mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
1227674d8f
- Computes API: mark password as write_only in ComputeSerializer, restrict ComputeViewSet and architectures to IsAdminUser. - Instances API: enforce user ownership tenant isolation in InstanceViewSet.list, restrict MigrateViewSet and CreateInstanceViewSet to IsAdminUser, require IsAdminUser for mutating FlavorViewSet. - Storage, Network, and Interface APIs: restrict StorageViewSet, VolumeViewSet, NetworkViewSet, InterfaceViewSet to IsAdminUser. - AppSettings & NWFilters: protect appsettings and nwfilter views with @superuser_only (403 Forbidden for non-superusers). - noVNC Console: sign tokens with TimestampSigner (salt='console.novnc', max_age=600), verify signature and user authorization in novncd with backward-compatible fallback for debug/test mode. - Accounts: avoid hardcoded default admin password; generate cryptographically secure random password unless ADMIN_PASSWORD is set (preserve 'admin' in test runner). - gstfsd daemon: bind to 127.0.0.1 by default instead of 0.0.0.0. - Tests: added comprehensive test coverage for API security, token expiration/rejection, and view permissions (132 tests passing).
45 lines
1.6 KiB
Python
45 lines
1.6 KiB
Python
from django.test import Client, TestCase
|
|
from django.urls import reverse
|
|
|
|
from appsettings.models import AppSettings
|
|
from appsettings.settings import app_settings, get_settings
|
|
|
|
|
|
class AppSettingsTestCase(TestCase):
|
|
def setUp(self):
|
|
self.client.login(username="admin", password="admin")
|
|
|
|
def test_get_settings_populates_singleton(self):
|
|
AppSettings.objects.update_or_create(
|
|
key="CUSTOM_TEST_SETTING",
|
|
defaults={"value": "test_value_123", "name": "Custom Test Setting"}
|
|
)
|
|
get_settings()
|
|
self.assertEqual(getattr(app_settings, "CUSTOM_TEST_SETTING", None), "test_value_123")
|
|
|
|
def test_appsettings_view_get(self):
|
|
response = self.client.get(reverse("appsettings"))
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
def test_appsettings_update_setting(self):
|
|
setting = AppSettings.objects.get(key="SHOW_ACCESS_ROOT_PASSWORD")
|
|
original_value = setting.value
|
|
new_val = "False" if original_value == "True" else "True"
|
|
|
|
response = self.client.post(
|
|
reverse("appsettings"),
|
|
{
|
|
"SHOW_ACCESS_ROOT_PASSWORD": new_val
|
|
}
|
|
)
|
|
self.assertRedirects(response, reverse("appsettings"))
|
|
|
|
setting.refresh_from_db()
|
|
self.assertEqual(setting.value, new_val)
|
|
|
|
def test_appsettings_non_superuser_forbidden(self):
|
|
from django.contrib.auth.models import User
|
|
regular_user = User.objects.create_user(username="regular", password="pwd")
|
|
self.client.force_login(regular_user)
|
|
response = self.client.get(reverse("appsettings"))
|
|
self.assertEqual(response.status_code, 403)
|