lukasandClaude Opus 5.5
addb2232a1
Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
server level and nginx dropped them in any location with its own header.
CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
addresses counted as non-public.
Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
85 lines
3.2 KiB
Python
85 lines
3.2 KiB
Python
"""Shared test fixtures and environment defaults.
|
|
|
|
Ensures the SPEC §14 env vars exist even when tests run outside the conda
|
|
activate hook (e.g. CI), so ``app.config`` imports cleanly.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import os
|
|
|
|
os.environ.setdefault("APP_DOMAIN", "test.webmail.local")
|
|
os.environ.setdefault(
|
|
"DATABASE_URL", "postgresql+asyncpg://webmail:webmail_dev@127.0.0.1:5433/webmail_dev"
|
|
)
|
|
# Force a dedicated Redis DB for tests (index 15) so the suite is isolated from the
|
|
# dev app's Redis (DB 0) and can be flushed between tests without touching real data.
|
|
os.environ["REDIS_URL"] = "redis://127.0.0.1:6380/15"
|
|
os.environ.setdefault("MASTER_KEY", base64.b64encode(b"\x00" * 32).decode())
|
|
os.environ.setdefault("BLOB_ROOT", "./var/blobs-test")
|
|
# Hosted mailboxes off: tests that need the mail server turn them on themselves
|
|
# (tests/hosted/), against the dev stack's Stalwart container.
|
|
os.environ["HOSTED_MAILBOXES"] = "false"
|
|
# No calls to the breached-password service from tests (app/identity/password_policy.py).
|
|
os.environ["PASSWORD_BREACH_CHECK"] = "false"
|
|
for _key, _value in {
|
|
"STALWART_URL": "http://127.0.0.1:8180",
|
|
"STALWART_ADMIN_SECRET": "stalwart_admin_dev",
|
|
"STALWART_MASTER_SECRET": "stalwart_master_dev",
|
|
"STALWART_IMAP_HOST": "127.0.0.1",
|
|
"STALWART_IMAP_PORT": "1993",
|
|
"STALWART_SMTP_HOST": "127.0.0.1",
|
|
"STALWART_SMTP_PORT": "1465",
|
|
}.items():
|
|
os.environ.setdefault(_key, _value)
|
|
|
|
from collections.abc import AsyncIterator # noqa: E402
|
|
|
|
import pytest_asyncio # noqa: E402
|
|
from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine # noqa: E402
|
|
from sqlalchemy.pool import NullPool # noqa: E402
|
|
|
|
from app.config import get_settings # noqa: E402
|
|
|
|
|
|
@pytest_asyncio.fixture(autouse=True)
|
|
async def _reset_global_engine() -> AsyncIterator[None]:
|
|
"""Dispose process-wide async resources after each test.
|
|
|
|
Each test runs on its own event loop; disposing here ensures the next test
|
|
(and any code using the global engine/redis, e.g. the search backend) rebinds
|
|
to its own loop rather than reusing a closed one.
|
|
"""
|
|
from app.redis_client import get_redis
|
|
|
|
# Flush the dedicated test Redis DB so rate-limit / session / token state does
|
|
# not leak between tests (each test starts from a clean slate).
|
|
await get_redis().flushdb()
|
|
yield
|
|
from app.db import dispose_engine
|
|
from app.queue import close_arq_pool
|
|
from app.redis_client import close_redis
|
|
|
|
await dispose_engine()
|
|
await close_redis()
|
|
# The arq enqueue pool is a loop-bound global like the engine/redis; reset it so
|
|
# a test that enqueues doesn't reuse a pool from a previous (closed) event loop.
|
|
await close_arq_pool()
|
|
|
|
|
|
@pytest_asyncio.fixture
|
|
async def db_session() -> AsyncIterator[AsyncSession]:
|
|
"""Rollback-per-test session (nothing persists to the dev database)."""
|
|
engine = create_async_engine(get_settings().database_url, poolclass=NullPool)
|
|
conn = await engine.connect()
|
|
trans = await conn.begin()
|
|
session = AsyncSession(bind=conn, expire_on_commit=False)
|
|
try:
|
|
yield session
|
|
finally:
|
|
await session.close()
|
|
await trans.rollback()
|
|
await conn.close()
|
|
await engine.dispose()
|