From b9a7824b28ed3ed1b4315fbea59963f75d693fc3 Mon Sep 17 00:00:00 2001 From: bruno Date: Wed, 28 Oct 2026 13:45:55 -0400 Subject: [PATCH] Tests CORS recherche : prod+dev autorises, tiers refuse --- tests/test_recherche_cors.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/tests/test_recherche_cors.py b/tests/test_recherche_cors.py index 86c7f3f..5ee067a 100644 --- a/tests/test_recherche_cors.py +++ b/tests/test_recherche_cors.py @@ -38,7 +38,13 @@ def test_origin_of(): def test_sister_origins_dev(): + # Correctif 2026-10-28 : 8 origines officielles, prod ET dev, + # quelle que soit la résolution. assert sister_origins(RESOLVED_DEV) == { + "https://og.dracodev.net", + "https://flowdeck.dracodev.net", + "https://tiktak.dracodev.net", + "https://kanbante.dracodev.net", "https://og-dev.dracodev.net", "https://flowdeck-dev.dracodev.net", "https://tiktak-dev.dracodev.net", @@ -47,12 +53,18 @@ def test_sister_origins_dev(): def test_sister_origins_ajoute_env_de_la_requete(): + # Correctif 2026-10-28 : configuration muette, quel que soit + # l'hôte de la requête, prod ET dev passent — l'hôte ne + # restreint plus l'allowlist. assert "https://og-dev.dracodev.net" in sister_origins( {}, request_host="og-dev.dracodev.net" ) - assert "https://og-dev.dracodev.net" not in sister_origins( + assert "https://og-dev.dracodev.net" in sister_origins( {}, request_host="og.dracodev.net" ) + assert "https://og.dracodev.net" in sister_origins( + {}, request_host="og-dev.dracodev.net" + ) def test_cors_headers(): @@ -60,7 +72,11 @@ def test_cors_headers(): assert headers["Access-Control-Allow-Origin"] == "https://tiktak-dev.dracodev.net" assert headers["Access-Control-Allow-Credentials"] == "true" assert cors_headers_for("https://evil.example", RESOLVED_DEV) is None - assert cors_headers_for("https://og.dracodev.net", RESOLVED_DEV) is None + assert cors_headers_for("https://og-dev.dracodev.net.evil.example", + RESOLVED_DEV) is None + # Autre environnement autorisé (correctif 2026-10-28). + assert cors_headers_for("https://og.dracodev.net", + RESOLVED_DEV) is not None def test_preflight_headers():