davideandClaude Sonnet 5
22e3cfb2be
They enumerate the entire API surface, admin endpoints included, to anyone who requests them. Gate them behind a new ENABLE_API_DOCS setting (off by default) and update README/docs and BUGS.md/CLAUDE.md open-bug counts accordingly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
29 lines
810 B
Python
29 lines
810 B
Python
"""B-42: Swagger/ReDoc/OpenAPI JSON must not be reachable unless explicitly enabled —
|
|
they enumerate the whole API surface, admin endpoints included."""
|
|
|
|
import importlib
|
|
|
|
from app.config import settings
|
|
|
|
|
|
def _reload_main():
|
|
import app.main
|
|
|
|
return importlib.reload(app.main)
|
|
|
|
|
|
def test_docs_disabled_by_default(monkeypatch):
|
|
monkeypatch.setattr(settings, "enable_api_docs", False)
|
|
main = _reload_main()
|
|
assert main.app.docs_url is None
|
|
assert main.app.redoc_url is None
|
|
assert main.app.openapi_url is None
|
|
|
|
|
|
def test_docs_enabled_when_configured(monkeypatch):
|
|
monkeypatch.setattr(settings, "enable_api_docs", True)
|
|
main = _reload_main()
|
|
assert main.app.docs_url == "/docs"
|
|
assert main.app.redoc_url == "/redoc"
|
|
assert main.app.openapi_url == "/openapi.json"
|