From 6b3844938524e3fd8819ccc4191c969a9917b894 Mon Sep 17 00:00:00 2001 From: bruno Date: Wed, 28 Oct 2026 16:06:24 -0400 Subject: [PATCH] Tests Flowdeck : origines agent en CORS recherche --- tests/test_recherche.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/tests/test_recherche.py b/tests/test_recherche.py index bcebe93..c7ffde3 100644 --- a/tests/test_recherche.py +++ b/tests/test_recherche.py @@ -49,6 +49,8 @@ def test_sister_origins_dev(): "https://flowdeck-dev.dracodev.net", "https://tiktak-dev.dracodev.net", "https://kanbante-dev.dracodev.net", + "https://agent.dracodev.net", + "https://agent-dev.dracodev.net", } @@ -86,3 +88,22 @@ def test_preflight_headers(): headers = preflight_headers("https://kanbante-dev.dracodev.net", RESOLVED_DEV) assert headers["Access-Control-Allow-Methods"] == "GET, OPTIONS" assert preflight_headers("https://evil.example", RESOLVED_DEV) is None + + +def test_origines_agent_console(): + # Fédération console (défaut 2) : la page de recherche de la + # console appelle /api/search depuis agent(. -dev) avec le + # cookie SSO — ces deux origines passent, prod ET dev, quelle + # que soit la résolution ; un tiers reste refusé. + assert cors_headers_for( + "https://agent.dracodev.net", RESOLVED_DEV) is not None + assert cors_headers_for( + "https://agent-dev.dracodev.net", {}) is not None + assert cors_headers_for( + "https://agent.dracodev.net", + RESOLVED_DEV)["Access-Control-Allow-Credentials"] == "true" + assert preflight_headers( + "https://agent-dev.dracodev.net", RESOLVED_DEV) is not None + assert "https://agent.dracodev.net" in sister_origins({}) + assert "https://agent-dev.dracodev.net" in sister_origins({}) + assert "https://agent-dev.dracodev.net" in sister_origins()