zhanghongyu_0626
3995cb44d8
- Added `auth.py` for mock login and JWT issuance. - Introduced `chat.py` for handling chat requests with role-based access control. - Enhanced `main.py` to include new routers and middleware for tracing. - Implemented input validation in `input_guard.py` to prevent SQL injection. - Created repositories for managing agent sessions and audit logs. - Added exception handling for authorization errors. - Updated settings to include JWT configuration. - Introduced tests for authentication and input validation.
17 lines
527 B
Python
17 lines
527 B
Python
"""Wave 0：输入防护测试。"""
|
|
|
|
|
|
def test_block_sql_injection_in_chat(client):
|
|
login = client.post("/api/auth/login", json={"actor_id": "STAFF-20001", "token_type": "staff"})
|
|
token = login.json()["data"]["access_token"]
|
|
resp = client.post(
|
|
"/api/chat",
|
|
json={"message": "please DROP TABLE users"},
|
|
headers={
|
|
"Authorization": f"Bearer {token}",
|
|
"X-Agent-Type": "analyst",
|
|
},
|
|
)
|
|
assert resp.status_code == 400
|
|
assert resp.json()["code"] == 400
|