feat: harden public install guide loading

2026-05-22 23:29:58 +03:00
parent 40414264be
commit 17224b4f74
4 changed files with 95 additions and 3 deletions
@@ -206,6 +206,71 @@ class SubscriptionGuidesRouteTests(unittest.IsolatedAsyncioTestCase):
        self.assertEqual(body["subscription"]["install_share_token"], share_token)
        panel_service.get_user_by_uuid.assert_awaited_once_with("panel-user")

+    async def test_public_route_rejects_unknown_share_token_without_loading_config(self):
+        share_token = "8f559061460e8fede78ef18dce887236"
+        panel_service = SimpleNamespace(
+            get_subscription_page_config_list=AsyncMock(),
+            get_subscription_page_config_by_uuid=AsyncMock(),
+            get_user_by_uuid=AsyncMock(),
+        )
+        request = self._request(
+            self._settings(SUBSCRIPTION_MINI_APP_URL="https://app.example.test/app"),
+            panel_service,
+            match_info={"share_token": share_token},
+        )
+
+        with patch.object(
+            guides.subscription_dal,
+            "get_subscription_by_install_share_token",
+            AsyncMock(return_value=None),
+        ):
+            response = await guides.public_subscription_guides_route(request)
+
+        body = json.loads(response.text)
+        self.assertEqual(response.status, 404)
+        self.assertFalse(body["ok"])
+        self.assertEqual(body["error"], "subscription_unavailable")
+        self.assertFalse(body["enabled"])
+        self.assertIsNone(body["config"])
+        self.assertEqual(body["subscription"]["install_share_token"], share_token)
+        self.assertFalse(body["subscription"]["active"])
+        panel_service.get_subscription_page_config_list.assert_not_called()
+        panel_service.get_subscription_page_config_by_uuid.assert_not_called()
+        panel_service.get_user_by_uuid.assert_not_called()
+
+    async def test_public_route_rejects_inactive_share_token_without_panel_user_lookup(self):
+        share_token = "8f559061460e8fede78ef18dce887236"
+        panel_service = SimpleNamespace(
+            get_subscription_page_config_list=AsyncMock(),
+            get_subscription_page_config_by_uuid=AsyncMock(),
+            get_user_by_uuid=AsyncMock(),
+        )
+        request = self._request(
+            self._settings(SUBSCRIPTION_MINI_APP_URL="https://app.example.test/app"),
+            panel_service,
+            match_info={"share_token": share_token},
+        )
+        local_sub = SimpleNamespace(
+            panel_user_uuid="panel-user",
+            install_share_token=share_token,
+            is_active=False,
+            end_date=datetime.now(timezone.utc) + timedelta(days=3),
+        )
+
+        with patch.object(
+            guides.subscription_dal,
+            "get_subscription_by_install_share_token",
+            AsyncMock(return_value=local_sub),
+        ):
+            response = await guides.public_subscription_guides_route(request)
+
+        body = json.loads(response.text)
+        self.assertEqual(response.status, 404)
+        self.assertFalse(body["ok"])
+        self.assertEqual(body["error"], "subscription_unavailable")
+        self.assertFalse(body["subscription"]["active"])
+        panel_service.get_user_by_uuid.assert_not_called()
+

 if __name__ == "__main__":
    unittest.main()