momentum devandClaude Fable 5
e2b3c1ceae
Step 6: tests/smoke_dashboard_headless.py renders the real page in a headless browser and fails on any JS console/pageerror (standalone script, not pytest-collected; CI non-blocking first). admin_api gains GET /api/config/effective (per-key masked value + source: overrides.env vs compose, missing .env.example keys flagged as drift) + an admin.html table (values XSS-escaped). dashboard.html gains the Experiment Ledger panel reading the plan-006 verdicts from the snapshot (empty-state until the tables exist). Removes the last CI ruff per-file pin (api/main.py:F821) now that os/hmac are imported; scoped ruff is green unpinned. Marks plan 007 DONE in plans/README.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
53 lines
2.0 KiB
Python
53 lines
2.0 KiB
Python
"""Admin effective-config endpoint: masking, drift, and fail-closed auth (plan 007 step 6)."""
|
|
|
|
import admin_api
|
|
|
|
|
|
def test_effective_config_masks_secret_values(monkeypatch):
|
|
monkeypatch.setenv("ALPACA_API_KEY", "supersecretvalue")
|
|
monkeypatch.setenv("TRADING_MIN_QUALITY_SCORE", "0.60")
|
|
cfg = admin_api.effective_config()
|
|
masked = cfg["ALPACA_API_KEY"]["value_masked"]
|
|
assert masked.startswith("***") and "supersecret" not in masked
|
|
# non-secret editable knob is shown verbatim, sourced from the process env
|
|
assert cfg["TRADING_MIN_QUALITY_SCORE"]["value_masked"] == "0.60"
|
|
assert cfg["TRADING_MIN_QUALITY_SCORE"]["source"] == "compose"
|
|
|
|
|
|
def test_mask_value_covers_database_url():
|
|
masked = admin_api._mask_value("DATABASE_URL", "postgresql://u:pw@host:5432/db")
|
|
assert masked.startswith("***") and "pw@host" not in masked
|
|
|
|
|
|
def test_overrides_source_wins(monkeypatch):
|
|
monkeypatch.setattr(admin_api.env_overrides, "read_overrides",
|
|
lambda: {"TRADING_PRICE_MAX": "20.0"})
|
|
monkeypatch.setenv("TRADING_PRICE_MAX", "20.0")
|
|
cfg = admin_api.effective_config()
|
|
assert cfg["TRADING_PRICE_MAX"]["source"] == "overrides.env"
|
|
|
|
|
|
def test_missing_required_key_is_drift(monkeypatch):
|
|
monkeypatch.delenv("POLYGON_API_KEY", raising=False) # documented in .env.example
|
|
cfg = admin_api.effective_config()
|
|
row = cfg.get("POLYGON_API_KEY", {})
|
|
assert row.get("drift") is True
|
|
assert row.get("source") == "missing"
|
|
|
|
|
|
def test_admin_auth_fail_closed(monkeypatch):
|
|
h = admin_api.Handler.__new__(admin_api.Handler)
|
|
monkeypatch.setattr(admin_api, "ADMIN_TOKEN", "")
|
|
h.headers = {}
|
|
assert h._authed() is False # no token configured -> deny
|
|
monkeypatch.setattr(admin_api, "ADMIN_TOKEN", "tok")
|
|
h.headers = {"X-Admin-Token": "tok"}
|
|
assert h._authed() is True
|
|
h.headers = {"X-Admin-Token": "nope"}
|
|
assert h._authed() is False
|
|
|
|
|
|
if __name__ == "__main__": # pragma: no cover
|
|
import pytest
|
|
pytest.main([__file__, "-q"])
|