||||
|
||||
def test_a_platform_must_belong_to_the_selected_game(app, client, as_role):
|
||||
player_id = as_role('player')
|
||||
|
||||
response = client.post(
|
||||
'/users/profile/edit',
|
||||
data={
|
||||
'username': 'player1',
|
||||
'full_name': 'Player One',
|
||||
'email': '[email protected]',
|
||||
'games': 'Apex Legends',
|
||||
'gamertag_Apex Legends': 'LegitName',
|
||||
'platform_Apex Legends': 'Forged platform',
|
||||
},
|
||||
follow_redirects=True,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
with app.app_context():
|
||||
assert UserGamertag.query.filter_by(user_id=player_id).count() == 0
|
||||
Reference in New Issue
Block a user