feat: fail closed on invalid dashboard auth (#262)

tests/test_dashboard_auth.py

@@ -6,10 +6,72 @@ from src import main
 
 @pytest.fixture
 def access_control(monkeypatch):
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_AUTH_MODE", "operator")
     monkeypatch.setenv("STACKCHAIN_DASHBOARD_ACCESS_TOKEN", "correct horse battery staple")
     monkeypatch.setenv("STACKCHAIN_DASHBOARD_SESSION_SECRET", "a-separate-session-signing-secret-with-enough-entropy")
 
 
+@pytest.mark.anyio
+async def test_default_operator_mode_fails_closed_before_gitea_when_secrets_are_missing(monkeypatch):
+    monkeypatch.delenv("STACKCHAIN_DASHBOARD_AUTH_MODE", raising=False)
+    called = False
+
+    async def user():
+        nonlocal called
+        called = True
+        return {"id": 1, "login": "timmy"}
+
+    monkeypatch.setattr(main, "current_user", user)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        health = await client.get("/healthz")
+        responses = [
+            await client.get("/readyz"),
+            await client.get("/login"),
+            await client.get("/"),
+            await client.get("/api/v1/context"),
+        ]
+
+    assert health.status_code == 200
+    assert [response.status_code for response in responses] == [503, 503, 503, 503]
+    assert all(response.headers["cache-control"] == "no-store" for response in responses)
+    assert all(response.json() == {
+        "detail": "Dashboard authentication is not configured"
+    } for response in responses)
+    assert called is False
+
+
+@pytest.mark.anyio
+async def test_operator_mode_rejects_reused_or_incomplete_secrets(monkeypatch):
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_AUTH_MODE", "operator")
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_ACCESS_TOKEN", "same-secret-with-at-least-thirty-two-characters")
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_SESSION_SECRET", "same-secret-with-at-least-thirty-two-characters")
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        reused = await client.get("/login")
+        monkeypatch.setenv("STACKCHAIN_DASHBOARD_SESSION_SECRET", "")
+        incomplete = await client.get("/login")
+
+    assert reused.status_code == 503
+    assert incomplete.status_code == 503
+    assert "same-secret" not in reused.text
+
+
+@pytest.mark.anyio
+async def test_insecure_local_mode_is_restricted_to_loopback(monkeypatch):
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_AUTH_MODE", "insecure-local")
+    local_transport = httpx.ASGITransport(app=main.app, client=("127.0.0.1", 1234))
+    remote_transport = httpx.ASGITransport(app=main.app, client=("203.0.113.9", 1234))
+    async with httpx.AsyncClient(transport=local_transport, base_url="http://test") as client:
+        local = await client.get("/login")
+    async with httpx.AsyncClient(transport=remote_transport, base_url="http://test") as client:
+        remote = await client.get("/login")
+
+    assert local.status_code == 200
+    assert remote.status_code == 403
+    assert remote.json() == {"detail": "Insecure local mode requires a loopback client"}
+
+
 @pytest.mark.anyio
 async def test_anonymous_private_request_is_rejected_before_gitea(access_control, monkeypatch):
     called = False