mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-11-02 03:02:28 +01:00
fix(editor): stabilize image generation, layer editing and controls (#6992)
* fix(editor): stabilize image workflows and editing controls
* docs(editor): add desktop and mobile visual validation evidence
* fix(editor): synchronize quick edit model events and register imagePreferences in test coordinator
* fix(settings): enforce authoritative global image-gen policy and non-admin preference persistence
- Enforce authoritative administrator global image_gen_enabled disable in get_user_setting, do_generate_image, and image_editing_provider_available, preventing non-admin user preference overrides while preserving user-disabled opt-outs and can_generate_images privilege checks across direct, gallery, and editor paths.
- Filter non-admin preference persistence in saveImagePreferences to user preference keys only (image_model, image_edit_model, image_quality), preventing global policy toggles from leaking into user preferences.
- Return accurate 200 OK Response from saveImagePreferences after fallback persistence succeeds so settings UI displays 'Saved' instead of false 403 error, while retaining visibility of real errors.
- Load per-user preferences via readImagePreferences in initImageSettings so non-admin selections persist and display correctly after page reload.
- Clear per-user model preferences on successful admin save (POST /api/auth/settings) via PUT /api/prefs/{key} with value: null to prevent stale per-user preferences from shadowing updated global settings.
- Support clearing keys in PUT /api/prefs/{key} when value is null.
- Add comprehensive Python regression tests for global-disabled/user-enabled, global-enabled/user-disabled, and authorized generation, plus Node and browser regression tests for non-admin persistence, toggle isolation, reload, and admin clearing.
* fix(settings): invalidate shared appConfig cache near auth settings write
* fix(test): isolate test_tool_policy unit suite from external model endpoint state
* fix(test): isolate web_fetch failure regression from contextual follow-up heuristics
* fix(test): isolate test_tool_policy from cross-test approval gate state
Ensure _patch_loop_basics disables TOOL_APPROVAL_GATE_ENABLED so routing tests in test_tool_policy run in the intended opt-out posture even when prior tests populate DATA_DIR with skills or untrusted context. Remove unnecessary forced_tools and contextual web mock workarounds.
* fix(settings): isolate non-admin image toggle and surface preference cleanup errors
- Restrict image generation availability toggle to admin users in imageModels.js, disabling the switch for non-admins and reverting unauthorized changes with an explicit message.
- Separate non-admin image model preference saves from global toggle updates.
- Track preference cleanup results on admin save in imagePreferences.js, propagating cleanup failures instead of ignoring them.
- Require valid preference keys on 403 fallback so toggle-only attempts reject cleanly.
- Add /api/prefs route mock to test_image_model_settings_sync_both_directions_and_survive_reopening.
- Add regression coverage for admin cleanup failures and non-admin toggle rejection.
* fix(settings): reconcile admin toggle on partial cleanup failure and report errors
- In imagePreferences.js, distinguish pre-persistence failures from post-save cleanup failures using err.globalSaved and err.phase.
- In imagePreferences.js, notify listeners of global policy updates on partial success before propagating cleanup failure.
- In imageModels.js, retain the persisted target state on admin toggle when global persistence succeeds but cleanup fails.
- In imageModels.js, reconcile admin toggle with authoritative server state via readImagePreferences() after ambiguous or partial failures.
- In imageModels.js, report partial success accurately without suppressing preference cleanup error messages.
- Add regression coverage in test_settings_save_response_ok_js.py for cleanup HTTP 500, cleanup network rejection, successful cleanup, and failed global POST.
