diff options
Diffstat (limited to 'packages/meshbay-node/tests/test_tmdb_config_policy.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_tmdb_config_policy.py | 103 |
1 files changed, 42 insertions, 61 deletions
diff --git a/packages/meshbay-node/tests/test_tmdb_config_policy.py b/packages/meshbay-node/tests/test_tmdb_config_policy.py index 29ef54c..c1781e3 100644 --- a/packages/meshbay-node/tests/test_tmdb_config_policy.py +++ b/packages/meshbay-node/tests/test_tmdb_config_policy.py @@ -1,9 +1,14 @@ """ -The operator decides whether the node calls TMDB at all, and whether it uses -a custom API token — docs/mediacenter.md §5.5. Same shape as -test_apps_enabled_policy.py/test_scan_settings_policy.py: a signed operator -instruction, node-wide (group_id="") rather than per-group, stored via -roster.py's group_settings table. +The operator's custom TMDB API token and query language — docs/mediacenter.md +§5.5. Same shape as test_apps_enabled_policy.py/test_scan_settings_policy.py: +a signed operator instruction, node-wide (group_id="") rather than per-group, +stored via roster.py's group_settings table. + +Whether TMDB is used *at all* used to live in this same op — moved to its +own per-group op (test_tmdb_enabled_policy.py, 2026-08-24): a real +media-library group and a test/demo group on the same node need not share +that decision, while the token and query language stay one operator's +shared credential/cache. Specific to this one: the subject signed/audited must never contain the token itself (it would end up in the audit log in plaintext) — only whether @@ -55,51 +60,39 @@ def _fake_challenge(issued: list): # ── Refused before a challenge is even issued ─────────────────────────────── -async def test_missing_enabled_is_refused(tmp_path): +async def test_non_string_token_is_refused(tmp_path): session = _session(tmp_path, "op", operator="op") session._has_admin_authority = lambda: True issued = [] session._issue_admin_challenge = _fake_challenge(issued) - session._do_tmdb_config({}) + session._do_tmdb_config({"token": 12345}) assert not issued assert [m for m in session.sent if m.get("type") == "error"] -async def test_non_bool_enabled_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = _fake_challenge(issued) +async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): + session = _session(tmp_path, "member-1", operator="the-operator") + session._has_admin_authority = lambda: False - session._do_tmdb_config({"enabled": "yes"}) + session._do_tmdb_config({"token": "x"}) - assert not issued assert [m for m in session.sent if m.get("type") == "error"] -async def test_non_string_token_is_refused(tmp_path): +async def test_non_string_language_is_refused(tmp_path): session = _session(tmp_path, "op", operator="op") session._has_admin_authority = lambda: True issued = [] session._issue_admin_challenge = _fake_challenge(issued) - session._do_tmdb_config({"enabled": True, "token": 12345}) + session._do_tmdb_config({"language": 42}) assert not issued assert [m for m in session.sent if m.get("type") == "error"] -async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): - session = _session(tmp_path, "member-1", operator="the-operator") - session._has_admin_authority = lambda: False - - session._do_tmdb_config({"enabled": False}) - - assert [m for m in session.sent if m.get("type") == "error"] - - # ── Who may change it, and what gets signed ───────────────────────────────── async def test_changing_it_needs_a_signature(tmp_path): @@ -108,7 +101,7 @@ async def test_changing_it_needs_a_signature(tmp_path): issued = [] session._issue_admin_challenge = _fake_challenge(issued) - session._do_tmdb_config({"enabled": True}) + session._do_tmdb_config({}) assert len(issued) == 1 op, subject, payload, group_id = issued[0] @@ -125,23 +118,23 @@ async def test_the_token_itself_never_appears_in_the_signed_subject(tmp_path): session._issue_admin_challenge = _fake_challenge(issued) secret = "sk-super-secret-tmdb-token" - session._do_tmdb_config({"enabled": True, "token": secret}) + session._do_tmdb_config({"token": secret}) _, subject, payload, _ = issued[0] assert secret not in subject assert payload["token"] == secret, "the real value still has to reach the exec step somehow" -async def