Forge-Store/Forge-Engine
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

Phase 3 : hardening qualite de code - typage strict, securite, dead code, a11y

Browse Source 
Config strictement stricte partout (ruff, mypy --strict, bandit, vulture,
import-linter, eslint, stylelint), aucune regle desactivee "pour ne pas
casser le build" - l'existant a ete corrige pour la satisfaire plutot que
l'inverse. Hooks pre-commit locaux (language: system) bloquants.

- Typage mypy --strict propage a tout le moteur (db, screens, auth, core,
  ai, routes, puis publish/scripts/tests/app.py/build_css.py).
- Securite : fuite de handle fichier Windows corrigee dans l'export SCORM
  (routes/publish/export_scorm.py), CSRF/RNG non-crypto/xAPI documentes
  (# nosec, # NOSONAR justifies), nouveau db.json_for_script() (echappe
  "</script>" dans le JSON embarque en <script>, 25 sites).
- Architecture : imports circulaires/F811 nettoyes, contrats
  import-linter respectes, code mort retire (vulture).
- Accessibilite : 69 champs de formulaire sans label correctement
  associe corriges (for/id ou aria-label) sur 11 templates.
- ESLint/Stylelint : lot mecanique JS/CSS, regles ajustees puis
  appliquees (aucune desactivee sans verification individuelle).
- Tests : isolation du compte admin partage (nettoyage ponctuel +
  fixture de teardown automatique en filet de securite), suite complete
  verte (591 tests Python, 241 tests JS).
- SonarQube Community Build self-heberge (Docker + PostgreSQL) : rapport
  complet analyse point par point, faux positifs documentes.
- .gitattributes ajoute (LF force) : core.autocrlf=true sur cette machine
  faisait echouer ESLint (linebreak-style) via un bug connu de git
  (checkout "en place" qui ignore l'eol force sur un fichier deja
  present sur disque - contourne en supprimant puis recreant chaque
  fichier suivi).

djLint (H021, styles inline) volontairement saute pour ce commit -
backlog assume, deja documente, traite dans un lot separe.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
william
2026-09-15 16:06:15 +02:00
co-authored by Claude Sonnet 5
parent 7db4803b93
commit c57420c8c9
454 changed files with 16448 additions and 6967 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_profile.py
+84 -45
View File
@@ -1,15 +1,16 @@
"""Page de profil (routes/auth/profile.py) : modifier nom/prénom, changer
de mot de passe, demander la suppression de son compte (avec mot de passe
+ confirmation textuelle, voir templates/auth/profile.html)."""
import pyotp
from flask.testing import FlaskClient
import auth
import db
from tests.test_auth import _register, _confirm_2fa, _complete_onboarding, _cleanup_project, anon_client # noqa: F401
from tests.conftest import not_none
from tests.test_auth import _cleanup_project, _complete_onboarding, _confirm_2fa, _register, anon_client # noqa: F401
def test_profile_page_shows_current_user_info(anon_client):
def test_profile_page_shows_current_user_info(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "profileinfo@example.com", prenom="Ada", nom="Lovelace")
_confirm_2fa(anon_client)
try:
@@ -21,20 +22,20 @@ def test_profile_page_shows_current_user_info(anon_client):
_cleanup_project("profileinfo@example.com")
def test_update_name(anon_client):
def test_update_name(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "updatename@example.com", prenom="Old", nom="Name")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/update-name", data={"prenom": "New", "nom": "Name2"})
assert "mises à jour" in resp.get_data(as_text=True)
user = auth.get_user_by_email("updatename@example.com")
user = not_none(auth.get_user_by_email("updatename@example.com"))
assert user["prenom"] == "New"
assert user["nom"] == "Name2"
finally:
_cleanup_project("updatename@example.com")
def test_update_name_requires_both_fields(anon_client):
def test_update_name_requires_both_fields(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "updatenameblank@example.com")
_confirm_2fa(anon_client)
try:
@@ -44,60 +45,82 @@ def test_update_name_requires_both_fields(anon_client):
_cleanup_project("updatenameblank@example.com")
def test_change_password_requires_correct_current_password(anon_client):
def test_change_password_requires_correct_current_password(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "changepwwrong@example.com")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/change-password", data={
"current_password": "wrong", "new_password": "Nouveau$ecret1", "new_password_confirm": "Nouveau$ecret1",
})
resp = anon_client.post(