---------
Co-authored-by: pewdiepie-archdaemon <pewdiepie-archdaemon@users.noreply.github.com>
Co-authored-by: Alexandre Teixeira <general@alexandreteixeira.dev>
This commit is contained in:
PewDiePie
co-authored by
pewdiepie-archdaemon
Alexandre Teixeira
pewdiepie-archdaemon
Alexandre Teixeira
parent
5353241743
commit
39303f19cd
@@ -118,3 +118,554 @@ def test_failed_save_shows_failure_in_simulated_dom():
|
||||
assert data["serverErrResult"] == {"text": "Failed to save", "color": "var(--red)"}
|
||||
assert data["okResult"] == {"text": "Saved", "color": "var(--fg)"}
|
||||
|
||||
|
||||
@pytest.mark.skipif(not _HAS_NODE, reason="node binary not on PATH")
|
||||
def test_image_preferences_js_policy_and_non_admin_fallback():
|
||||
"""Verify imagePreferences.js non-admin fallback, policy toggle isolation, and admin clearing."""
|
||||
js = """
|
||||
globalThis.window = { dispatchEvent: () => {} };
|
||||
globalThis.CustomEvent = class CustomEvent {};
|
||||
|
||||
const { saveImagePreferences, readImagePreferences } = await import('./static/js/settings/imagePreferences.js');
|
||||
|
||||
const results = {};
|
||||
|
||||
// Scenario 1: Non-admin save (POST /api/auth/settings returns 403)
|
||||
const prefCalls = [];
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/auth/settings') {
|
||||
return { status: 403, ok: false, text: async () => 'Forbidden' };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
prefCalls.push({ url, body: JSON.parse(opts.body) });
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
|
||||
const patch = {
|
||||
image_gen_enabled: true,
|
||||
image_model: 'user-gen-model',
|
||||
image_edit_model: 'user-edit-model',
|
||||
image_quality: 'high',
|
||||
};
|
||||
|
||||
const res = await saveImagePreferences(patch);
|
||||
results.fallbackResOk = res.ok;
|
||||
results.fallbackResStatus = res.status;
|
||||
results.prefCalls = prefCalls;
|
||||
|
||||
// Scenario 2: Non-admin save fails on prefs PUT (keeps actual failure visible)
|
||||
globalThis.fetch = async (url) => {
|
||||
if (url === '/api/auth/settings') return { status: 403, ok: false };
|
||||
if (url.startsWith('/api/prefs/')) return { status: 500, ok: false, text: async () => 'Disk error' };
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
try {
|
||||
await saveImagePreferences({ image_model: 'fail-model' });
|
||||
results.prefFailureThrew = false;
|
||||
} catch (err) {
|
||||
results.prefFailureThrew = true;
|
||||
results.prefFailureStatus = err.status;
|
||||
}
|
||||
|
||||
// Scenario 3: Admin save clears pre-existing per-user preferences
|
||||
const adminPrefClears = [];
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/auth/settings') {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
adminPrefClears.push({ url, body: JSON.parse(opts.body) });
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
const adminRes = await saveImagePreferences({ image_model: 'admin-model', image_gen_enabled: true });
|
||||
results.adminResOk = adminRes.ok;
|
||||
results.adminPrefClears = adminPrefClears;
|
||||
|
||||
// Scenario 4: readImagePreferences loads image_quality along with models
|
||||
globalThis.fetch = async (url) => {
|
||||
if (url === '/api/prefs') {
|
||||
return {
|
||||
ok: true,
|
||||
json: async () => ({ image_model: 'pref-gen', image_quality: 'low' }),
|
||||
};
|
||||
}
|
||||
if (url === '/api/auth/settings') {
|
||||
return {
|
||||
ok: true,
|
||||
json: async () => ({ image_model: 'global-gen', image_edit_model: 'global-edit', image_quality: 'medium' }),
|
||||
};
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
const loaded = await readImagePreferences();
|
||||
results.loaded = loaded;
|
||||
|
||||
console.log(JSON.stringify(results));
|
||||
"""
|
||||
proc = subprocess.run(["node", "--input-type=module", "-e", js], capture_output=True, text=True, check=True)
|
||||
import json
|
||||
data = json.loads(proc.stdout)
|
||||
|
||||
# 1. Non-admin fallback returns ok=True, status=200
|
||||
assert data["fallbackResOk"] is True
|
||||
assert data["fallbackResStatus"] == 200
|
||||
|
||||
# 2. image_gen_enabled was filtered out; only image_model, image_edit_model, image_quality written
|
||||
written_keys = [c["url"].split("/api/prefs/")[1] for c in data["prefCalls"]]
|
||||
