Files
detections/e2e/tests/test_streaming_video_upload.py
T
Oleksandr Bezdieniezhnykh 097811a67b [AZ-178] Fix Critical/High security findings: auth, CVEs, non-root containers, per-job SSE
- Pin all deps; h11==0.16.0 (CVE-2025-43859), python-multipart>=1.3.1 (CVE-2026-28356), PyJWT==2.12.1
- Add HMAC JWT verification (require_auth FastAPI dependency, JWT_SECRET-gated)
- Fix TokenManager._refresh() to use ADMIN_API_URL instead of ANNOTATIONS_URL
- Rename POST /detect → POST /detect/image (image-only, rejects video files)
- Replace global SSE stream with per-job SSE: GET /detect/{media_id} with event replay buffer
- Apply require_auth to all 4 protected endpoints
- Fix on_annotation/on_status closure to use mutable current_id for correct post-upload event routing
- Add non-root appuser to Dockerfile and Dockerfile.gpu
- Add JWT_SECRET to e2e/docker-compose.test.yml and run-tests.sh
- Update all e2e tests and unit tests for new endpoints and HMAC token signing
- 64/64 tests pass

Made-with: Cursor
2026-04-02 06:32:12 +03:00

129 lines
3.7 KiB
Python

"""
AZ-178: True streaming video detection — e2e tests.
Both tests upload video_test01.mp4 (12 MB), wait for the first SSE event,
then stop. The goal is to prove the service starts and produces detections,
not to process the whole file.
Run with: pytest e2e/tests/test_streaming_video_upload.py -s -v
"""
import json
import threading
import time
from pathlib import Path
import pytest
import sseclient
FIXTURES_DIR = Path(__file__).resolve().parent.parent / "fixtures"
_TIMEOUT = 5.0
_STOP_AFTER = 5
def _fixture_path(name: str) -> str:
p = FIXTURES_DIR / name
if not p.is_file():
pytest.skip(f"missing fixture {p}")
return str(p)
def _chunked_reader(path: str, chunk_size: int = 64 * 1024):
with open(path, "rb") as f:
while True:
chunk = f.read(chunk_size)
if not chunk:
break
yield chunk
def _start_sse_listener(
http_client, media_id: str, auth_headers: dict
) -> tuple[list[dict], list[BaseException], threading.Event]:
events: list[dict] = []
errors: list[BaseException] = []
first_event = threading.Event()
def _listen():
try:
with http_client.get(
f"/detect/{media_id}",
stream=True,
timeout=_TIMEOUT + 2,
headers=auth_headers,
) as resp:
resp.raise_for_status()
for event in sseclient.SSEClient(resp).events():
if not event.data or not str(event.data).strip():
continue
events.append(json.loads(event.data))
if len(events) >= _STOP_AFTER:
first_event.set()
break
except BaseException as exc:
errors.append(exc)
finally:
first_event.set()
threading.Thread(target=_listen, daemon=True).start()
return events, errors, first_event
@pytest.mark.timeout(10)
def test_streaming_video_detections_appear_during_upload(
warm_engine, http_client, auth_headers
):
# Arrange
video_path = _fixture_path("video_test01.mp4")
# Act
r = http_client.post(
"/detect/video",
data=_chunked_reader(video_path),
headers={
**auth_headers,
"X-Filename": "video_test01.mp4",
"Content-Type": "application/octet-stream",
},
timeout=8,
)
assert r.status_code == 200
media_id = r.json()["mediaId"]
events, errors, first_event = _start_sse_listener(http_client, media_id, auth_headers)
first_event.wait(timeout=_TIMEOUT)
# Assert
assert not errors, f"SSE thread error: {errors}"
assert len(events) >= 1, "Expected at least one SSE event within 5s"
print(f"\n First {len(events)} SSE events:")
for e in events:
print(f" {e}")
@pytest.mark.timeout(10)
def test_non_faststart_video_still_works(warm_engine, http_client, auth_headers):
# Arrange
video_path = _fixture_path("video_test01.mp4")
# Act
r = http_client.post(
"/detect/video",
data=_chunked_reader(video_path),
headers={
**auth_headers,
"X-Filename": "video_test01_plain.mp4",
"Content-Type": "application/octet-stream",
},
timeout=8,
)
assert r.status_code == 200
media_id = r.json()["mediaId"]
events, errors, first_event = _start_sse_listener(http_client, media_id, auth_headers)
first_event.wait(timeout=_TIMEOUT)
# Assert
assert not errors, f"SSE thread error: {errors}"
assert len(events) >= 1, "Expected at least one SSE event within 5s"
print(f"\n First {len(events)} SSE events:")
for e in events:
print(f" {e}")