Files
webmail-client/backend/tests/plugins/test_calendar_reminders.py
T
lukasandClaude Opus 5.5 addb2232a1 Security hardening from the assessment; testing fixes
Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
  server level and nginx dropped them in any location with its own header.
  CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
  HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
  breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
  endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
  IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
  addresses counted as non-public.

Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
  away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
  reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
  to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
  app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 22:08:06 +02:00

132 lines
4.9 KiB
Python

"""Event reminders as notifications (calendar plugin, sdk.push): due reminders
are sent once, repeating events remind on each occurrence, cancelled and
declined ones stay quiet."""
from __future__ import annotations
import uuid
from collections.abc import AsyncIterator
from datetime import UTC, datetime, timedelta
from typing import Any
import httpx
import pytest
import pytest_asyncio
from httpx import ASGITransport
from sqlalchemy import delete, text
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
from sqlalchemy.pool import NullPool
from webmail_plugin_calendar import reminders # type: ignore[import-not-found]
from app.config import get_settings
from app.identity.passwords import hash_password
from app.identity.sessions import create_session
from app.main import create_app
from app.models import User
from app.plugins.sdk import PluginPush
CAL = "/api/plugins/calendar"
# Far from any real event in the dev database.
MON_9 = datetime(2031, 6, 2, 9, 0, tzinfo=UTC) # a Monday
@pytest_asyncio.fixture
async def ctx(
monkeypatch: pytest.MonkeyPatch,
) -> AsyncIterator[tuple[httpx.AsyncClient, uuid.UUID, list[dict[str, Any]], Any]]:
sent: list[dict[str, Any]] = []
async def fake_notify(self: PluginPush, user_id: uuid.UUID, **kw: Any) -> int:
sent.append({"user_id": user_id, **kw})
return 1
monkeypatch.setattr(PluginPush, "notify", fake_notify)
engine = create_async_engine(get_settings().database_url, poolclass=NullPool)
sm = async_sessionmaker(engine, expire_on_commit=False)
async with sm() as s:
user = User(
handle=f"rem{uuid.uuid4().hex[:8]}@test.local", password_hash=hash_password("pw")
)
s.add(user)
await s.commit()
token = await create_session(user.id, "pytest")
client = httpx.AsyncClient(
transport=ASGITransport(app=create_app()),
base_url="http://testserver",
cookies={"session": token, "csrf": "c"},
headers={"X-CSRF": "c"},
)
try:
yield client, user.id, sent, sm
finally:
await client.aclose()
async with sm() as s:
await s.execute(
text("DELETE FROM plg_calendar_calendars WHERE user_id = :u"), {"u": str(user.id)}
)
await s.execute(text("DELETE FROM plugin_kv WHERE user_id = :u"), {"u": str(user.id)})
await s.execute(delete(User).where(User.id == user.id))
await s.commit()
await engine.dispose()
async def _event(client: httpx.AsyncClient, **fields: Any) -> str:
cal = (await client.get(f"{CAL}/calendars")).json()[0]["id"]
r = await client.post(f"{CAL}/events", json={"calendar_id": cal, **fields})
assert r.status_code == 200, r.text
return str(r.json()["id"])
async def test_due_reminders_are_sent_once(ctx) -> None: # type: ignore[no-untyped-def]
client, user_id, sent, sm = ctx
await _event(
client,
summary="Dentist",
location="Main St 4",
dtstart=MON_9.isoformat(),
dtend=(MON_9 + timedelta(hours=1)).isoformat(),
reminders=[10, 60],
)
called_off = await _event(
client, summary="Called off", dtstart=MON_9.isoformat(), reminders=[10]
)
async with sm() as db: # cancelled by its organizer: never reminds
await db.execute(
text("UPDATE plg_calendar_events SET status = 'cancelled' WHERE id = :id"),
{"id": called_off},
)
await db.commit()
async def run(at: datetime) -> int:
return await reminders.reminder_job({}, now=at, only_user=user_id)
assert await run(MON_9 - timedelta(minutes=61)) == 0 # nothing due yet
assert await run(MON_9 - timedelta(minutes=60)) == 1 # the 1-hour reminder
assert sent[-1]["title"] == "Dentist"
assert sent[-1]["body"] == "In 1 hour, 09:00 · Main St 4"
assert sent[-1]["url"].startswith("/p/calendar?date=2031-06-02&event=")
assert sent[-1]["sticky"] is True
assert await run(MON_9 - timedelta(minutes=59)) == 0 # not again
# The worker was down when the 10-minute reminder came due: sent late, once.
assert await run(MON_9 - timedelta(minutes=4)) == 1
assert sent[-1]["body"] == "In 10 minutes, 09:00 · Main St 4"
assert await run(MON_9 - timedelta(minutes=3)) == 0
assert len(sent) == 2
async def test_repeating_events_remind_on_each_occurrence(ctx) -> None: # type: ignore[no-untyped-def]
client, user_id, sent, _ = ctx
await _event(
client,
summary="Weekly sync",
dtstart=MON_9.isoformat(),
dtend=(MON_9 + timedelta(minutes=30)).isoformat(),
rrule="FREQ=WEEKLY;BYDAY=MO",
reminders=[15],
)
for week in range(3):
at = MON_9 + timedelta(weeks=week) - timedelta(minutes=15)
assert await reminders.reminder_job({}, now=at, only_user=user_id) == 1
tags = {s["tag"] for s in sent}
assert len(sent) == 3 and len(tags) == 3 # one notification per occurrence