Merge pull request #1 from PrivateBasicsApp/chore/update-dependencies

PrivateBasicsApp · web-flow · commit 7364a5afad26 · 2026-07-06T06:09:13.000Z
Chore/update dependencies (Django 5.2, FastAPI 0.138 + security)etesync#205
diff --git a/.gitignore b/.gitignore
@@ -1,7 +1,7 @@
 /journal
 /db.sqlite3*
 Session.vim
-/.venv
+/.venv*
 /assets
 /logs
 /.coverage
@@ -10,6 +10,8 @@ Session.vim
 /.idea
 
 __pycache__
+.pytest_cache/
+.ruff_cache/
 .*.swp
 
 /etebase_server_settings.py
@@ -18,3 +20,4 @@ __pycache__
 /build
 /dist
 /*.egg-info
+.DS_Store
diff --git a/README.md b/README.md
@@ -11,7 +11,7 @@ An [Etebase](https://www.etebase.com) (EteSync 2.0) server so you can run your o
 
 ## Requirements
 
-Etebase requires Python 3.7 or newer and has a few Python dependencies (listed in `requirements.in/base.txt`).
+Etebase requires Python 3.10 or newer and has a few Python dependencies (listed in `requirements.in/base.txt`).
 
 ## From source
 
diff --git a/etebase_server/fastapi/dependencies.py b/etebase_server/fastapi/dependencies.py
@@ -2,7 +2,7 @@
 
 from django.db.models import QuerySet
 from django.utils import timezone
-from fastapi import Depends
+from fastapi import Depends, Path
 from fastapi.security import APIKeyHeader
 
 from etebase_server.django import models
@@ -74,7 +74,7 @@ def get_collection_queryset(user: UserType = Depends(get_authenticated_user)) ->
 
 
 @django_db_cleanup_decorator
-def get_collection(collection_uid: str, queryset: QuerySet = Depends(get_collection_queryset)) -> models.Collection:
+def get_collection(collection_uid: str = Path(...), queryset: QuerySet = Depends(get_collection_queryset)) -> models.Collection:
     return get_object_or_404(queryset, uid=collection_uid)
 
 
diff --git a/pyproject.toml b/pyproject.toml
@@ -26,3 +26,9 @@ ignore = ["E203", "E501", "E711", "E712", "N803", "N815", "N818", "T201"]
 
