83 lines
6.7 KiB
Python
83 lines
6.7 KiB
Python
import json
|
|
import os
|
|
import sqlite3
|
|
import threading
|
|
import unittest
|
|
from http.client import HTTPConnection
|
|
from tempfile import TemporaryDirectory
|
|
|
|
from app.main import create_server, hash_password
|
|
|
|
|
|
class Phase14ApiTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.tmp = TemporaryDirectory()
|
|
self.old = {k: os.environ.get(k) for k in ("BOOTSTRAP_ADMIN_EMAIL", "BOOTSTRAP_ADMIN_PASSWORD")}
|
|
os.environ["BOOTSTRAP_ADMIN_EMAIL"] = "outreach-owner@example.test"
|
|
os.environ["BOOTSTRAP_ADMIN_PASSWORD"] = "outreach-password"
|
|
self.db_path = self.tmp.name + "/outreach.db"
|
|
self.server = create_server("127.0.0.1", 0, self.db_path)
|
|
self.thread = threading.Thread(target=self.server.serve_forever, daemon=True); self.thread.start()
|
|
self.conn = HTTPConnection("127.0.0.1", self.server.server_port, timeout=3); self.cookie = None
|
|
self.request("POST", "/api/v1/auth/login", {"email": "outreach-owner@example.test", "password": "outreach-password"})
|
|
|
|
def tearDown(self):
|
|
self.server.shutdown(); self.server.server_close(); self.thread.join(timeout=2); self.tmp.cleanup()
|
|
for k, v in self.old.items():
|
|
if v is None: os.environ.pop(k, None)
|
|
else: os.environ[k] = v
|
|
|
|
def request(self, method, path, payload=None):
|
|
body = json.dumps(payload).encode() if payload is not None else None
|
|
headers = {"Content-Type": "application/json"} if body else {}
|
|
if self.cookie: headers["Cookie"] = self.cookie
|
|
self.conn.request(method, path, body, headers); response = self.conn.getresponse()
|
|
if response.getheader("Set-Cookie"): self.cookie = response.getheader("Set-Cookie").split(";", 1)[0]
|
|
return response.status, json.loads(response.read() or b"{}")
|
|
|
|
def business(self, email="target@example.test"):
|
|
status, item = self.request("POST", "/api/v1/businesses", {"name": "Target Co", "website": "https://target.test", "email": email})
|
|
self.assertEqual(status, 201); return item
|
|
|
|
def test_draft_lifecycle_is_evidence_grounded_and_audited(self):
|
|
b = self.business(); bid = b["id"]
|
|
self.request("POST", f"/api/v1/businesses/{bid}/evidence", {"kind": "source", "url": "https://target.test/about", "claim": "Makes solar panels"})
|
|
status, draft = self.request("POST", f"/api/v1/businesses/{bid}/outreach/drafts", {"target": {"kind": "email", "value": "target@example.test", "verified": True}, "subject": "Hello {{business.name}}", "body": "We saw: {{evidence.1.claim}}", "idempotency_key": "draft-1"})
|
|
self.assertEqual(status, 201); self.assertEqual(draft["status"], "pending_review"); self.assertIn("Target Co", draft["subject"]); self.assertIn("Makes solar panels", draft["body"])
|
|
self.assertEqual(len(draft["citations"]), 1); self.assertEqual(self.request("POST", f"/api/v1/businesses/{bid}/outreach/drafts", {"target": {"kind": "email", "value": "target@example.test", "verified": True}, "subject": "ignored", "body": "ignored", "idempotency_key": "draft-1"})[0], 200)
|
|
self.assertEqual(self.request("PATCH", f"/api/v1/outreach/drafts/{draft['id']}", {"body": "Updated {{evidence.1.claim}}"})[0], 200)
|
|
status, approved = self.request("POST", f"/api/v1/outreach/drafts/{draft['id']}/approve", {}); self.assertEqual(status, 200); self.assertEqual(approved["status"], "approved")
|
|