assert "image_gen_enabled" not in written_keys
|
||||
assert "image_model" in written_keys
|
||||
assert "image_edit_model" in written_keys
|
||||
assert "image_quality" in written_keys
|
||||
|
||||
# 3. Preference failure threw error and preserved status
|
||||
assert data["prefFailureThrew"] is True
|
||||
assert data["prefFailureStatus"] == 500
|
||||
|
||||
# 4. Admin save cleared per-user preferences with value: null
|
||||
assert data["adminResOk"] is True
|
||||
cleared_keys = [c["url"].split("/api/prefs/")[1] for c in data["adminPrefClears"]]
|
||||
assert "image_model" in cleared_keys
|
||||
for call in data["adminPrefClears"]:
|
||||
assert call["body"] == {"value": None}
|
||||
|
||||
# 5. readImagePreferences includes image_quality from prefs
|
||||
assert data["loaded"]["image_model"] == "pref-gen"
|
||||
assert data["loaded"]["image_edit_model"] == "global-edit"
|
||||
assert data["loaded"]["image_quality"] == "low"
|
||||
|
||||
|
||||
@pytest.mark.skipif(not _HAS_NODE, reason="node binary not on PATH")
|
||||
def test_admin_cleanup_failure_and_rejection_surfaced():
|
||||
"""Verify saveImagePreferences surfaces HTTP failures and rejected network requests during admin cleanup."""
|
||||
js = """
|
||||
globalThis.window = { dispatchEvent: () => {} };
|
||||
globalThis.CustomEvent = class CustomEvent {};
|
||||
|
||||
const { saveImagePreferences } = await import('./static/js/settings/imagePreferences.js');
|
||||
|
||||
const results = {};
|
||||
|
||||
// 1. HTTP 500 failure during admin preference cleanup
|
||||
globalThis.fetch = async (url) => {
|
||||
if (url === '/api/auth/settings') {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
return { status: 500, ok: false, text: async () => 'Database lock error' };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
try {
|
||||
await saveImagePreferences({ image_model: 'admin-model', image_gen_enabled: true });
|
||||
results.http500Threw = false;
|
||||
} catch (err) {
|
||||
results.http500Threw = true;
|
||||
results.http500Status = err.status;
|
||||
results.http500GlobalSaved = err.globalSaved;
|
||||
results.http500Phase = err.phase;
|
||||
}
|
||||
|
||||
// 2. Network rejection during admin preference cleanup
|
||||
globalThis.fetch = async (url) => {
|
||||
if (url === '/api/auth/settings') {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
throw new Error('Network offline');
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
try {
|
||||
await saveImagePreferences({ image_model: 'admin-model', image_gen_enabled: true });
|
||||
results.networkRejectThrew = false;
|
||||
} catch (err) {
|
||||
results.networkRejectThrew = true;
|
||||
results.networkRejectStatus = err.status;
|
||||
results.networkRejectGlobalSaved = err.globalSaved;
|
||||
results.networkRejectPhase = err.phase;
|
||||
}
|
||||
|
||||
// 3. Successful cleanup
|
||||
const clearedKeys = [];
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/auth/settings') {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
clearedKeys.push({ url, body: JSON.parse(opts.body) });
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
const okRes = await saveImagePreferences({ image_model: 'admin-model', image_gen_enabled: true });
|
||||
results.okResStatus = okRes.status;
|
||||
results.clearedKeysCount = clearedKeys.length;
|
||||
|
||||
console.log(JSON.stringify(results));
|
||||
"""
|
||||
proc = subprocess.run(["node", "--input-type=module", "-e", js], capture_output=True, text=True, check=True)
|
||||
import json
|
||||
data = json.loads(proc.stdout)
|
||||
assert data["http500Threw"] is True
|
||||
assert data["http500Status"] == 500
|
||||
assert data["http500GlobalSaved"] is True
|
||||
assert data["http500Phase"] == "cleanup"
|
||||
assert data["networkRejectThrew"] is True
|
||||
assert data["networkRejectStatus"] == 500
|
||||
assert data["networkRejectGlobalSaved"] is True
|
||||
assert data["networkRejectPhase"] == "cleanup"
|
||||
assert data["okResStatus"] == 200
|
||||
assert data["clearedKeysCount"] == 3
|
||||
|
||||
|
||||
@pytest.mark.skipif(not _HAS_NODE, reason="node binary not on PATH")
|
||||
def test_admin_toggle_reconciliation_and_partial_failure_reporting():
|
||||
"""Verify admin toggle reconciles with authoritative server state and reports partial success accurately."""
