add ssrf-safe website analysis

apps/api/tests/test_phase8_api.py

@@ -0,0 +1,62 @@
+import json
+import os
+import threading
+import unittest
+from http.client import HTTPConnection
+from tempfile import TemporaryDirectory
+from unittest.mock import patch
+
+from app.main import create_server
+
+
+class WebsiteScanApiTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = TemporaryDirectory()
+        os.environ['BOOTSTRAP_ADMIN_EMAIL'] = 'scan-owner@example.test'
+        os.environ['BOOTSTRAP_ADMIN_PASSWORD'] = 'password'
+        self.server = create_server('127.0.0.1', 0, self.tmp.name + '/db.sqlite')
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True); self.thread.start()
+        self.conn = HTTPConnection('127.0.0.1', self.server.server_port, timeout=4); self.cookie = None
+        self.request('POST', '/api/v1/auth/login', {'email': 'scan-owner@example.test', 'password': 'password'})
+
+    def tearDown(self):
+        self.server.shutdown(); self.server.server_close(); self.thread.join(2); self.tmp.cleanup()
+
+    def request(self, method, path, payload=None):
+        body = json.dumps(payload).encode() if payload is not None else None; headers = {'Content-Type': 'application/json'} if body else {}
+        if self.cookie: headers['Cookie'] = self.cookie
+        self.conn.request(method, path, body, headers); response = self.conn.getresponse(); cookie = response.getheader('Set-Cookie')
+        if cookie: self.cookie = cookie.split(';', 1)[0]
+        return response.status, json.loads(response.read() or b'{}')
+
+    def test_scan_is_cached_history_is_listed_and_audited(self):
+        _, business = self.request('POST', '/api/v1/businesses', {'name': 'Scan Co', 'website': 'https://scan.example'})
+        result = {'classification': 'healthy', 'status': 200, 'final_url': 'https://scan.example/', 'redirect_chain': []}
+        with patch('app.main.validate_url', return_value='https://scan.example/'), patch('app.main.scan_website', return_value=result) as scanner:
+            first_status, first = self.request('POST', f"/api/v1/businesses/{business['id']}/websites/scan", {})
+            second_status, second = self.request('POST', f"/api/v1/businesses/{business['id']}/websites/scan", {})
+        self.assertEqual(first_status, 201); self.assertEqual(second_status, 200); self.assertTrue(second['cache_hit']); scanner.assert_called_once()
+        status, history = self.request('GET', '/api/v1/website-scans?page_size=1')
+        self.assertEqual(status, 200); self.assertEqual(len(history['items']), 1); self.assertFalse(history['has_more'])
+        self.assertEqual(history['items'][0]['classification'], 'healthy')
+        self.assertEqual(self.request('GET', '/api/v1/website-scans?business_id=999999')[1]['items'], [])
+
+    def test_get_latest_scan_returns_scan_payload(self):
+        _, business = self.request('POST', '/api/v1/businesses', {'name': 'Read Scan Co', 'website': 'https://read.example'})
+        result = {'classification': 'unknown', 'status': 200, 'final_url': 'https://read.example/', 'redirect_chain': []}
+        with patch('app.main.validate_url', return_value='https://read.example/'), patch('app.main.scan_website', return_value=result):
+            self.assertEqual(self.request('POST', f"/api/v1/businesses/{business['id']}/websites/scan", {})[0], 201)
+        status, payload = self.request('GET', f"/api/v1/businesses/{business['id']}/websites/scan")
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['classification'], 'unknown')
+        self.assertEqual(payload['business_id'], business['id'])
+
+    def test_unsafe_scan_is_rejected_without_fetching(self):
+        _, business = self.request('POST', '/api/v1/businesses', {'name': 'Private Scan', 'website': 'http://127.0.0.1/'})
+        with patch('app.main.scan_website') as scanner:
+            status, payload = self.request('POST', f"/api/v1/businesses/{business['id']}/websites/scan", {})
+        self.assertEqual(status, 400); self.assertEqual(payload['error'], 'unsafe_url'); scanner.assert_not_called()
+
+
+if __name__ == '__main__':
+    unittest.main()