 [tool.ruff.lint.isort]
 combine-as-imports = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]
+addopts = "-ra"
+DJANGO_SETTINGS_MODULE = "etebase_server.settings"
diff --git a/requirements-dev.txt b/requirements-dev.txt
diff --git a/requirements.in/base.txt b/requirements.in/base.txt
@@ -1,9 +1,9 @@
-django>=4.0,<5.0
+django>=5.2,<6.0
 msgpack
 pynacl
-fastapi>=0.104
+fastapi==0.138.2
 pydantic>=2.0.0
 typing_extensions
 uvicorn[standard]
 aiofiles
-redis>=4.2.0rc1
+redis>=5.0
diff --git a/requirements.in/development.txt b/requirements.in/development.txt
@@ -1,5 +1,10 @@
+# Keep dev-only deps aligned with the runtime pins in requirements.txt.
+--constraint ../requirements.txt
+
 coverage
 pip-tools
+pytest
+pytest-django
 pywatchman
 ruff
 mypy
diff --git a/requirements.txt b/requirements.txt
diff --git a/tests/conftest.py b/tests/conftest.py
@@ -0,0 +1,100 @@
+"""Shared fixtures for the FastAPI endpoint tests.
+
+Provides:
+- ``app``          : the real ASGI app built by ``create_application`` (session-scoped).
+- ``api_request``  : a synchronous ASGI driver to issue msgpack requests without httpx.
+- ``user`` / ``auth_token`` : user and token created via the ORM (they need a transactional
+  DB, because the sync endpoints run in the threadpool and must see committed data).
+"""
+
+import asyncio
+import os
+
+import msgpack
+import pytest
+from django.conf import settings
+
+from etebase_server.fastapi.utils import msgpack_encode
+
+
+@pytest.fixture(scope="session")
+def app():
+    # create_application mounts StaticFiles on STATIC_ROOT and installs TrustedHostMiddleware:
+    # in tests the dir does not exist and ALLOWED_HOSTS is empty, so we set them before building.
+    settings.ALLOWED_HOSTS = ["*"]
+    os.makedirs(settings.STATIC_ROOT, exist_ok=True)
+
+    from etebase_server.fastapi.main import create_application
+
+    return create_application()
+
+
+@pytest.fixture
+def api_request(app):
+    """Drive a single HTTP request through the ASGI app and return ``(status, decoded_body)``.
+
+    The request body is msgpack-encoded; the response is msgpack-decoded (falling back to raw
+    bytes for non-msgpack responses, e.g. FastAPI's default 401/403).
+    """
+
+    def _request(method, path, *, body=None, token=None):
+        raw = msgpack_encode(body) if body is not None else b""
+        url_path, _, query = path.partition("?")
+
+        headers = [(b"host", b"testserver"), (b"accept", b"application/msgpack")]
+        if body is not None:
+            headers.append((b"content-type", b"application/msgpack"))
+        if token is not None:
+            headers.append((b"authorization", f"Token {token}".encode()))
+
+        scope = {
+            "type": "http",
+            "asgi": {"version": "3.0", "spec_version": "2.3"},
+            "http_version": "1.1",
+            "method": method,
+            "path": url_path,
+            "raw_path": url_path.encode(),
+            "query_string": query.encode(),
+            "headers": headers,
+            "scheme": "http",
+            "server": ("testserver", 80),
+            "client": ("testclient", 1),
+            "root_path": "",
+        }
+
+        async def receive():
+            return {"type": "http.request", "body": raw, "more_body": False}
+
+        captured = {"status": None, "body": b""}
+
+        async def send(message):
+            if message["type"] == "http.response.start":
+                captured["status"] = message["status"]
+            elif message["type"] == "http.response.body":
+                captured["body"] += message.get("body", b"")
+
+        asyncio.run(app(scope, receive, send))
+
+        out = captured["body"]
+        try:
+            decoded = msgpack.unpackb(out, raw=False) if out else None
+        except Exception:
+            decoded = out
+        return captured["status"], decoded
+
+    return _request
+
+
+@pytest.fixture
+def user(transactional_db):
+    from etebase_server.myauth.models import get_typed_user_model
+
+    User = get_typed_user_model()
+    return User.objects.create(username="testuser", email="testuser@example.com")
+
+
+@pytest.fixture
+def auth_token(user):
+    from etebase_server.django.token_auth.models import AuthToken
+
+    return AuthToken.objects.create(user=user).key
diff --git a/tests/integration/__init__.py b/tests/integration/__init__.py
diff --git a/tests/integration/test_item_endpoints.py b/tests/integration/test_item_endpoints.py
@@ -0,0 +1,59 @@
+"""Integration smoke tests for the collection/item endpoints.
+
+They drive real msgpack requests through the ASGI app (auth + dependency resolution + ORM).
+The key signal is **404 vs 422**: before the ``collection_uid`` fix the item endpoints returned
+422; with the fix, a nonexistent collection returns 404.
+"""
+
+# Plausible but nonexistent uid: it must be resolved as a path param (404), not 422.
+NONEXISTENT = "0" * 64
+
+
+def test_item_list_nonexistent_collection_returns_404_not_422(api_request, auth_token):
+    status, _ = api_request("GET", f"/api/v1/collection/{NONEXISTENT}/item/", token=auth_token)
+    assert status == 404
+
+
+def test_item_batch_wellformed_body_returns_404_not_422(api_request, auth_token):
+    body = {
+        "items": [
+            {
+                "uid": "item-uid",
+                "version": 1,
+                "encryptionKey": b"key",
+                "content": {
+                    "uid": "item-uid",
+                    "meta": b"meta",
+                    "deleted": False,
+                    "chunks": [["chunk-uid", b"data"]],
+                },
+                "etag": None,
+            }
+        ],
+        "deps": None,
+    }
+    status, _ = api_request(
+        "POST", f"/api/v1/collection/{NONEXISTENT}/item/batch/", body=body, token=auth_token
+    )
+    assert status == 404
+
+
+def test_list_multi_returns_200(api_request, auth_token):
+    status, decoded = api_request(
+        "POST", "/api/v1/collection/list_multi/", body={"collectionTypes": []}, token=auth_token
+    )
+    assert status == 200
+    assert decoded["data"] == []
+
+
+def test_item_list_without_token_returns_401(api_request):
+    # Missing Authorization header -> APIKeyHeader (auto_error) responds 401.