|
||||
js = """
|
||||
const { initImageSettings } = await import('./static/js/settings/imageModels.js');
|
||||
|
||||
function createEnv() {
|
||||
const elements = {};
|
||||
function makeElement(id, tag = 'div') {
|
||||
const listeners = {};
|
||||
const el = {
|
||||
id, tagName: tag.toUpperCase(),
|
||||
value: '', checked: false, disabled: false, title: '',
|
||||
style: {},
|
||||
parentElement: { title: '', style: {} },
|
||||
closest: () => ({ style: {} }),
|
||||
addEventListener: (evt, cb) => { listeners[evt] = listeners[evt] || []; listeners[evt].push(cb); },
|
||||
dispatchEvent: (evt) => Promise.all((listeners[evt] || []).map(cb => cb())),
|
||||
length: 0, appendChild: () => {}, remove: () => {}
|
||||
};
|
||||
elements[id] = el;
|
||||
return el;
|
||||
}
|
||||
|
||||
const modelSel = makeElement('set-imgModelSelect', 'select');
|
||||
const editModelSel = makeElement('set-imgEditModelSelect', 'select');
|
||||
const qualSel = makeElement('set-imgQualitySelect', 'select');
|
||||
const msg = makeElement('set-imgSettingsMsg', 'span');
|
||||
const enabledToggle = makeElement('set-imgEnabledToggle', 'input');
|
||||
|
||||
globalThis.document = {
|
||||
getElementById: (id) => elements[id] || null,
|
||||
createElement: (tag) => makeElement('anon-' + Math.random(), tag),
|
||||
};
|
||||
globalThis.window = {
|
||||
_isAdmin: true,
|
||||
addEventListener: () => {},
|
||||
removeEventListener: () => {},
|
||||
dispatchEvent: () => {}
|
||||
};
|
||||
globalThis.CustomEvent = class CustomEvent {};
|
||||
|
||||
return { modelSel, editModelSel, qualSel, msg, enabledToggle };
|
||||
}
|
||||
|
||||
const testResults = {};
|
||||
|
||||
// 1. Global POST 200 + cleanup HTTP 500 failure
|
||||
{
|
||||
const { enabledToggle, msg } = createEnv();
|
||||
let serverGlobal = true;
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/model-endpoints') return { ok: true, json: async () => [] };
|
||||
if (url === '/api/prefs') return { ok: true, json: async () => ({}) };
|
||||
if (url === '/api/auth/settings') {
|
||||
if (opts.method === 'POST') {
|
||||
const body = JSON.parse(opts.body);
|
||||
serverGlobal = body.image_gen_enabled;
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
return { ok: true, json: async () => ({ image_gen_enabled: serverGlobal }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
return { status: 500, ok: false, text: async () => 'DB lock' };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
await initImageSettings();
|
||||
enabledToggle.checked = false;
|
||||
await enabledToggle.dispatchEvent('change');
|
||||
testResults.s1_checked = enabledToggle.checked;
|
||||
testResults.s1_server = serverGlobal;
|
||||
testResults.s1_msg = msg.textContent;
|
||||
testResults.s1_color = msg.style.color;
|
||||
}
|
||||
|
||||
// 2. Global POST 200 + cleanup network rejection
|
||||
{
|
||||
const { enabledToggle, msg } = createEnv();
|
||||
let serverGlobal = true;
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/model-endpoints') return { ok: true, json: async () => [] };
|
||||
if (url === '/api/prefs') return { ok: true, json: async () => ({}) };
|
||||
if (url === '/api/auth/settings') {
|
||||
if (opts.method === 'POST') {
|
||||
const body = JSON.parse(opts.body);
|
||||
serverGlobal = body.image_gen_enabled;
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
return { ok: true, json: async () => ({ image_gen_enabled: serverGlobal }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
throw new Error('Network offline');
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
await initImageSettings();
|
||||
enabledToggle.checked = false;
|
||||
await enabledToggle.dispatchEvent('change');
|
||||
testResults.s2_checked = enabledToggle.checked;
|
||||
testResults.s2_server = serverGlobal;
|
||||
testResults.s2_msg = msg.textContent;
|
||||
testResults.s2_color = msg.style.color;
|
||||
}
|
