|
| 1 | +""" |
| 2 | +Tests for CORS origin restrictions. |
| 3 | +
|
| 4 | +Validates that the CORS middleware only allows known local origins |
| 5 | +and respects the VOICEBOX_CORS_ORIGINS environment variable. |
| 6 | +
|
| 7 | +Uses a minimal FastAPI app that mirrors the exact CORS configuration |
| 8 | +from backend/main.py, so tests run without heavy ML dependencies. |
| 9 | +
|
| 10 | +Usage: |
| 11 | + pip install httpx pytest fastapi starlette |
| 12 | + python -m pytest backend/tests/test_cors.py -v |
| 13 | +""" |
| 14 | + |
| 15 | +import os |
| 16 | +import pytest |
| 17 | +from fastapi import FastAPI |
| 18 | +from fastapi.middleware.cors import CORSMiddleware |
| 19 | +from starlette.testclient import TestClient |
| 20 | + |
| 21 | + |
| 22 | +def _build_app(env_origins: str = "") -> FastAPI: |
| 23 | + """ |
| 24 | + Build a minimal FastAPI app with the same CORS logic as backend/main.py. |
| 25 | +
|
| 26 | + This mirrors the exact code in main.py so the test validates the real |
| 27 | + configuration without needing torch/numpy/transformers installed. |
| 28 | + """ |
| 29 | + app = FastAPI() |
| 30 | + |
| 31 | + _default_origins = [ |
| 32 | + "http://localhost:5173", |
| 33 | + "http://127.0.0.1:5173", |
| 34 | + "http://localhost:17493", |
| 35 | + "http://127.0.0.1:17493", |
| 36 | + "tauri://localhost", |
| 37 | + "https://tauri.localhost", |
| 38 | + ] |
| 39 | + _cors_origins = _default_origins + [o.strip() for o in env_origins.split(",") if o.strip()] |
| 40 | + |
| 41 | + app.add_middleware( |
| 42 | + CORSMiddleware, |
| 43 | + allow_origins=_cors_origins, |
| 44 | + allow_credentials=True, |
| 45 | + allow_methods=["*"], |
| 46 | + allow_headers=["*"], |
| 47 | + ) |
| 48 | + |
| 49 | + @app.get("/health") |
| 50 | + async def health(): |
| 51 | + return {"status": "ok"} |
| 52 | + |
| 53 | + return app |
| 54 | + |
| 55 | + |
| 56 | +@pytest.fixture() |
| 57 | +def client(): |
| 58 | + return TestClient(_build_app()) |
| 59 | + |
| 60 | + |
| 61 | +@pytest.fixture() |
| 62 | +def client_with_custom_origins(): |
| 63 | + return TestClient(_build_app("https://custom.example.com,https://other.example.com")) |
| 64 | + |
| 65 | + |
| 66 | +def _get_with_origin(client: TestClient, origin: str) -> dict: |
| 67 | + """Send a GET with Origin header, return response headers.""" |
| 68 | + response = client.get("/health", headers={"Origin": origin}) |
| 69 | + return dict(response.headers) |
| 70 | + |
| 71 | + |
| 72 | +def _preflight(client: TestClient, origin: str) -> dict: |
| 73 | + """Send CORS preflight OPTIONS request, return response headers.""" |
| 74 | + response = client.options( |
| 75 | + "/health", |
| 76 | + headers={ |
| 77 | + "Origin": origin, |
| 78 | + "Access-Control-Request-Method": "GET", |
| 79 | + }, |
| 80 | + ) |
| 81 | + return dict(response.headers) |
| 82 | + |
| 83 | + |
| 84 | +class TestCORSDefaultOrigins: |
| 85 | + """CORS should allow known local origins and block everything else.""" |
| 86 | + |
| 87 | + @pytest.mark.parametrize("origin", [ |
| 88 | + "http://localhost:5173", |
| 89 | + "http://127.0.0.1:5173", |
| 90 | + "http://localhost:17493", |
| 91 | + "http://127.0.0.1:17493", |
| 92 | + "tauri://localhost", |
| 93 | + "https://tauri.localhost", |
| 94 | + ]) |
| 95 | + def test_allowed_origins(self, client, origin): |
| 96 | + headers = _get_with_origin(client, origin) |
