feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

2026-08-31 13:48:54 +05:30
parent 4e21d617ce
commit e91cdbae6e
48 changed files with 3742 additions and 65 deletions
@@ -0,0 +1,98 @@
+import urllib.request
+import urllib.parse
+import json
+import time
+
+BASE_URL = 'http://127.0.0.1:8000'
+VALID_KEY = 'skyheal_secure_api_key_2026'
+
+def http_post(url, body_dict=None, token=None, headers=None):
+    if headers is None:
+        headers = {'Content-Type': 'application/json'}
+    else:
+        headers = dict(headers)
+        if 'Content-Type' not in headers:
+            headers['Content-Type'] = 'application/json'
+
+    if token:
+        headers['Authorization'] = f"Bearer {token}"
+
+    data_bytes = json.dumps(body_dict).encode('utf-8') if body_dict is not None else b''
+    req = urllib.request.Request(url, data=data_bytes, headers=headers, method='POST')
+    try:
+        with urllib.request.urlopen(req) as res:
+            return res.status, json.loads(res.read().decode('utf-8')), res.headers
+    except urllib.error.HTTPError as e:
+        body = e.read().decode('utf-8', errors='ignore')
+        try:
+            parsed = json.loads(body)
+        except:
+            parsed = body
+        return e.code, parsed, e.headers
+
+def http_get(url, token=None, headers=None):
+    if headers is None:
+        headers = {}
+    else:
+        headers = dict(headers)
+    if token:
+        headers['Authorization'] = f"Bearer {token}"
+    req = urllib.request.Request(url, headers=headers, method='GET')
+    try:
+        with urllib.request.urlopen(req) as res:
+            ct = res.headers.get('Content-Type', '')
+            body = res.read().decode('utf-8', errors='ignore')
+            if 'json' in ct:
+                return res.status, json.loads(body), res.headers
+            return res.status, body, res.headers
+    except urllib.error.HTTPError as e:
+        body = e.read().decode('utf-8', errors='ignore')
+        try:
+            parsed = json.loads(body)
+        except:
+            parsed = body
+        return e.code, parsed, e.headers
+
+def run_automated_production_tests():
+    test_results = []
+
+    # 1. Test Authentication Security
+    c_no_auth, _, _ = http_post(f'{BASE_URL}/v1/onboarding/start', {"patient": {"id": "P1"}})
+    test_results.append({"test": "1. Reject Unauthenticated Request (401)", "passed": c_no_auth == 401, "status": c_no_auth})
+
+    c_auth, r_auth, _ = http_post(f'{BASE_URL}/v1/onboarding/start', {
+        "patient": {"id": "PAT-PROD-01", "name": "Prod Patient", "age": 32, "gender": "female"},
+        "category": {"type": "general", "code": "general_medicine", "name": "General Medicine"}
+    }, token="test_token_PAT-PROD-01")
+    s_id = r_auth.get("session_id") if isinstance(r_auth, dict) else None
+    test_results.append({"test": "2. Authenticated Session Creation (200)", "passed": c_auth == 200, "status": c_auth})
+
+    # 2. Test IDOR Session Isolation
+    if s_id:
+        c_idor, r_idor, _ = http_post(f'{BASE_URL}/v1/onboarding/{s_id}/message', {"message": "Unauthorized message"}, token="test_token_PAT-PROD-02")
+        test_results.append({"test": "3. IDOR Prevention Cross-Session Access (403)", "passed": c_idor == 403, "status": c_idor})
+
+    # 3. Test Response Security Headers & X-Request-ID
+    c_hdr, _, hdrs = http_get(f'{BASE_URL}/health')
+    req_id = hdrs.get("X-Request-ID")
+    nosniff = hdrs.get("X-Content-Type-Options")
+    frame = hdrs.get("X-Frame-Options")
+    hdr_passed = req_id is not None and nosniff == "nosniff" and frame == "DENY"
+    test_results.append({"test": "4. Security Headers & X-Request-ID Correlation", "passed": hdr_passed, "status": c_hdr})
+
+    # 4. Test Age Validation Schema Bounds
+    c_age_neg, _, _ = http_post(f'{BASE_URL}/v1/onboarding/start', {
+        "patient": {"id": "PAT-NEG", "name": "Invalid Age", "age": -10, "gender": "female"},
+        "category": {"type": "general", "code": "general_medicine", "name": "General Medicine"}
+    }, token=VALID_KEY)
+    test_results.append({"test": "5. Schema Validation Negative Age Rejection (422)", "passed": c_age_neg == 422, "status": c_age_neg})
+
+    total = len(test_results)
+    passed = sum(1 for t in test_results if t['passed'])
+    print(f"AUTOMATED PRODUCTION TESTS COMPLETED: {passed}/{total} Passed.")
+
+    with open('tests_production_results.json', 'w', encoding='utf-8') as f:
+        json.dump({"total": total, "passed": passed, "results": test_results}, f, indent=2)
+
+if __name__ == '__main__':
+    run_automated_production_tests()