29 lines
810 B
Python
29 lines
810 B
Python
 
|
"""B-42: Swagger/ReDoc/OpenAPI JSON must not be reachable unless explicitly enabled —
|
||
|
|
they enumerate the whole API surface, admin endpoints included."""
|
||
|
|
|
||
|
|
import importlib
|
||
|
|
|
||
|
|
from app.config import settings
|
||
|
|
|
||
|
|
|
||
|
|
def _reload_main():
|
||
|
|
import app.main
|
||
|
|
|
||
|
|
return importlib.reload(app.main)
|
||
|
|
|
||
|
|
|
||
|
|
def test_docs_disabled_by_default(monkeypatch):
|
||
|
|
monkeypatch.setattr(settings, "enable_api_docs", False)
|
||
|
|
main = _reload_main()
|
||
|
|
assert main.app.docs_url is None
|
||
|
|
assert main.app.redoc_url is None
|
||
|
|
assert main.app.openapi_url is None
|
||
|
|
|
||
|
|
|
||
|
|
def test_docs_enabled_when_configured(monkeypatch):
|
||
|
|
monkeypatch.setattr(settings, "enable_api_docs", True)
|
||
|
|
main = _reload_main()
|
||
|
|
assert main.app.docs_url == "/docs"
|
||
|
|
assert main.app.redoc_url == "/redoc"
|
||
|
|
assert main.app.openapi_url == "/openapi.json"
|