| 97 | + assert headers.get("access-control-allow-origin") == origin |
| 98 | + |
| 99 | + @pytest.mark.parametrize("origin", [ |
| 100 | + "http://evil.com", |
| 101 | + "http://localhost:9999", |
| 102 | + "https://attacker.example.com", |
| 103 | + "null", |
| 104 | + ]) |
| 105 | + def test_blocked_origins(self, client, origin): |
| 106 | + headers = _get_with_origin(client, origin) |
| 107 | + assert "access-control-allow-origin" not in headers |
| 108 | + |
| 109 | + def test_preflight_allowed(self, client): |
| 110 | + headers = _preflight(client, "http://localhost:5173") |
| 111 | + assert headers.get("access-control-allow-origin") == "http://localhost:5173" |
| 112 | + |
| 113 | + def test_preflight_blocked(self, client): |
| 114 | + headers = _preflight(client, "http://evil.com") |
| 115 | + assert "access-control-allow-origin" not in headers |
| 116 | + |
| 117 | + def test_credentials_header_present(self, client): |
| 118 | + headers = _get_with_origin(client, "http://localhost:5173") |
| 119 | + assert headers.get("access-control-allow-credentials") == "true" |
| 120 | + |
| 121 | + |
| 122 | +class TestCORSCustomOrigins: |
| 123 | + """VOICEBOX_CORS_ORIGINS env var should extend the allowlist.""" |
| 124 | + |
| 125 | + def test_custom_origin_allowed(self, client_with_custom_origins): |
| 126 | + headers = _get_with_origin(client_with_custom_origins, "https://custom.example.com") |
| 127 | + assert headers.get("access-control-allow-origin") == "https://custom.example.com" |
| 128 | + |
| 129 | + def test_other_custom_origin_allowed(self, client_with_custom_origins): |
| 130 | + headers = _get_with_origin(client_with_custom_origins, "https://other.example.com") |
| 131 | + assert headers.get("access-control-allow-origin") == "https://other.example.com" |
| 132 | + |
| 133 | + def test_default_origins_still_work(self, client_with_custom_origins): |
| 134 | + headers = _get_with_origin(client_with_custom_origins, "http://localhost:5173") |
| 135 | + assert headers.get("access-control-allow-origin") == "http://localhost:5173" |
| 136 | + |
| 137 | + def test_unlisted_origin_still_blocked(self, client_with_custom_origins): |
| 138 | + headers = _get_with_origin(client_with_custom_origins, "http://evil.com") |
| 139 | + assert "access-control-allow-origin" not in headers |
| 140 | + |
| 141 | + |
| 142 | +class TestCORSEnvVarParsing: |
| 143 | + """Edge cases for VOICEBOX_CORS_ORIGINS parsing.""" |
| 144 | + |
| 145 | + def test_empty_env_var(self): |
| 146 | + app = _build_app("") |
| 147 | + client = TestClient(app) |
| 148 | + headers = _get_with_origin(client, "http://evil.com") |
| 149 | + assert "access-control-allow-origin" not in headers |
| 150 | + |
| 151 | + def test_whitespace_trimmed(self): |
| 152 | + app = _build_app(" https://spaced.example.com ") |
| 153 | + client = TestClient(app) |
| 154 | + headers = _get_with_origin(client, "https://spaced.example.com") |
| 155 | + assert headers.get("access-control-allow-origin") == "https://spaced.example.com" |
| 156 | + |
| 157 | + def test_trailing_comma_ignored(self): |
| 158 | + app = _build_app("https://one.example.com,") |
| 159 | + client = TestClient(app) |
| 160 | + headers = _get_with_origin(client, "https://one.example.com") |
| 161 | + assert headers.get("access-control-allow-origin") == "https://one.example.com" |
0 commit comments