592 lines
23 KiB
Python
592 lines
23 KiB
Python
"""Tests for M4-T03 + M4-T07: scripts/admin_cli.py — CLI escape hatch.
|
|
|
|
Covers:
|
|
- reset-password: new password verifies, old password fails.
|
|
- unlock: clears specified/all throttle rows; prints count; idempotent.
|
|
- disable-totp: clears TOTP state + recovery codes without requiring any credential.
|
|
- reissue-totp: writes new secret; prints otpauth URI; secret changes.
|
|
- list-admin: prints user table without crashing.
|
|
- Non-existent user → friendly error + SystemExit with non-zero code.
|
|
- Data-safety: CLI must never reference user-data tables in delete/drop.
|
|
|
|
DB isolation: each test gets a fresh temporary SQLite database via
|
|
``cli_db`` fixture (mirrors the pattern in test_login_throttle.py).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import sys
|
|
from datetime import UTC, datetime
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
from alembic import command
|
|
from alembic.config import Config
|
|
from sqlalchemy import create_engine, select
|
|
from sqlalchemy.orm import Session, sessionmaker
|
|
|
|
from app.db import reset_db_caches
|
|
from app.config import get_settings
|
|
from app.models.auth import AuthUser, RecoveryCode
|
|
from app.models.auth_throttle import LoginThrottle
|
|
from app.services.auth import hash_password, verify_password
|
|
from scripts.admin_cli import (
|
|
build_parser,
|
|
cmd_disable_totp,
|
|
cmd_list_admin,
|
|
cmd_reset_password,
|
|
cmd_reissue_totp,
|
|
cmd_unlock,
|
|
)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Fixtures
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def _make_app_alembic_config(database_url: str) -> Config:
|
|
config = Config("alembic_app.ini")
|
|
config.set_main_option("sqlalchemy.url", database_url)
|
|
return config
|
|
|
|
|
|
@pytest.fixture()
|
|
def cli_db(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
|
|
"""Fresh migrated SQLite DB wired as the active app DB for the CLI.
|
|
|
|
Monkeypatches APP_DATABASE_URL so that ``get_session_local()`` inside
|
|
admin_cli reaches this temp file, not the real data store.
|
|
"""
|
|
db_path = tmp_path / "cli_test.db"
|
|
db_url = f"sqlite:///{db_path}"
|
|
|
|
monkeypatch.setenv("APP_DATABASE_URL", db_url)
|
|
monkeypatch.setenv("AUTH_BOOTSTRAP_USERNAME", "admin")
|
|
monkeypatch.setenv("AUTH_BOOTSTRAP_PASSWORD", "original-password")
|
|
monkeypatch.setenv("AUTH_COOKIE_SECURE_OVERRIDE", "false")
|
|
monkeypatch.setenv("AUTH_LOGIN_THROTTLE_ENABLED", "false")
|
|
get_settings.cache_clear()
|
|
reset_db_caches()
|
|
|
|
command.upgrade(_make_app_alembic_config(db_url), "head")
|
|
reset_db_caches()
|
|
|
|
# Bootstrap the admin user manually so the test controls the initial hash.
|
|
engine = create_engine(db_url, connect_args={"check_same_thread": False})
|
|
SessionLocal = sessionmaker(bind=engine, autoflush=False, autocommit=False, class_=Session)
|
|
with SessionLocal() as session:
|
|
# The Alembic upgrade does NOT create a user (that is app startup logic).
|
|
# Insert the initial admin user here for tests that need one.
|
|
existing = session.scalar(select(AuthUser).limit(1))
|
|
if existing is None:
|
|
user = AuthUser(
|
|
username="admin",
|
|
password_hash=hash_password("original-password"),
|
|
is_active=True,
|
|
force_password_change=False,
|
|
created_at=datetime.now(UTC),
|
|
)
|
|
session.add(user)
|
|
session.commit()
|
|
engine.dispose()
|
|
reset_db_caches()
|
|
|
|
yield db_url
|
|
|
|
get_settings.cache_clear()
|
|
reset_db_caches()
|
|
|
|
|
|
@pytest.fixture()
|
|
def cli_session(cli_db: str) -> Session:
|
|
"""SQLAlchemy session bound to the CLI test DB."""
