fix: mfa/status 200 auth désactivée (garde anonymous) BUG-081 + clôture BUG-080/082/083

2026-09-27 10:35:33 -04:00
parent 14b8032635
commit e9b7a317c1
12 changed files with 102 additions and 18 deletions
@@ -367,3 +367,64 @@ class TestMfaApiEndpoints:
        data = login_resp.json()
        assert "access_token" in data
        assert data.get("mfa_required") is None
+
+
+# ── BUG-081 : /api/auth/mfa/status avec auth désactivée ──────────────────
+
+@pytest.fixture
+def mfa_client_noauth():
+    """TestClient avec auth DÉSACTIVÉE (OBSIGATE_AUTH_ENABLED=false)."""
+    tmp = Path(tempfile.mkdtemp())
+    data_dir = tmp / "data"
+    data_dir.mkdir()
+
+    orig_cwd = os.getcwd()
+    test_vault_path = os.path.abspath("test-vault")
+    os.chdir(str(tmp))
+
+    os.environ["VAULT_1_NAME"] = "TestVault"
+    os.environ["VAULT_1_PATH"] = test_vault_path
+    os.environ["OBSIGATE_AUTH_ENABLED"] = "false"
+    os.environ["OBSIGATE_WATCHER_ENABLED"] = "false"
+
+    import backend.main
+    backend.main._load_config = lambda: {"watcher_enabled": False}
+
+    from backend.main import app
+    from backend.indexer import build_index, index
+    for key in list(index.keys()):
+        del index[key]
+
+    loop = asyncio.new_event_loop()
+    asyncio.set_event_loop(loop)
+    loop.run_until_complete(build_index())
+
+    from backend.search import init_inverted_index
+    init_inverted_index()
+
+    from fastapi.testclient import TestClient
+    client = TestClient(app, raise_server_exceptions=False)
+    yield client
+
+    if hasattr(client, 'close'):
+        client.close()
+    loop.run_until_complete(asyncio.sleep(0))
+
+    os.chdir(orig_cwd)
+    shutil.rmtree(str(tmp), ignore_errors=True)
+    for k in ["VAULT_1_NAME", "VAULT_1_PATH", "OBSIGATE_AUTH_ENABLED",
+              "OBSIGATE_WATCHER_ENABLED"]:
+        os.environ.pop(k, None)
+
+
+class TestMfaStatusAuthDisabled:
+    """BUG-081 : `GET /api/auth/mfa/status` ne doit pas répondre 500 quand
+    l'auth est désactivée (pseudo-user `anonymous` sans entrée en store)."""
+
+    def test_mfa_status_anonymous_returns_disabled(self, mfa_client_noauth):
+        resp = mfa_client_noauth.get("/api/auth/mfa/status")
+        assert resp.status_code == 200, f"BUG-081: {resp.status_code} {resp.text[:200]}"
+        body = resp.json()
+        assert body["mfa_enabled"] is False
+        assert body["totp_enabled"] is False
+        assert body["webauthn_credentials"] == 0