Ole-Morten Duesund
7ab2320be6
Flask-app som genererer statiske sider til public/ og serverer dem sammen med et admin-grensesnitt (/admin). Innhold ligger som markdown og bilder i et git-repo (data/content), brukere i sqlite. - Editor med toolbar, live server-side forhåndsvisning, bildeopplasting via knapp, dra-og-slipp og lim inn. Bilder nedskaleres og EXIF fjernes. - Hovedbruker publiserer under /<slug>/, gjester under /<bruker>/<slug>/. Slug lages fra tittelen og fryses ved publisering. - Alle interne lenker er relative, så siden kan flyttes mellom domener og sub-paths (SOAPBOX_BASE_PATH) uten rebuild. - Tema 'green' med CSS-variabler, mørk modus og WCAG-kontrast. - Containerfile (python:alpine + git), compose.yaml og Caddyfile-eksempel. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JcEy43fNYpwg6K6oTKakWR
136 lines
5.1 KiB
Python
136 lines
5.1 KiB
Python
import re
|
|
|
|
from soapbox.app import create_app
|
|
from soapbox.config import load_config
|
|
from tests.conftest import csrf, login, png_bytes
|
|
|
|
|
|
def _create_post(client, prefix=""):
|
|
login(client, prefix=prefix)
|
|
r = client.post(f"{prefix}/admin/new", data={"csrf": csrf(client)})
|
|
assert r.status_code == 302
|
|
post_id = r.headers["Location"].split("/admin/edit/")[1]
|
|
return post_id
|
|
|
|
|
|
def test_login_required(client):
|
|
assert client.get("/admin/").status_code == 302
|
|
assert client.get("/admin/login").status_code == 200
|
|
assert client.get("/admin/static/admin.css").content_type.startswith("text/css")
|
|
assert client.get("/admin/static/editor.js").status_code == 200
|
|
|
|
|
|
def test_full_flow_owner(client, cfg):
|
|
post_id = _create_post(client)
|
|
assert post_id == "_owner/nytt-innlegg"
|
|
token = csrf(client)
|
|
|
|
# Last opp et bilde
|
|
r = client.post(
|
|
f"/admin/upload/{post_id}",
|
|
data={"file": (__import__("io").BytesIO(png_bytes()), "Mitt Bilde.PNG")},
|
|
headers={"X-CSRF": token},
|
|
content_type="multipart/form-data",
|
|
)
|
|
assert r.status_code == 200, r.data
|
|
assert r.json["filename"] == "mitt-bilde.png"
|
|
|
|
# Forhåndsvisning peker bildet til admin-media
|
|
r = client.post(
|
|
f"/admin/preview/{post_id}",
|
|
json={"body": " [x](/annet/)"},
|
|
headers={"X-CSRF": token},
|
|
)
|
|
assert f'src="/admin/media/{post_id}/mitt-bilde.png"' in r.text
|
|
assert 'href="../annet/"' in r.text
|
|
|
|
# Publiser: slug følger tittelen
|
|
body = "Hei **verden**\n\n\n\n[hjem](/)"
|
|
r = client.post(
|
|
f"/admin/edit/{post_id}",
|
|
data={"csrf": token, "title": "Grønt er skjønt", "body": body, "action": "publish"},
|
|
)
|
|
assert r.headers["Location"].endswith("/admin/edit/_owner/groent-er-skjoent")
|
|
assert (cfg.content_dir / "posts/groent-er-skjoent/index.md").exists()
|
|
assert (cfg.content_dir / "posts/groent-er-skjoent/mitt-bilde.png").exists()
|
|
|
|
# Statisk output
|
|
r = client.get("/groent-er-skjoent")
|
|
assert r.status_code == 301 and r.headers["Location"].endswith("/groent-er-skjoent/")
|
|
html = client.get("/groent-er-skjoent/").text
|
|