|
|
engine = create_engine(cli_db, connect_args={"check_same_thread": False})
|
|
SessionLocal = sessionmaker(bind=engine, autoflush=False, autocommit=False, class_=Session)
|
|
session = SessionLocal()
|
|
try:
|
|
yield session
|
|
finally:
|
|
session.close()
|
|
engine.dispose()
|
|
|
|
|
|
def _add_throttle_rows(session: Session, rows: list[tuple[str, str]]) -> None:
|
|
"""Helper: insert (scope, key) throttle rows into the test DB."""
|
|
now = datetime.now(UTC)
|
|
for scope, key in rows:
|
|
session.add(
|
|
LoginThrottle(
|
|
scope=scope,
|
|
key=key,
|
|
failures=5,
|
|
first_failed_at=now,
|
|
last_failed_at=now,
|
|
next_allowed_at=None,
|
|
)
|
|
)
|
|
session.commit()
|
|
|
|
|
|
def _throttle_count(session: Session) -> int:
|
|
return session.query(LoginThrottle).count()
|
|
|
|
|
|
def _enable_totp_for_user(session: Session, username: str, secret: str = "JBSWY3DPEHPK3PXP") -> None:
|
|
"""Helper: set TOTP enabled + secret for a user and add some recovery codes."""
|
|
user = session.scalar(select(AuthUser).where(AuthUser.username == username))
|
|
assert user is not None, f"User '{username}' not found in _enable_totp_for_user"
|
|
user.totp_secret = secret
|
|
user.totp_enabled = True
|
|
# Add two fake recovery codes so we can verify they get deleted.
|
|
session.add(RecoveryCode(user_id=user.id, code_hash=hash_password("aaaa-bbbb")))
|
|
session.add(RecoveryCode(user_id=user.id, code_hash=hash_password("cccc-dddd")))
|
|
session.commit()
|
|
session.expire_all()
|
|
|
|
|
|
def _recovery_code_count(session: Session, username: str) -> int:
|
|
user = session.scalar(select(AuthUser).where(AuthUser.username == username))
|
|
assert user is not None
|
|
return session.query(RecoveryCode).filter(RecoveryCode.user_id == user.id).count()
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# reset-password tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestResetPassword:
|
|
"""reset-password sub-command."""
|
|
|
|
def test_new_password_verifies(self, cli_db: str, cli_session: Session):
|
|
"""After reset, new password passes verify_password; old one fails."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reset-password", "admin", "--password", "new-secret-123"])
|
|
cmd_reset_password(args)
|
|
|
|
# Re-query from the session (committed by CLI, so flush needed).
|
|
cli_session.expire_all()
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert verify_password("new-secret-123", user.password_hash), (
|
|
"New password should verify against stored hash"
|
|
)
|
|
assert not verify_password("original-password", user.password_hash), (
|
|
"Old password must no longer verify"
|
|
)
|
|
|
|
def test_nonexistent_user_exits_nonzero(self, cli_db: str):
|
|
"""reset-password for an unknown username must SystemExit with code != 0."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(
|
|
["reset-password", "ghost-user", "--password", "doesnt-matter"]
|
|
)
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
cmd_reset_password(args)
|
|
assert exc_info.value.code != 0
|
|
|
|
def test_empty_password_exits_nonzero(self, cli_db: str):
|
|
"""Passing an empty --password string must fail with non-zero exit."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reset-password", "admin", "--password", ""])
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
cmd_reset_password(args)
|
|
assert exc_info.value.code != 0
|
|
|
|
def test_multiple_resets_are_idempotent(self, cli_db: str, cli_session: Session):
|
|
"""Calling reset-password multiple times leaves the last password active."""
|
|
parser = build_parser()
|
|
|
|
args1 = parser.parse_args(["reset-password", "admin", "--password", "first-pass"])
|
|
cmd_reset_password(args1)
|
|
|
|
args2 = parser.parse_args(["reset-password", "admin", "--password", "second-pass"])
|
|
cmd_reset_password(args2)
|
|
|
|
cli_session.expire_all()
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert verify_password("second-pass", user.password_hash)
|
|
assert not verify_password("first-pass", user.password_hash)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# unlock tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestUnlock:
|
|
"""unlock sub-command."""
|
|
|
|
def test_unlock_all_clears_all_rows(self, cli_db: str, cli_session: Session):
|
|
"""unlock --all should delete every row in auth_login_throttle."""