"/profile/change-password",
data={
"current_password": "wrong",
"new_password": "Nouveau$ecret1",
"new_password_confirm": "Nouveau$ecret1",
},
)
assert "incorrect" in resp.get_data(as_text=True)
finally:
_cleanup_project("changepwwrong@example.com")
def test_change_password_rejects_mismatched_confirmation(anon_client):
def test_change_password_rejects_mismatched_confirmation(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "changepwmismatch@example.com")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/change-password", data={
"current_password": "Sup3r$ecret!", "new_password": "Nouveau$ecret1", "new_password_confirm": "Autre$ecret2",
})
resp = anon_client.post(
"/profile/change-password",
data={
"current_password": "Sup3r$ecret!",
"new_password": "Nouveau$ecret1",
"new_password_confirm": "Autre$ecret2",
},
)
assert "ne correspondent pas" in resp.get_data(as_text=True)
finally:
_cleanup_project("changepwmismatch@example.com")
def test_change_password_rejects_a_weak_new_password(anon_client):
def test_change_password_rejects_a_weak_new_password(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "changepwweak@example.com")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/change-password", data={
"current_password": "Sup3r$ecret!", "new_password": "faible", "new_password_confirm": "faible",
})
resp = anon_client.post(
"/profile/change-password",
data={
"current_password": "Sup3r$ecret!",
"new_password": "faible",
"new_password_confirm": "faible",
},
)
assert "faible" in resp.get_data(as_text=True)
finally:
_cleanup_project("changepwweak@example.com")
def test_change_password_success_lets_login_with_new_password(anon_client):
def test_change_password_success_lets_login_with_new_password(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "changepwok@example.com")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/change-password", data={
"current_password": "Sup3r$ecret!", "new_password": "Nouveau$ecret1", "new_password_confirm": "Nouveau$ecret1",
})
resp = anon_client.post(
"/profile/change-password",
data={
"current_password": "Sup3r$ecret!",
"new_password": "Nouveau$ecret1",
"new_password_confirm": "Nouveau$ecret1",
},
)
assert "modifié" in resp.get_data(as_text=True)
anon_client.post("/logout")
resp = anon_client.post("/login", data={"email": "changepwok@example.com", "password": "Nouveau$ecret1"}, follow_redirects=False)
resp = anon_client.post(
"/login", data={"email": "changepwok@example.com", "password": "Nouveau$ecret1"}, follow_redirects=False
)
assert resp.status_code == 302
assert resp.headers["Location"] == "/login/2fa"
finally:
_cleanup_project("changepwok@example.com")
def test_delete_account_requires_correct_password(anon_client):
def test_delete_account_requires_correct_password(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "deletewrongpw@example.com")
_confirm_2fa(anon_client)
try:
@@ -108,7 +131,7 @@ def test_delete_account_requires_correct_password(anon_client):
_cleanup_project("deletewrongpw@example.com")
def test_delete_account_requires_the_confirmation_phrase(anon_client):
def test_delete_account_requires_the_confirmation_phrase(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "deletenoconfirm@example.com")
_confirm_2fa(anon_client)
try:
@@ -119,32 +142,38 @@ def test_delete_account_requires_the_confirmation_phrase(anon_client):
_cleanup_project("deletenoconfirm@example.com")
def test_delete_account_removes_user_and_their_project(anon_client):
def test_delete_account_removes_user_and_their_project(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "deleteforreal@example.com")
_confirm_2fa(anon_client)
_complete_onboarding(anon_client)
user = auth.get_user_by_email("deleteforreal@example.com")
user = not_none(auth.get_user_by_email("deleteforreal@example.com"))
slug = user["project_slug"]
import os
assert os.path.isdir(db.game_dir(slug))
resp = anon_client.post("/profile/delete", data={"current_password": "Sup3r$ecret!", "confirm_text": "SUPPRIMER"}, follow_redirects=False)
resp = anon_client.post(
"/profile/delete",
data={"current_password": "Sup3r$ecret!", "confirm_text": "SUPPRIMER"},
follow_redirects=False,
)
assert resp.status_code == 302
assert resp.headers["Location"] == "/login"
assert auth.get_user_by_email("deleteforreal@example.com") is None
assert not os.path.isdir(db.game_dir(slug))
def test_the_only_admin_account_cannot_be_deleted(client):
def test_the_only_admin_account_cannot_be_deleted(client: FlaskClient) -> None:
"""`client` (conftest.py) est déjà connecté en tant qu'admin unique de
la session de tests."""