db = sqlite3.connect(self.db_path); actions = [r[0] for r in db.execute("SELECT action FROM audit_log")]; db.close()
|
|
self.assertTrue({"outreach_draft.created", "outreach_draft.updated", "outreach_draft.approved"}.issubset(actions))
|
|
|
|
def test_send_is_not_configured_and_all_gates_are_reported(self):
|
|
b = self.business(); bid = b["id"]
|
|
_, d = self.request("POST", f"/api/v1/businesses/{bid}/outreach/drafts", {"target": {"kind": "email", "value": "target@example.test", "verified": False}, "subject": "Hi", "body": "Body"})
|
|
status, result = self.request("POST", f"/api/v1/outreach/drafts/{d['id']}/send", {}); self.assertEqual(status, 409); self.assertEqual(result["status"], "not_configured"); self.assertIn("provider", result["blocked_reasons"])
|
|
|
|
def test_suppression_and_unapproved_target_block_send_and_no_network(self):
|
|
b = self.business(); bid = b["id"]
|
|
self.request("PATCH", "/api/v1/outreach/provider-config", {"provider": "smtp", "enabled": True, "secret": "test-secret", "legal_policy": {"consent_required": False}})
|
|
self.request("POST", "/api/v1/suppressions", {"kind": "email", "value": "target@example.test"})
|
|
_, d = self.request("POST", f"/api/v1/businesses/{bid}/outreach/drafts", {"target": {"kind": "email", "value": "target@example.test", "verified": True}, "subject": "Hi", "body": "Body"})
|
|
self.request("POST", f"/api/v1/outreach/drafts/{d['id']}/approve", {})
|
|
status, result = self.request("POST", f"/api/v1/outreach/drafts/{d['id']}/send", {}); self.assertEqual(status, 409); self.assertEqual(result["status"], "blocked"); self.assertIn("suppressed", result["blocked_reasons"]); self.assertFalse(result["network_send"])
|
|
|
|
def test_provider_config_never_returns_secret_and_tenant_isolation(self):
|
|
status, config = self.request("PATCH", "/api/v1/outreach/provider-config", {"provider": "smtp", "enabled": True, "secret": "super-secret", "legal_policy": {"consent_required": True}})
|
|
self.assertEqual(status, 200); self.assertNotIn("secret", json.dumps(config).lower()); self.assertTrue(config["enabled"])
|
|
self.assertNotIn("super-secret", json.dumps(config))
|
|
ph, salt = hash_password("other-password"); db = sqlite3.connect(self.db_path); db.execute("INSERT INTO organizations(id,name) VALUES('other-tenant','Other')"); db.execute("INSERT INTO users(organization_id,email,password_hash,password_salt,role) VALUES(?,?,?,?,?)", ("other-tenant", "other@example.test", ph, salt, "owner")); db.commit(); db.close()
|
|
self.cookie = None; self.assertEqual(self.request("POST", "/api/v1/auth/login", {"email": "other@example.test", "password": "other-password"})[0], 200)
|
|
self.assertEqual(self.request("GET", "/api/v1/outreach/provider-config")[1]["enabled"], False)
|
|
self.assertEqual(self.request("GET", "/api/v1/outreach/drafts")[1]["items"], [])
|
|
|
|
def test_limits_and_unknown_template_variable(self):
|
|
b = self.business(); bid = b["id"]
|
|
status, result = self.request("POST", f"/api/v1/businesses/{bid}/outreach/drafts", {"target": {"kind": "email", "value": "target@example.test", "verified": True}, "subject": "Hi {{not.evidence}}", "body": "Body"})
|
|
self.assertEqual(status, 400); self.assertEqual(result["error"], "unsupported_template_variable")
|
|
self.assertEqual(self.request("GET", "/api/v1/outreach/drafts?page_size=101")[0], 400)
|
|
|
|
|
|
if __name__ == "__main__": unittest.main()
|