05/06/2026 Initial commit

2026-05-06 14:19:07 -04:00
parent 9da1dffd9a
commit dde18a2cd2
116 changed files with 4276 additions and 7 deletions
@@ -0,0 +1,25 @@
+"""tests/test_security_headers.py — Verify security headers on both portals."""
+
+
+def test_admin_security_headers(admin_client):
+    resp = admin_client.get("/admin/login")
+    assert resp.headers.get("X-Content-Type-Options") == "nosniff"
+    assert "X-Frame-Options" in resp.headers
+    assert "Referrer-Policy" in resp.headers
+
+
+def test_tenant_security_headers(tenant_client):
+    resp = tenant_client.get("/login")
+    assert resp.headers.get("X-Content-Type-Options") == "nosniff"
+    assert "X-Frame-Options" in resp.headers
+    assert "Content-Security-Policy" in resp.headers
+
+
+def test_checkin_kiosk_404_bad_slug(tenant_client):
+    resp = tenant_client.get("/checkin/INVALID_SLUG!!!")
+    assert resp.status_code == 404
+
+
+def test_checkin_kiosk_404_unknown_tenant(tenant_client):
+    resp = tenant_client.get("/checkin/valid-but-unknown-slug")
+    assert resp.status_code == 404