jpmschweitzerandClaude Sonnet 5
3a3dc959be
`alembic/env.py` took its target from `get_settings().database_url`, composed from `.env`'s production `POSTGRES_*` values, so the most natural command in the repo — a bare `alembic current` — talked to production. `-x target=test` and `-x target=production` now name the database explicitly; anything else exits non-zero before any engine is built, and the one line it prints before migrating never shows a credential. `run_alembic` (tests/conftest.py) passes `-x target=test` and sets `TEST_DATABASE_URL` in the subprocess environment instead of overriding `POSTGRES_*` — the `_components()` shim is gone; nothing else used it. `make migrate-test`, `make migrate-production` and `make dev-test-server` are the three documented ways to reach either database now; `dev-test-server` refuses to start if the resolved database is not `core_api_test`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
41 lines
1.2 KiB
Python
41 lines
1.2 KiB
Python
"""Tests for core-api T-3's `make dev-test-server` target: it must refuse to
|
|
start when the resolved database is not `core_api_test`, before uvicorn ever
|
|
binds the port, and it must never print credentials while doing so."""
|
|
import os
|
|
import socket
|
|
import subprocess
|
|
from urllib.parse import urlsplit
|
|
|
|
from tests.conftest import REPO_ROOT
|
|
|
|
PORT = 8777
|
|
|
|
|
|
def _port_is_free(port: int) -> bool:
|
|
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
|
|
return s.connect_ex(("localhost", port)) != 0
|
|
|
|
|
|
def test_refuses_when_resolved_database_is_not_core_api_test(test_database_url):
|
|
password = urlsplit(test_database_url).password
|
|
wrong = test_database_url.rsplit("/", 1)[0] + "/core_api"
|
|
|
|
env = os.environ.copy()
|
|
env["TEST_DATABASE_URL"] = wrong
|
|
|
|
result = subprocess.run(
|
|
["make", "dev-test-server"],
|
|
cwd=str(REPO_ROOT),
|
|
env=env,
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=15,
|
|
)
|
|
|
|
combined = result.stdout + result.stderr
|
|
assert result.returncode != 0
|
|
assert "core_api_test" in combined
|
|
if password:
|
|
assert password not in combined
|
|
assert _port_is_free(PORT), "dev-test-server must never bind the port when it refuses"
|