|
| 1 | +""" |
| 2 | +Regression test for issue #76 — saving settings must not fail when the |
| 3 | +masked api_bearer_token placeholder '********' is present. |
| 4 | +
|
| 5 | +These are fast unit tests that do NOT require Docker. |
| 6 | +""" |
| 7 | + |
| 8 | +import json |
| 9 | +from pathlib import Path |
| 10 | +from unittest.mock import patch |
| 11 | + |
| 12 | +import pytest |
| 13 | + |
| 14 | +pytestmark = [pytest.mark.unit] |
| 15 | + |
| 16 | + |
| 17 | +@pytest.fixture |
| 18 | +def settings_env(tmp_path): |
| 19 | + """Create a minimal SettingsManager with a temp settings file, |
| 20 | + bypassing the compat layer so writes go to the temp directory.""" |
| 21 | + from modules.core.file_operations import FileOperations |
| 22 | + from modules.core.settings import SettingsManager |
| 23 | + |
| 24 | + data_dir = tmp_path / "data" |
| 25 | + data_dir.mkdir() |
| 26 | + cert_dir = tmp_path / "certificates" |
| 27 | + cert_dir.mkdir() |
| 28 | + backup_dir = tmp_path / "backups" |
| 29 | + backup_dir.mkdir() |
| 30 | + logs_dir = tmp_path / "logs" |
| 31 | + logs_dir.mkdir() |
| 32 | + |
| 33 | + file_ops = FileOperations( |
| 34 | + data_dir=data_dir, |
| 35 | + cert_dir=cert_dir, |
| 36 | + backup_dir=backup_dir, |
| 37 | + logs_dir=logs_dir, |
| 38 | + ) |
| 39 | + settings_file = data_dir / "settings.json" |
| 40 | + mgr = SettingsManager(file_ops, settings_file) |
| 41 | + |
| 42 | + # Bypass the compat wrappers so we use our local file_ops directly |
| 43 | + mgr._safe_file_write_compat = file_ops.safe_file_write |
| 44 | + mgr._safe_file_read_compat = file_ops.safe_file_read |
| 45 | + mgr._settings_file_exists_compat = lambda: settings_file.exists() |
| 46 | + mgr._save_settings_compat = lambda s, r="auto": mgr.save_settings(s, r) |
| 47 | + |
| 48 | + return mgr, settings_file |
| 49 | + |
| 50 | + |
| 51 | +def _seed(settings_file): |
| 52 | + """Write a valid baseline settings file and return the dict.""" |
| 53 | + from modules.core.utils import generate_secure_token |
| 54 | + base = { |
| 55 | + "email": "user@example.com", |
| 56 | + "dns_provider": "cloudflare", |
| 57 | + "domains": [], |
| 58 | + "auto_renew": True, |
| 59 | + "api_bearer_token": generate_secure_token(), |
| 60 | + "setup_completed": True, |
| 61 | + } |
| 62 | + settings_file.write_text(json.dumps(base)) |
| 63 | + return base |
| 64 | + |
| 65 | + |
| 66 | +class TestMaskedTokenSave: |
| 67 | + """Issue #76: save_settings must handle masked api_bearer_token.""" |
| 68 | + |
| 69 | + def test_save_with_masked_token_succeeds(self, settings_env): |
| 70 | + """Saving settings that contain '********' must not fail.""" |
| 71 | + mgr, settings_file = settings_env |
| 72 | + initial = _seed(settings_file) |
| 73 | + |
| 74 | + updated = dict(initial) |
| 75 | + updated["api_bearer_token"] = "********" |
| 76 | + result = mgr.save_settings(updated, "test") |
| 77 | + assert result is True, "save_settings should succeed with masked token" |
| 78 | + |
| 79 | + saved = json.loads(settings_file.read_text()) |
| 80 | + assert saved.get("api_bearer_token") != "********", \ |
| 81 | + "Masked placeholder must not be persisted" |
| 82 | + |
| 83 | + def test_save_with_empty_token_succeeds(self, settings_env): |
| 84 | + """Saving settings with an empty api_bearer_token must not fail.""" |
| 85 | + mgr, settings_file = settings_env |
| 86 | + _seed(settings_file) |
| 87 | + |
| 88 | + updated = json.loads(settings_file.read_text()) |
| 89 | + updated["api_bearer_token"] = "" |
| 90 | + result = mgr.save_settings(updated, "test") |
| 91 | + assert result is True, "save_settings should succeed with empty token" |
| 92 | + |
| 93 | + def test_save_with_valid_token_still_validates(self, settings_env): |
| 94 | + """A real, valid token must still pass through validation.""" |
| 95 | + mgr, settings_file = settings_env |
| 96 | + initial = _seed(settings_file) |
| 97 | + real_token = initial["api_bearer_token"] |
| 98 | + |
| 99 | + result = mgr.save_settings(dict(initial), "test") |
| 100 | + assert result is True |
| 101 | + |
| 102 | + saved = json.loads(settings_file.read_text()) |
| 103 | + assert saved.get("api_bearer_token") == real_token |
| 104 | + |
| 105 | + def test_save_with_invalid_token_still_rejected(self, settings_env): |
| 106 | + """A truly invalid (short, non-masked) token must still be rejected.""" |
| 107 | + mgr, settings_file = settings_env |
| 108 | + _seed(settings_file) |
| 109 | + |
| 110 | + bad_settings = json.loads(settings_file.read_text()) |
| 111 | + bad_settings["api_bearer_token"] = "tooshort" |
| 112 | + result = mgr.save_settings(bad_settings, "test") |
| 113 | + assert result is False, "Short invalid tokens must still be rejected" |
0 commit comments