mirror of
https://github.com/azaion/detections.git
synced 2026-04-22 21:46:31 +00:00
Oleksandr Bezdieniezhnykh
097811a67b
- Pin all deps; h11==0.16.0 (CVE-2025-43859), python-multipart>=1.3.1 (CVE-2026-28356), PyJWT==2.12.1
- Add HMAC JWT verification (require_auth FastAPI dependency, JWT_SECRET-gated)
- Fix TokenManager._refresh() to use ADMIN_API_URL instead of ANNOTATIONS_URL
- Rename POST /detect → POST /detect/image (image-only, rejects video files)
- Replace global SSE stream with per-job SSE: GET /detect/{media_id} with event replay buffer
- Apply require_auth to all 4 protected endpoints
- Fix on_annotation/on_status closure to use mutable current_id for correct post-upload event routing
- Add non-root appuser to Dockerfile and Dockerfile.gpu
- Add JWT_SECRET to e2e/docker-compose.test.yml and run-tests.sh
- Update all e2e tests and unit tests for new endpoints and HMAC token signing
- 64/64 tests pass
Made-with: Cursor
48 lines
1.3 KiB
Python
48 lines
1.3 KiB
Python
import os
|
|
|
|
import pytest
|
|
import requests
|
|
|
|
|
|
def test_nft_sec_01_malformed_multipart(base_url, http_client):
|
|
url = f"{base_url.rstrip('/')}/detect/image"
|
|
r1 = requests.post(
|
|
url,
|
|
data=b"not-multipart-body",
|
|
headers={"Content-Type": "multipart/form-data"},
|
|
timeout=30,
|
|
)
|
|
assert r1.status_code in (400, 422)
|
|
r2 = requests.post(
|
|
url,
|
|
data=b"does-not-match-boundary",
|
|
headers={"Content-Type": "multipart/form-data; boundary=----abc"},
|
|
timeout=30,
|
|
)
|
|
assert r2.status_code in (400, 422)
|
|
r3 = requests.post(
|
|
url,
|
|
files={"file": ("", b"", "")},
|
|
timeout=30,
|
|
)
|
|
assert r3.status_code in (400, 401, 422)
|
|
assert http_client.get("/health").status_code == 200
|
|
|
|
|
|
@pytest.mark.timeout(30)
|
|
def test_nft_sec_02_oversized_request(http_client, auth_headers):
|
|
large = os.urandom(50 * 1024 * 1024)
|
|
try:
|
|
r = http_client.post(
|
|
"/detect/image",
|
|
files={"file": ("large.jpg", large, "image/jpeg")},
|
|
headers=auth_headers,
|
|
timeout=15,
|
|
)
|
|
except requests.RequestException:
|
|
pass
|
|
else:
|
|
assert r.status_code != 500
|
|
assert r.status_code in (413, 400, 422)
|
|
assert http_client.get("/health").status_code == 200
|