|
|
_add_throttle_rows(
|
|
cli_session,
|
|
[("ip", "1.2.3.4"), ("ip", "5.6.7.8"), ("user", "admin")],
|
|
)
|
|
assert _throttle_count(cli_session) == 3
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--all"])
|
|
cmd_unlock(args)
|
|
|
|
cli_session.expire_all()
|
|
assert _throttle_count(cli_session) == 0
|
|
|
|
def test_unlock_ip_clears_only_target_ip(self, cli_db: str, cli_session: Session):
|
|
"""unlock --ip should remove only the matching scope='ip' row."""
|
|
_add_throttle_rows(
|
|
cli_session,
|
|
[("ip", "10.0.0.1"), ("ip", "10.0.0.2"), ("user", "admin")],
|
|
)
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--ip", "10.0.0.1"])
|
|
cmd_unlock(args)
|
|
|
|
cli_session.expire_all()
|
|
assert _throttle_count(cli_session) == 2
|
|
remaining = cli_session.scalars(select(LoginThrottle)).all()
|
|
keys = [(r.scope, r.key) for r in remaining]
|
|
assert ("ip", "10.0.0.1") not in keys
|
|
assert ("ip", "10.0.0.2") in keys
|
|
assert ("user", "admin") in keys
|
|
|
|
def test_unlock_username_clears_only_target_user(self, cli_db: str, cli_session: Session):
|
|
"""unlock --username should remove only the matching scope='user' row."""
|
|
_add_throttle_rows(
|
|
cli_session,
|
|
[("ip", "1.2.3.4"), ("user", "admin"), ("user", "other")],
|
|
)
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--username", "admin"])
|
|
cmd_unlock(args)
|
|
|
|
cli_session.expire_all()
|
|
assert _throttle_count(cli_session) == 2
|
|
remaining = cli_session.scalars(select(LoginThrottle)).all()
|
|
keys = [(r.scope, r.key) for r in remaining]
|
|
assert ("user", "admin") not in keys
|
|
assert ("ip", "1.2.3.4") in keys
|
|
assert ("user", "other") in keys
|
|
|
|
def test_unlock_all_idempotent(self, cli_db: str, cli_session: Session):
|
|
"""Calling unlock --all when no rows exist must not raise."""
|
|
assert _throttle_count(cli_session) == 0
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--all"])
|
|
cmd_unlock(args) # must not raise
|
|
|
|
cli_session.expire_all()
|
|
assert _throttle_count(cli_session) == 0
|
|
|
|
def test_unlock_ip_idempotent_when_absent(self, cli_db: str, cli_session: Session):
|
|
"""Calling unlock --ip for a non-existent IP is a no-op (0 rows deleted)."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--ip", "99.99.99.99"])
|
|
cmd_unlock(args) # must not raise; 0 rows deleted is fine
|
|
|
|
def test_unlock_username_idempotent_when_absent(self, cli_db: str, cli_session: Session):
|
|
"""Calling unlock --username for a non-existent username is a no-op."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--username", "nobody"])
|
|
cmd_unlock(args) # must not raise
|
|
|
|
def test_unlock_all_prints_row_count(self, cli_db: str, cli_session: Session, capsys):
|
|
"""unlock --all must print the number of rows deleted."""
|
|
_add_throttle_rows(cli_session, [("ip", "1.2.3.4"), ("user", "admin")])
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--all"])
|
|
cmd_unlock(args)
|
|
|
|
captured = capsys.readouterr()
|
|
assert "2" in captured.out
|
|
|
|
def test_unlock_does_not_touch_auth_users(self, cli_db: str, cli_session: Session):
|
|
"""unlock must not delete or alter auth_users rows."""
|
|
_add_throttle_rows(cli_session, [("ip", "1.2.3.4")])
|
|
user_count_before = cli_session.query(AuthUser).count()
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["unlock", "--all"])
|
|
cmd_unlock(args)
|
|
|
|
cli_session.expire_all()
|
|
assert cli_session.query(AuthUser).count() == user_count_before
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# list-admin tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestListAdmin:
|
|
"""list-admin sub-command."""
|
|
|
|
def test_list_admin_prints_header_and_user(self, cli_db: str, capsys):
|
|
"""list-admin must print the admin user row."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["list-admin"])
|
|
cmd_list_admin(args)
|
|
|
|
captured = capsys.readouterr()
|
|
assert "admin" in captured.out
|
|
|
|
def test_list_admin_no_users(
|
|
self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys
|
|
):
|
|
"""list-admin on an empty user table should say 'No users found.'"""
