Alec Perkins
604c2bbf91
- Rate limits in the shared cache for comments, issues, uploads and invites; a limited HTMX reply keeps the draft. - Content-Security-Policy (self only, no inline script or style, bucket origin for images and frames) and Permissions-Policy on every page. htmx configured not to inject styles or eval. - Moderation: deactivating a user ends their sessions and keeps their content; deleted accounts show as "ghost"; reserved usernames; the admin won't delete an org's last owner. - Admin requires a TOTP code (django-otp), with add_admin_totp to enrol. - Email provider chosen by environment through django-anymail. - Playwright browser tests: axe WCAG 2.1 AA on every page in light and dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit Canvas/CanvasText on :root fixes dark-mode contrast detection. - bin/start creates the data dir if missing; docs/operations.md runbook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
101 lines
2.8 KiB
Python
101 lines
2.8 KiB
Python
import itertools
|
|
|
|
import pytest
|
|
from allauth.account.models import EmailAddress
|
|
from django.contrib.auth import get_user_model
|
|
|
|
from intent.orgs.models import OrgMembership, Role
|
|
from intent.orgs.services import create_org
|
|
from intent.projects.models import ProjectMembership, Visibility
|
|
from intent.projects.services import create_project
|
|
|
|
_counter = itertools.count()
|
|
|
|
|
|
@pytest.fixture
|
|
def make_user(db):
|
|
def make(username=None, *, email=None, is_staff=False):
|
|
username = username or f"user{next(_counter)}"
|
|
email = email or f"{username}@example.com"
|
|
user = get_user_model().objects.create_user(
|
|
username=username, email=email, is_staff=is_staff
|
|
)
|
|
EmailAddress.objects.create(user=user, email=email, verified=True, primary=True)
|
|
return user
|
|
|
|
return make
|
|
|
|
|
|
@pytest.fixture
|
|
def owner(make_user):
|
|
return make_user("olive")
|
|
|
|
|
|
@pytest.fixture
|
|
def org(owner):
|
|
return create_org(slug="catbriar", name="Catbriar", owner=owner)
|
|
|
|
|
|
@pytest.fixture
|
|
def collaborator(make_user, org):
|
|
user = make_user("cole")
|
|
OrgMembership.objects.create(org=org, user=user, role=Role.COLLABORATOR)
|
|
return user
|
|
|
|
|
|
@pytest.fixture
|
|
def project(org, owner):
|
|
"""A private project created by the org owner, who is therefore its project owner too."""
|
|
return create_project(
|
|
org,
|
|
owner,
|
|
slug="intent",
|
|
name="Intent",
|
|
feature_prefix="INT",
|
|
visibility=Visibility.PRIVATE,
|
|
open_contribution=False,
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def editor(make_user, org, project):
|
|
"""An org collaborator who is a collaborator on the project."""
|
|
user = make_user("eddie")
|
|
OrgMembership.objects.create(org=org, user=user)
|
|
ProjectMembership.objects.create(project=project, user=user)
|
|
return user
|
|
|
|
|
|
@pytest.fixture
|
|
def open_project(project):
|
|
"""The project, made public and open to contributions from any signed-in user."""
|
|
project.visibility = Visibility.PUBLIC
|
|
project.open_contribution = True
|
|
project.save()
|
|
return project
|
|
|
|
|
|
@pytest.fixture
|
|
def outsider(make_user):
|
|
"""A signed-in user with no role in the org."""
|
|
return make_user("uma")
|
|
|
|
|
|
@pytest.fixture
|
|
def verified_admin(client, make_user):
|
|
"""Sign `client` in as a staff user who has passed the admin's second factor."""
|
|
from django_otp import DEVICE_ID_SESSION_KEY
|
|
from django_otp.plugins.otp_totp.models import TOTPDevice
|
|
|
|
def sign_in(user=None):
|
|
user = user or get_user_model().objects.create_superuser(
|
|
"sam", "sam@example.com", "a-long-admin-password"
|
|
)
|
|
device = TOTPDevice.objects.create(user=user, name="Phone", confirmed=True)
|
|
client.force_login(user)
|
|
session = client.session
|
|
session[DEVICE_ID_SESSION_KEY] = device.persistent_id
|
|
session.save()
|
|
return user
|
|
|
|
return sign_in
|