resp = client.post("/profile/delete", data={"current_password": "Test1234!", "confirm_text": "SUPPRIMER"})
assert "administrateur" in resp.get_data(as_text=True)
import tests.conftest as conftest_module
assert auth.get_user_by_id(conftest_module._TEST_ADMIN_ID) is not None
def test_regenerate_recovery_codes_requires_correct_password(anon_client):
def test_regenerate_recovery_codes_requires_correct_password(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "regencodeswrong@example.com")
_confirm_2fa(anon_client)
try:
@@ -154,10 +183,10 @@ def test_regenerate_recovery_codes_requires_correct_password(anon_client):
_cleanup_project("regencodeswrong@example.com")
def test_regenerate_recovery_codes_replaces_the_old_ones_and_shows_them_once(anon_client):
def test_regenerate_recovery_codes_replaces_the_old_ones_and_shows_them_once(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "regencodesok@example.com")
_confirm_2fa(anon_client)
user = auth.get_user_by_email("regencodesok@example.com")
user = not_none(auth.get_user_by_email("regencodesok@example.com"))
try:
old_codes = auth.generate_recovery_codes(user["id"])
@@ -179,7 +208,7 @@ def test_regenerate_recovery_codes_replaces_the_old_ones_and_shows_them_once(ano
_cleanup_project("regencodesok@example.com")
def test_update_email_requires_correct_password(anon_client):
def test_update_email_requires_correct_password(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "emailwrongpw@example.com")
_confirm_2fa(anon_client)
try:
@@ -190,31 +219,35 @@ def test_update_email_requires_correct_password(anon_client):
_cleanup_project("emailwrongpw@example.com")
def test_update_email_rejects_invalid_format(anon_client):
def test_update_email_rejects_invalid_format(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "emailinvalid@example.com")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/update-email", data={"email": "not-an-email", "current_password": "Sup3r$ecret!"})
resp = anon_client.post(
"/profile/update-email", data={"email": "not-an-email", "current_password": "Sup3r$ecret!"}
)
assert "invalide" in resp.get_data(as_text=True)
finally:
_cleanup_project("emailinvalid@example.com")
def test_update_email_rejects_an_email_already_used(anon_client):
def test_update_email_rejects_an_email_already_used(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
_register(anon_client, "emailtaken1@example.com")
_confirm_2fa(anon_client)
anon_client.post("/logout")
_register(anon_client, "emailtaken2@example.com")
_confirm_2fa(anon_client)
try:
resp = anon_client.post("/profile/update-email", data={"email": "emailtaken1@example.com", "current_password": "Sup3r$ecret!"})
resp = anon_client.post(
"/profile/update-email", data={"email": "emailtaken1@example.com", "current_password": "Sup3r$ecret!"}
)
assert "existe déjà" in resp.get_data(as_text=True)
finally:
_cleanup_project("emailtaken1@example.com")
_cleanup_project("emailtaken2@example.com")
def test_update_email_never_touches_the_project_folder(anon_client):
def test_update_email_never_touches_the_project_folder(anon_client: FlaskClient) -> None: # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
"""Le dossier propriétaire d'un projet est nommé d'après l'ID du
compte (voir routes/games/games_new.py, opaque et stable — jamais
l'email, voir scripts/migrate_owner_folders_to_user_id.py pour la
@@ -226,11 +259,13 @@ def test_update_email_never_touches_the_project_folder(anon_client):
_register(anon_client, "oldmail@example.com")
_confirm_2fa(anon_client)
_complete_onboarding(anon_client)
old_user = auth.get_user_by_email("oldmail@example.com")
old_user = not_none(auth.get_user_by_email("oldmail@example.com"))
old_slug = old_user["project_slug"]
assert os.path.isdir(db.game_dir(old_slug))
try:
resp = anon_client.post("/profile/update-email", data={"email": "newmail@example.com", "current_password": "Sup3r$ecret!"})
resp = anon_client.post(
"/profile/update-email", data={"email": "newmail@example.com", "current_password": "Sup3r$ecret!"}
)
assert "mise à jour" in resp.get_data(as_text=True)
assert auth.get_user_by_email("oldmail@example.com") is None
@@ -242,7 +277,9 @@ def test_update_email_never_touches_the_project_folder(anon_client):
# La connexion se fait désormais avec la nouvelle adresse.
anon_client.post("/logout")
resp = anon_client.post("/login", data={"email": "newmail@example.com", "password": "Sup3r$ecret!"}, follow_redirects=False)
resp = anon_client.post(
"/login", data={"email": "newmail@example.com", "password": "Sup3r$ecret!"}, follow_redirects=False
)
assert resp.status_code == 302
assert resp.headers["Location"] == "/login/2fa"
finally:
@@ -250,7 +287,7 @@ def test_update_email_never_touches_the_project_folder(anon_client):
_cleanup_project("newmail@example.com")
def test_update_email_for_an_admin_does_not_touch_any_project_folder(client, game):
def test_update_email_for_an_admin_does_not_touch_any_project_folder(client: FlaskClient, game: str) -> None:
"""`client`/`game` (conftest.py) : compte admin, pas de project_slug
dédié — changer son adresse ne doit renommer aucun dossier. L'admin de
test est PARTAGÉ par toute la session de tests (voir conftest.py) :
@@ -259,10 +296,12 @@ def test_update_email_for_an_admin_does_not_touch_any_project_folder(client, gam
import tests.conftest as conftest_module
try:
resp = client.post("/profile/update-email", data={"email": "newadminmail@example.com", "current_password": "Test1234!"})
resp = client.post(
"/profile/update-email", data={"email": "newadminmail@example.com", "current_password": "Test1234!"}
)
assert "mise à jour" in resp.get_data(as_text=True)
user = auth.get_user_by_id(conftest_module._TEST_ADMIN_ID)
user = not_none(auth.get_user_by_id(conftest_module._TEST_ADMIN_ID))
assert user["email"] == "newadminmail@example.com"
assert user["project_slug"] is None
assert db.game_meta(game) is not None