| import importlib |
| import os |
| import re |
| from types import SimpleNamespace |
|
|
| from fastapi.testclient import TestClient |
|
|
| os.environ.setdefault("SYSTEM", "spaces") |
| os.environ.setdefault("SPACE_ID", "test/certificate-generator") |
| os.environ.setdefault("SPACE_HOST", "test-certificate-generator.hf.space") |
| os.environ.setdefault("OAUTH_CLIENT_ID", "test-client") |
| os.environ.setdefault("OAUTH_CLIENT_SECRET", "test-secret") |
| os.environ.setdefault("OAUTH_SCOPES", "openid profile") |
| os.environ.setdefault("OPENID_PROVIDER_URL", "https://huggingface.co") |
|
|
| certificate_app = importlib.import_module("app") |
|
|
|
|
| def test_oauth_login_clears_stale_session_before_redirecting(): |
| with TestClient(certificate_app.app) as client: |
| response = client.get("/oauth-login", follow_redirects=False) |
|
|
| assert response.status_code == 303 |
| assert response.headers["location"] == "/login/huggingface?_target_url=/" |
| cookie = response.headers["set-cookie"].lower() |
| assert 'session=""' in cookie |
| assert "max-age=0" in cookie |
| assert "httponly" in cookie |
| assert "samesite=none" in cookie |
| assert "secure" in cookie |
|
|
|
|
| def test_auth_control_uses_top_level_navigation(): |
| logged_out = certificate_app.auth_control(None) |
| logged_in = certificate_app.auth_control( |
| SimpleNamespace(username='person<script>alert("x")</script>') |
| ) |
|
|
| assert 'href="/oauth-login"' in logged_out |
| assert 'target="_top"' in logged_out |
| assert 'href="/logout?_target_url=/"' in logged_in |
| assert "<script>" not in logged_in |
| assert "<script>" in logged_in |
|
|
|
|
| def test_root_frontend_asset_is_served(): |
| """Catch broken asset paths when mounting Gradio at the Space root.""" |
| with TestClient(certificate_app.app) as client: |
| response = client.get("/") |
| assert response.status_code == 200 |
|
|
| assets = re.findall(r'(?:src|href)="(\.?/assets/[^"]+)"', response.text) |
| assert assets, "root page did not reference a Gradio frontend asset" |
|
|
| asset_path = assets[0].removeprefix(".") |
| asset_response = client.get(asset_path) |
|
|
| assert asset_response.status_code == 200 |
|
|