test_subject_reflects_enabled_and_whether_a_token_was_supplied(tmp_path): +async def test_subject_reflects_whether_a_token_was_supplied(tmp_path): session = _session(tmp_path, "op", operator="op") session._has_admin_authority = lambda: True issued = [] session._issue_admin_challenge = _fake_challenge(issued) - session._do_tmdb_config({"enabled": False, "token": "x"}) + session._do_tmdb_config({"token": "x"}) _, subject, _, _ = issued[0] - assert subject == "enabled=False,custom_token=yes,language=default" + assert subject == "custom_token=yes,language=default" async def test_subject_says_no_custom_token_when_none_given(tmp_path): @@ -150,10 +143,10 @@ async def test_subject_says_no_custom_token_when_none_given(tmp_path): issued = [] session._issue_admin_challenge = _fake_challenge(issued) - session._do_tmdb_config({"enabled": True}) + session._do_tmdb_config({}) _, subject, _, _ = issued[0] - assert subject == "enabled=True,custom_token=no,language=default" + assert subject == "custom_token=no,language=default" async def test_subject_reflects_a_configured_language(tmp_path): @@ -162,44 +155,32 @@ async def test_subject_reflects_a_configured_language(tmp_path): issued = [] session._issue_admin_challenge = _fake_challenge(issued) - session._do_tmdb_config({"enabled": True, "language": "fr-FR"}) + session._do_tmdb_config({"language": "fr-FR"}) _, subject, payload, _ = issued[0] - assert subject == "enabled=True,custom_token=no,language=fr-FR" + assert subject == "custom_token=no,language=fr-FR" assert payload["language"] == "fr-FR" -async def test_non_string_language_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = _fake_challenge(issued) - - session._do_tmdb_config({"enabled": True, "language": 42}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - # ── Where it is stored ────────────────────────────────────────────────────── async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path): roster = Roster(db_path=tmp_path / "roster.db") await roster.open() try: - enabled, token, language = await roster.tmdb_config() - assert (enabled, token, language) == (True, None, None), ( - "absent must mean on, with the shipped default token, TMDB's own default language") - await roster.set_tmdb_config(True, "my-custom-token", "fr-FR", set_by="op") - enabled, token, language = await roster.tmdb_config() - assert (enabled, token, language) == (True, "my-custom-token", "fr-FR") + token, language = await roster.tmdb_config() + assert (token, language) == (None, None), ( + "absent must mean the shipped default token, TMDB's own default language") + await roster.set_tmdb_config("my-custom-token", "fr-FR", set_by="op") + token, language = await roster.tmdb_config() + assert (token, language) == ("my-custom-token", "fr-FR") finally: await roster.close() reopened = Roster(db_path=tmp_path / "roster.db") await reopened.open() try: - assert await reopened.tmdb_config() == (True, "my-custom-token", "fr-FR") + assert await reopened.tmdb_config() == ("my-custom-token", "fr-FR") finally: await reopened.close() @@ -208,11 +189,11 @@ async def test_clearing_the_token_reverts_to_the_default(tmp_path): roster = Roster(db_path=tmp_path / "roster.db") await roster.open() try: - await roster.set_tmdb_config(True, "a-token", set_by="op") - assert (await roster.tmdb_config())[1] == "a-token" + await roster.set_tmdb_config("a-token", set_by="op") + assert (await roster.tmdb_config())[0] == "a-token" - await roster.set_tmdb_config(True, "", set_by="op") - enabled, token, language = await roster.tmdb_config() + await roster.set_tmdb_config("", set_by="op") + token, language = await roster.tmdb_config() assert token is None, "an explicit empty string clears the custom token" finally: await roster.close() @@ -222,9 +203,9 @@ async def test_omitting_the_token_leaves_it_unchanged(tmp_path): roster = Roster(db_path=tmp_path / "roster.db") await roster.open() try: - await roster.set_tmdb_config(True, "a-token", set_by="op") - await roster.set_tmdb_config(False, None, set_by="op") - enabled, token, language = await roster.tmdb_config() - assert (enabled, token) == (False, "a-token") + await roster.set_tmdb_config("a-token", set_by="op") + await roster.set_tmdb_config(set_by="op") + token, language = await roster.tmdb_config() + assert token == "a-token" finally: await roster.close() |