|
|
db_path = tmp_path / "empty_test.db"
|
|
db_url = f"sqlite:///{db_path}"
|
|
|
|
monkeypatch.setenv("APP_DATABASE_URL", db_url)
|
|
monkeypatch.setenv("AUTH_BOOTSTRAP_USERNAME", "admin")
|
|
monkeypatch.setenv("AUTH_BOOTSTRAP_PASSWORD", "x")
|
|
monkeypatch.setenv("AUTH_COOKIE_SECURE_OVERRIDE", "false")
|
|
get_settings.cache_clear()
|
|
reset_db_caches()
|
|
command.upgrade(_make_app_alembic_config(db_url), "head")
|
|
reset_db_caches()
|
|
|
|
# Do NOT bootstrap a user — table is empty.
|
|
parser = build_parser()
|
|
args = parser.parse_args(["list-admin"])
|
|
cmd_list_admin(args)
|
|
|
|
captured = capsys.readouterr()
|
|
assert "No users found" in captured.out
|
|
|
|
get_settings.cache_clear()
|
|
reset_db_caches()
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# disable-totp tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestDisableTotp:
|
|
"""disable-totp sub-command (M4-T07)."""
|
|
|
|
def test_disable_totp_clears_state(self, cli_db: str, cli_session: Session):
|
|
"""After disable-totp: totp_enabled=False, totp_secret=None, recovery codes gone."""
|
|
_enable_totp_for_user(cli_session, "admin")
|
|
|
|
# Verify preconditions.
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert user.totp_enabled is True
|
|
assert user.totp_secret is not None
|
|
assert _recovery_code_count(cli_session, "admin") == 2
|
|
|
|
# Run disable-totp — NO credential supplied (escape hatch semantics).
|
|
parser = build_parser()
|
|
args = parser.parse_args(["disable-totp", "admin"])
|
|
cmd_disable_totp(args)
|
|
|
|
# Verify state.
|
|
cli_session.expire_all()
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert user.totp_enabled is False
|
|
assert user.totp_secret is None
|
|
assert _recovery_code_count(cli_session, "admin") == 0
|
|
|
|
def test_disable_totp_no_credential_required(self, cli_db: str, cli_session: Session):
|
|
"""disable-totp must succeed without any recovery code or password argument."""
|
|
_enable_totp_for_user(cli_session, "admin")
|
|
|
|
# The argparse spec for disable-totp takes only username — no credential flags.
|
|
# Parsing must succeed with just the username.
|
|
parser = build_parser()
|
|
args = parser.parse_args(["disable-totp", "admin"])
|
|
# No exception means no credential was needed.
|
|
cmd_disable_totp(args) # must not raise
|
|
|
|
def test_disable_totp_already_disabled_is_noop(self, cli_db: str, cli_session: Session):
|
|
"""disable-totp on a user who never had TOTP is a harmless no-op."""
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert user.totp_enabled is False
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["disable-totp", "admin"])
|
|
cmd_disable_totp(args) # must not raise
|
|
|
|
cli_session.expire_all()
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert user.totp_enabled is False
|
|
assert user.totp_secret is None
|
|
|
|
def test_disable_totp_nonexistent_user_exits_nonzero(self, cli_db: str):
|
|
"""disable-totp for an unknown user must SystemExit with code != 0."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["disable-totp", "ghost-user"])
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
cmd_disable_totp(args)
|
|
assert exc_info.value.code != 0
|
|
|
|
def test_disable_totp_prints_confirmation(
|
|
self, cli_db: str, cli_session: Session, capsys
|
|
):
|
|
"""disable-totp must print a confirmation message mentioning the user."""
|
|
_enable_totp_for_user(cli_session, "admin")
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["disable-totp", "admin"])
|
|
cmd_disable_totp(args)
|
|
|
|
captured = capsys.readouterr()
|
|
assert "admin" in captured.out
|
|
|
|
def test_disable_totp_does_not_touch_password(
|
|
self, cli_db: str, cli_session: Session
|
|
):
|
|
"""disable-totp must not alter the user's password_hash."""
|
|
_enable_totp_for_user(cli_session, "admin")
|
|
|
|
user_before = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user_before is not None
|
|
pw_hash_before = user_before.password_hash
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["disable-totp", "admin"])
|
|
cmd_disable_totp(args)
|
|
|
|
cli_session.expire_all()
|
|
user_after = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user_after is not None
|
|
assert user_after.password_hash == pw_hash_before
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# reissue-totp tests
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestReissueTotp:
|
|
"""reissue-totp sub-command (M4-T07)."""
