import json import unittest from unittest.mock import patch from flowers import create_app class FakeVault: def __init__(self, *args): pass def authenticate(self): return True def all(self): return [ { "organization": "Acme", "myID": "alice@example.test", "dateCreated": "2024-02-03 12:00:00", } ] class AppTests(unittest.TestCase): def setUp(self): self.app = create_app({"TESTING": True, "SECRET_KEY": "test-secret"}) self.client = self.app.test_client() def csrf(self): self.client.get("/") with self.client.session_transaction() as browser_session: return browser_session["csrf_token"] def test_login_form_requires_csrf(self): response = self.client.post( "/browser", data={"action": "login", "name": "alice", "password": "legacy_pwd"}, ) self.assertEqual(response.status_code, 400) @patch("flower_vase.Flower", FakeVault) def test_login_renders_existing_entries(self): response = self.client.post( "/browser", data={ "csrf_token": self.csrf(), "action": "login", "name": "alice", "password": "legacy_pwd", }, follow_redirects=True, ) self.assertEqual(response.status_code, 200) self.assertIn(b"Acme", response.data) with self.client.session_transaction() as browser_session: self.assertNotIn("dbpwd", browser_session) self.assertNotIn("password", browser_session) self.assertIn("auth_token", browser_session) @patch("flower_vase.Flower", FakeVault) def test_legacy_api_keeps_double_encoded_list(self): response = self.client.post( "/app", data={"action": "list", "name": "alice", "password": "legacy_pwd"}, ) payload = response.get_json() nested = json.loads(payload["list"]) self.assertEqual(payload["result"], 1) self.assertEqual(nested[0]["organization"], "Acme") if __name__ == "__main__": unittest.main()