assert "<strong>verden</strong>" in html
|
|
assert 'href="../theme/style.css"' in html
|
|
assert 'href="../"' in html # intern lenke omskrevet til relativ
|
|
assert client.get("/groent-er-skjoent/mitt-bilde.png").status_code == 200
|
|
assert "Grønt er skjønt" in client.get("/").text
|
|
feed = client.get("/feed.xml").text
|
|
assert "https://blog.example.no/groent-er-skjoent/" in feed
|
|
|
|
# Etter publisering fryses slug selv om tittelen endres
|
|
r = client.post(
|
|
"/admin/edit/_owner/groent-er-skjoent",
|
|
data={"csrf": token, "title": "Ny tittel", "body": body, "action": "save"},
|
|
)
|
|
assert r.headers["Location"].endswith("/admin/edit/_owner/groent-er-skjoent")
|
|
|
|
# Git-historikk
|
|
from soapbox.gitstore import log
|
|
|
|
lines = log(cfg.content_dir)
|
|
assert any("Publiserte: Grønt er skjønt" in line for line in lines)
|
|
assert all("eier:" in line for line in lines)
|
|
|
|
|
|
def test_guest_flow_and_isolation(client, cfg):
|
|
post_id = _create_post(client) # eierens utkast
|
|
client.post("/admin/logout", data={"csrf": csrf(client)})
|
|
|
|
login(client, "gjest1")
|
|
token = csrf(client)
|
|
# Gjest kan ikke røre eierens innlegg
|
|
assert client.get(f"/admin/edit/{post_id}").status_code == 403
|
|
assert client.get("/admin/users").status_code == 403
|
|
|
|
r = client.post("/admin/new", data={"csrf": token})
|
|
gid = r.headers["Location"].split("/admin/edit/")[1]
|
|
assert gid == "gjest1/nytt-innlegg"
|
|
client.post(
|
|
f"/admin/edit/{gid}",
|
|
data={"csrf": token, "title": "Post 1", "body": "hei", "action": "publish"},
|
|
)
|
|
assert (cfg.content_dir / "guests/gjest1/post-1/index.md").exists()
|
|
|
|
html = client.get("/gjest1/post-1/").text
|
|
assert 'href="../../theme/style.css"' in html
|
|
assert "Gjest En" in html
|
|
assert "Post 1" in client.get("/gjest1/").text
|
|
assert "Post 1" in client.get("/").text # gjesteinnlegg vises også på forsiden
|
|
# eierens utkast er ikke publisert
|
|
assert client.get("/nytt-innlegg/").status_code == 404
|
|
|
|
|
|
def test_csrf_enforced(client):
|
|
login(client)
|
|
assert client.post("/admin/new", data={}).status_code == 403
|
|
|
|
|
|
def test_subpath_mount(tmp_path):
|
|
cfg = load_config({"SOAPBOX_DATA_DIR": str(tmp_path / "d"), "SOAPBOX_BASE_PATH": "/blog/"})
|
|
assert cfg.base_path == "/blog"
|
|
app = create_app(cfg)
|
|
app.config["TESTING"] = True
|
|
from soapbox import db
|
|
|
|
conn = db.connect(cfg.db_path)
|
|
db.create_user(conn, "eier", "hemmelig123", db.ROLE_OWNER)
|
|
conn.close()
|
|
client = app.test_client()
|
|
assert client.get("/admin/login").status_code == 404
|
|
assert client.get("/blog/admin/login").status_code == 200
|
|
login(client, prefix="/blog")
|
|
r = client.post("/blog/admin/new", data={"csrf": csrf(client, "/blog")})
|
|
assert r.headers["Location"].startswith("/blog/admin/edit/")
|
|
html = client.get("/blog/").text
|
|
assert 'href="theme/style.css"' in html
|
|
assert re.search(r'href="admin/"', html)
|
|
assert client.get("/blog/theme/style.css").status_code == 200
|