|
|
|
|
def test_reissue_totp_changes_secret(self, cli_db: str, cli_session: Session):
|
|
"""After reissue-totp, totp_secret must be a new non-empty value."""
|
|
old_secret = "JBSWY3DPEHPK3PXP"
|
|
_enable_totp_for_user(cli_session, "admin", secret=old_secret)
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reissue-totp", "admin"])
|
|
cmd_reissue_totp(args)
|
|
|
|
cli_session.expire_all()
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert user.totp_secret is not None
|
|
assert user.totp_secret != old_secret, "Secret must be regenerated"
|
|
|
|
def test_reissue_totp_prints_uri(self, cli_db: str, cli_session: Session, capsys):
|
|
"""reissue-totp must print an otpauth:// URI and the secret."""
|
|
_enable_totp_for_user(cli_session, "admin")
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reissue-totp", "admin"])
|
|
cmd_reissue_totp(args)
|
|
|
|
captured = capsys.readouterr()
|
|
assert "otpauth://" in captured.out
|
|
assert "Secret" in captured.out
|
|
|
|
def test_reissue_totp_totp_enabled_unchanged(self, cli_db: str, cli_session: Session):
|
|
"""reissue-totp must leave totp_enabled in its current state (True stays True)."""
|
|
_enable_totp_for_user(cli_session, "admin")
|
|
|
|
user_before = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user_before is not None
|
|
assert user_before.totp_enabled is True
|
|
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reissue-totp", "admin"])
|
|
cmd_reissue_totp(args)
|
|
|
|
cli_session.expire_all()
|
|
user_after = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user_after is not None
|
|
assert user_after.totp_enabled is True, "totp_enabled must remain unchanged"
|
|
|
|
def test_reissue_totp_disabled_user_stays_disabled(
|
|
self, cli_db: str, cli_session: Session
|
|
):
|
|
"""reissue-totp on a user with totp_enabled=False leaves it False."""
|
|
# Don't enable TOTP — user is in disabled state.
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reissue-totp", "admin"])
|
|
cmd_reissue_totp(args)
|
|
|
|
cli_session.expire_all()
|
|
user = cli_session.scalar(select(AuthUser).where(AuthUser.username == "admin"))
|
|
assert user is not None
|
|
assert user.totp_enabled is False, "totp_enabled must remain False"
|
|
assert user.totp_secret is not None, "A new secret should have been written"
|
|
|
|
def test_reissue_totp_nonexistent_user_exits_nonzero(self, cli_db: str):
|
|
"""reissue-totp for an unknown user must SystemExit with code != 0."""
|
|
parser = build_parser()
|
|
args = parser.parse_args(["reissue-totp", "ghost-user"])
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
cmd_reissue_totp(args)
|
|
assert exc_info.value.code != 0
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Argument-parser edge-cases
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class TestParserEdgeCases:
|
|
"""Ensure argparse flags behave as expected."""
|
|
|
|
def test_unlock_requires_flag(self):
|
|
"""unlock without any flag should exit with a parse error (non-zero)."""
|
|
parser = build_parser()
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
parser.parse_args(["unlock"])
|
|
assert exc_info.value.code != 0
|
|
|
|
def test_unlock_ip_and_all_mutually_exclusive(self):
|
|
"""--ip and --all together should produce a parse error."""
|
|
parser = build_parser()
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
parser.parse_args(["unlock", "--all", "--ip", "1.2.3.4"])
|
|
assert exc_info.value.code != 0
|
|
|
|
def test_unknown_command_exits_nonzero(self):
|
|
"""An unknown sub-command must exit non-zero."""
|
|
parser = build_parser()
|
|
with pytest.raises(SystemExit) as exc_info:
|
|
parser.parse_args(["nonexistent-command"])
|
|
assert exc_info.value.code != 0
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Module-level smoke: python -m scripts.admin_cli --help
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_help_flag_exits_zero():
|
|
"""python -m scripts.admin_cli --help must exit 0."""
|
|
result = subprocess.run(
|
|
[sys.executable, "-m", "scripts.admin_cli", "--help"],
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
assert result.returncode == 0
|
|
assert "reset-password" in result.stdout
|
|
assert "unlock" in result.stdout
|
|
assert "disable-totp" in result.stdout
|
|
assert "reissue-totp" in result.stdout
|
|
assert "list-admin" in result.stdout
|