||||
|
||||
// 3. Successful cleanup
|
||||
{
|
||||
const { enabledToggle, msg } = createEnv();
|
||||
let serverGlobal = true;
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/model-endpoints') return { ok: true, json: async () => [] };
|
||||
if (url === '/api/prefs') return { ok: true, json: async () => ({}) };
|
||||
if (url === '/api/auth/settings') {
|
||||
if (opts.method === 'POST') {
|
||||
const body = JSON.parse(opts.body);
|
||||
serverGlobal = body.image_gen_enabled;
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
return { ok: true, json: async () => ({ image_gen_enabled: serverGlobal }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
await initImageSettings();
|
||||
enabledToggle.checked = false;
|
||||
await enabledToggle.dispatchEvent('change');
|
||||
testResults.s3_checked = enabledToggle.checked;
|
||||
testResults.s3_server = serverGlobal;
|
||||
testResults.s3_msg = msg.textContent;
|
||||
testResults.s3_color = msg.style.color;
|
||||
}
|
||||
|
||||
// 4. Failed global POST (HTTP 500)
|
||||
{
|
||||
const { enabledToggle, msg } = createEnv();
|
||||
let serverGlobal = true;
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/model-endpoints') return { ok: true, json: async () => [] };
|
||||
if (url === '/api/prefs') return { ok: true, json: async () => ({}) };
|
||||
if (url === '/api/auth/settings') {
|
||||
if (opts.method === 'POST') {
|
||||
return { status: 500, ok: false, text: async () => 'Internal Server Error' };
|
||||
}
|
||||
return { ok: true, json: async () => ({ image_gen_enabled: serverGlobal }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
await initImageSettings();
|
||||
enabledToggle.checked = false;
|
||||
await enabledToggle.dispatchEvent('change');
|
||||
testResults.s4_checked = enabledToggle.checked;
|
||||
testResults.s4_server = serverGlobal;
|
||||
testResults.s4_msg = msg.textContent;
|
||||
testResults.s4_color = msg.style.color;
|
||||
}
|
||||
|
||||
console.log(JSON.stringify(testResults));
|
||||
"""
|
||||
proc = subprocess.run(["node", "--input-type=module", "-e", js], capture_output=True, text=True, check=True)
|
||||
import json
|
||||
data = json.loads(proc.stdout)
|
||||
|
||||
# 1. Successful global POST followed by HTTP 500 cleanup failure:
|
||||
# Toggle does not revert, server policy was persisted, and message reports partial success + cleanup error
|
||||
assert data["s1_checked"] is False
|
||||
assert data["s1_server"] is False
|
||||
assert "Policy saved, but failed to clear preferences" in data["s1_msg"]
|
||||
assert "DB lock" in data["s1_msg"]
|
||||
assert data["s1_color"] == "var(--red)"
|
||||
|
||||
# 2. Successful global POST followed by network rejection during cleanup:
|
||||
# Toggle does not revert, server policy was persisted, and message reports network failure
|
||||
assert data["s2_checked"] is False
|
||||
assert data["s2_server"] is False
|
||||
assert "Policy saved, but failed to clear preferences" in data["s2_msg"]
|
||||
assert "Network offline" in data["s2_msg"]
|
||||
assert data["s2_color"] == "var(--red)"
|
||||
|
||||
# 3. Successful cleanup:
|
||||
# Toggle saved, server updated, success message displayed
|
||||
assert data["s3_checked"] is False
|
||||
assert data["s3_server"] is False
|
||||
assert data["s3_msg"] == "Saved"
|
||||
assert data["s3_color"] == "var(--fg)"
|
||||
|
||||
# 4. Failed global POST:
|
||||
# Toggle reverts to authoritative server state, error displayed
|
||||
assert data["s4_checked"] is True
|
||||
assert data["s4_server"] is True
|
||||
assert data["s4_msg"] == "Failed to save"
|
||||
assert data["s4_color"] == "var(--red)"
|
||||
|
||||
|
||||
@pytest.mark.skipif(not _HAS_NODE, reason="node binary not on PATH")
|
||||
def test_non_admin_toggle_rejection_and_ui_behavior():
|
||||
"""Verify non-admin cannot change image_gen_enabled via API or UI, and receives unambiguous feedback."""