+    status, _ = api_request("GET", f"/api/v1/collection/{NONEXISTENT}/item/")
+    assert status == 401
+
+
+def test_member_list_nonexistent_collection_returns_404_not_422(api_request, auth_token):
+    # member_router is also mounted under /collection/{collection_uid}: same 422 risk,
+    # covered by the same get_collection fix.
+    status, _ = api_request("GET", f"/api/v1/collection/{NONEXISTENT}/member/", token=auth_token)
+    assert status == 404
diff --git a/tests/unit/test_exceptions.py b/tests/unit/test_exceptions.py
@@ -0,0 +1,139 @@
+"""Pure unit tests for ``etebase_server.fastapi.exceptions``.
+
+They cover the HTTP exception hierarchy and the error-transformation helpers. These are
+"classic" unit tests: they need no database, no configured Django settings, and no running
+server. The only requirement is that ``django.core.exceptions``, ``fastapi`` and ``pydantic``
+are importable.
+"""
+
+import pytest
+from django.core.exceptions import ValidationError as DjangoValidationError
+from fastapi import HTTPException, status
+
+from etebase_server.fastapi.exceptions import (
+    AuthenticationFailed,
+    CustomHttpException,
+    HttpError,
+    NotAuthenticated,
+    NotSupported,
+    PermissionDenied,
+    ValidationError,
+    flatten_errors,
+    transform_validation_error,
+)
+
+
+class TestCustomHttpException:
+    def test_defaults(self):
+        exc = CustomHttpException(code="boom", detail="Something broke")
+        assert exc.code == "boom"
+        assert exc.detail == "Something broke"
+        assert exc.status_code == status.HTTP_400_BAD_REQUEST
+        assert isinstance(exc, HTTPException)
+
+    def test_custom_status_code(self):
+        exc = CustomHttpException(code="teapot", detail="no coffee", status_code=status.HTTP_418_IM_A_TEAPOT)
+        assert exc.status_code == status.HTTP_418_IM_A_TEAPOT
+
+    def test_as_dict(self):
+        exc = CustomHttpException(code="boom", detail="broke")
+        assert exc.as_dict == {"code": "boom", "detail": "broke"}
+
+
+@pytest.mark.parametrize(
+    "exc_cls, expected_code, expected_status",
+    [
+        (AuthenticationFailed, "authentication_failed", status.HTTP_401_UNAUTHORIZED),
+        (NotAuthenticated, "not_authenticated", status.HTTP_401_UNAUTHORIZED),
+        (PermissionDenied, "permission_denied", status.HTTP_403_FORBIDDEN),
+        (NotSupported, "not_implemented", status.HTTP_501_NOT_IMPLEMENTED),
+    ],
+)
+def test_subclass_defaults(exc_cls, expected_code, expected_status):
+    exc = exc_cls()
+    assert exc.code == expected_code
+    assert exc.status_code == expected_status
+    assert isinstance(exc, CustomHttpException)
+
+
+class TestHttpError:
+    def test_defaults(self):
+        exc = HttpError(code="bad", detail="nope")
+        assert exc.code == "bad"
+        assert exc.status_code == status.HTTP_400_BAD_REQUEST
+        assert exc.errors is None
+
+    def test_empty_code_falls_back_to_generic(self):
+        exc = HttpError(code="", detail="nope")
+        assert exc.code == "generic_error"
+
+    def test_as_dict_without_errors(self):
+        exc = HttpError(code="bad", detail="nope")
+        assert exc.as_dict == {"code": "bad", "detail": "nope", "errors": None}
+
+    def test_as_dict_serializes_nested_validation_errors(self):
+        nested = ValidationError(code="invalid", detail="too short", field="password")
+        exc = HttpError(code="field_errors", detail="Field validations failed.", errors=[nested])
+        result = exc.as_dict
+        assert result["code"] == "field_errors"
+        assert result["detail"] == "Field validations failed."
+        assert result["errors"] == [{"field": "password", "code": "invalid", "detail": "too short"}]
+
+
+class TestValidationError:
+    def test_field_is_stored(self):
+        exc = ValidationError(code="invalid", detail="bad value", field="email")
+        assert exc.field == "email"
+        assert exc.code == "invalid"
+        assert isinstance(exc, HttpError)
+
+
+class TestTransformValidationError:
+    def test_dict_errors_become_field_errors(self):
+        django_err = DjangoValidationError({"name": ["This field is required."]})
+        with pytest.raises(HttpError) as exc_info:
+            transform_validation_error("user", django_err)
+
+        exc = exc_info.value
+        assert exc.code == "field_errors"
+        assert exc.detail == "Field validations failed."
+        assert len(exc.errors) == 1
+        only = exc.errors[0]
+        assert isinstance(only, ValidationError)
+        assert only.field == "user.name"
+        assert only.detail == "This field is required."
+
+    def test_list_errors_become_field_errors(self):
+        django_err = DjangoValidationError(["first problem", "second problem"])
+        with pytest.raises(HttpError) as exc_info:
+            transform_validation_error("user", django_err)
+
+        exc = exc_info.value
+        assert exc.code == "field_errors"
+        assert len(exc.errors) == 2
+
+    def test_single_message_raises_plain_http_error(self):
+        django_err = DjangoValidationError("just one message", code="custom_code")
+        with pytest.raises(HttpError) as exc_info:
+            transform_validation_error("user", django_err)
+
+        exc = exc_info.value
+        assert exc.code == "custom_code"
+        assert exc.detail == "just one message"
+
+
+class TestFlattenErrors:
+    def test_flattens_list_of_django_errors(self):
+        django_err = DjangoValidationError(["problem a", "problem b"])
+        result = flatten_errors("field", django_err.error_list)
+        assert len(result) == 2
+        assert all(isinstance(e, ValidationError) for e in result)
+        assert all(e.field == "field" for e in result)
+        assert {e.detail for e in result} == {"problem a", "problem b"}
+
+    def test_flattens_nested_dict_of_django_errors(self):
+        django_err = DjangoValidationError({"name": ["required"], "email": ["invalid"]})
+        result = flatten_errors("user", django_err.error_dict)
+        assert len(result) == 2
+        fields = {e.field for e in result}
+        assert fields == {"user.name", "user.email"}
diff --git a/tests/unit/test_utils.py b/tests/unit/test_utils.py