|
||||
js = """
|
||||
const { saveImagePreferences } = await import('./static/js/settings/imagePreferences.js');
|
||||
|
||||
const results = {};
|
||||
|
||||
// 1. Direct call to saveImagePreferences with only non-admin excluded toggle
|
||||
globalThis.window = { dispatchEvent: () => {} };
|
||||
globalThis.CustomEvent = class CustomEvent {};
|
||||
globalThis.fetch = async (url) => {
|
||||
if (url === '/api/auth/settings') return { status: 403, ok: false, text: async () => 'Forbidden' };
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
try {
|
||||
await saveImagePreferences({ image_gen_enabled: true });
|
||||
results.toggleOnlyThrew = false;
|
||||
} catch (err) {
|
||||
results.toggleOnlyThrew = true;
|
||||
results.toggleOnlyStatus = err.status;
|
||||
}
|
||||
|
||||
// 2. Simulated UI interaction in imageModels.js for non-admin
|
||||
const elements = {};
|
||||
function makeElement(id, tag = 'div') {
|
||||
const listeners = {};
|
||||
const el = {
|
||||
id, tagName: tag.toUpperCase(),
|
||||
value: '', checked: false, disabled: false, title: '',
|
||||
style: {},
|
||||
parentElement: { title: '', style: {} },
|
||||
closest: () => ({ style: {} }),
|
||||
addEventListener: (evt, cb) => { listeners[evt] = listeners[evt] || []; listeners[evt].push(cb); },
|
||||
dispatchEvent: (evt) => Promise.all((listeners[evt] || []).map(cb => cb())),
|
||||
length: 0, appendChild: () => {}, remove: () => {}
|
||||
};
|
||||
elements[id] = el;
|
||||
return el;
|
||||
}
|
||||
|
||||
const modelSel = makeElement('set-imgModelSelect', 'select');
|
||||
const editModelSel = makeElement('set-imgEditModelSelect', 'select');
|
||||
const qualSel = makeElement('set-imgQualitySelect', 'select');
|
||||
const msg = makeElement('set-imgSettingsMsg', 'span');
|
||||
const enabledToggle = makeElement('set-imgEnabledToggle', 'input');
|
||||
|
||||
globalThis.document = {
|
||||
getElementById: (id) => elements[id] || null,
|
||||
createElement: (tag) => makeElement('anon-' + Math.random(), tag),
|
||||
};
|
||||
globalThis.window._isAdmin = false;
|
||||
globalThis.window.addEventListener = () => {};
|
||||
globalThis.window.removeEventListener = () => {};
|
||||
|
||||
const apiCalls = [];
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
apiCalls.push({ url, method: opts.method || 'GET' });
|
||||
if (url === '/api/model-endpoints') return { ok: true, json: async () => [] };
|
||||
if (url === '/api/prefs') return { ok: true, json: async () => ({}) };
|
||||
if (url === '/api/auth/settings') {
|
||||
if (opts.method === 'POST') return { status: 403, ok: false, text: async () => 'Forbidden' };
|
||||
return { ok: true, json: async () => ({ image_gen_enabled: true, image_model: 'global-model' }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
|
||||
const { initImageSettings } = await import('./static/js/settings/imageModels.js');
|
||||
await initImageSettings();
|
||||
|
||||
// Check non-admin initial UI state
|
||||
results.nonAdminToggleDisabled = enabledToggle.disabled;
|
||||
results.nonAdminToggleTitle = enabledToggle.title;
|
||||
results.nonAdminToggleChecked = enabledToggle.checked;
|
||||
|
||||
// Simulate non-admin attempting to toggle image generation
|
||||
enabledToggle.checked = false; // user clicked switch to turn off
|
||||
enabledToggle.dispatchEvent('change');
|
||||
results.revertedChecked = enabledToggle.checked;
|
||||
results.revertedMsgText = msg.textContent;
|
||||
results.revertedMsgColor = msg.style.color;
|
||||
|
||||
// Simulate non-admin changing model preference
|
||||
modelSel.value = 'user-selected-model';
|
||||
await modelSel.dispatchEvent('change');
|
||||
results.modelChangeMsg = msg.textContent;
|
||||
|
||||
// 3. Admin UI interaction in imageModels.js
|
||||
globalThis.window._isAdmin = true;
|
||||
const adminToggle = makeElement('set-imgEnabledToggle', 'input');
|
||||
const adminMsg = makeElement('set-imgSettingsMsg', 'span');
|
||||
elements['set-imgEnabledToggle'] = adminToggle;
|
||||
elements['set-imgSettingsMsg'] = adminMsg;
|
||||
|
||||
let adminSavedToggle = null;
|
||||
globalThis.fetch = async (url, opts = {}) => {
|
||||
if (url === '/api/model-endpoints') return { ok: true, json: async () => [] };
|
||||
if (url === '/api/prefs') return { ok: true, json: async () => ({}) };
|
||||
if (url === '/api/auth/settings') {
|
||||
if (opts.method === 'POST') {
|
||||
const body = JSON.parse(opts.body);
|
||||
adminSavedToggle = body.image_gen_enabled;
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
return { ok: true, json: async () => ({ image_gen_enabled: true, image_model: 'global-model' }) };
|
||||
}
|
||||
if (url.startsWith('/api/prefs/')) {
|
||||
return { status: 200, ok: true, json: async () => ({ ok: true }) };
|
||||
}
|
||||
throw new Error('Unexpected URL: ' + url);
|
||||
};
|
||||
|
||||
await initImageSettings();
|
||||
results.adminToggleDisabled = adminToggle.disabled;
|
||||
adminToggle.checked = false;
|
||||
await adminToggle.dispatchEvent('change');
|
||||
results.adminSavedToggle = adminSavedToggle;
|
||||
results.adminMsg = adminMsg.textContent;
|
||||
|
||||
console.log(JSON.stringify(results));
|
||||
"""
|
||||
proc = subprocess.run(["node", "--input-type=module", "-e", js], capture_output=True, text=True, check=True)
|
||||
import json
|
||||
data = json.loads(proc.stdout)
|
||||
|
||||
# 1. Non-admin toggle-only save threw 403
|
||||
assert data["toggleOnlyThrew"] is True
|
||||
assert data["toggleOnlyStatus"] == 403
|
||||
|
||||
# 2. Non-admin UI has disabled toggle and rejects changes with warning
|
||||
assert data["nonAdminToggleDisabled"] is True
|
||||
assert "Admin access is required" in data["nonAdminToggleTitle"]
|
||||
assert data["nonAdminToggleChecked"] is True
|
||||
assert data["revertedChecked"] is True
|
||||
assert "Admin access is required" in data["revertedMsgText"]
|
||||
assert data["revertedMsgColor"] == "var(--red)"
|
||||
|
||||
# 3. Non-admin model changes succeed
|
||||
assert data["modelChangeMsg"] == "Saved"
|
||||
|
||||
# 4. Admin UI allows toggle changes and persists to auth settings
|
||||
assert data["adminToggleDisabled"] is False
|
||||
assert data["adminSavedToggle"] is False
|
||||
assert data["adminMsg"] == "Saved"
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user