99 lines
4.2 KiB
Python
99 lines
4.2 KiB
Python
import urllib.request
|
|
import urllib.parse
|
|
import json
|
|
import time
|
|
|
|
BASE_URL = 'http://127.0.0.1:8000'
|
|
VALID_KEY = 'skyheal_secure_api_key_2026'
|
|
|
|
def http_post(url, body_dict=None, token=None, headers=None):
|
|
if headers is None:
|
|
headers = {'Content-Type': 'application/json'}
|
|
else:
|
|
headers = dict(headers)
|
|
if 'Content-Type' not in headers:
|
|
headers['Content-Type'] = 'application/json'
|
|
|
|
if token:
|
|
headers['Authorization'] = f"Bearer {token}"
|
|
|
|
data_bytes = json.dumps(body_dict).encode('utf-8') if body_dict is not None else b''
|
|
req = urllib.request.Request(url, data=data_bytes, headers=headers, method='POST')
|
|
try:
|
|
with urllib.request.urlopen(req) as res:
|
|
return res.status, json.loads(res.read().decode('utf-8')), res.headers
|
|
except urllib.error.HTTPError as e:
|
|
body = e.read().decode('utf-8', errors='ignore')
|
|
try:
|
|
parsed = json.loads(body)
|
|
except:
|
|
parsed = body
|
|
return e.code, parsed, e.headers
|
|
|
|
def http_get(url, token=None, headers=None):
|
|
if headers is None:
|
|
headers = {}
|
|
else:
|
|
headers = dict(headers)
|
|
if token:
|
|
headers['Authorization'] = f"Bearer {token}"
|
|
req = urllib.request.Request(url, headers=headers, method='GET')
|
|
try:
|
|
with urllib.request.urlopen(req) as res:
|
|
ct = res.headers.get('Content-Type', '')
|
|
body = res.read().decode('utf-8', errors='ignore')
|
|
if 'json' in ct:
|
|
return res.status, json.loads(body), res.headers
|
|
return res.status, body, res.headers
|
|
except urllib.error.HTTPError as e:
|
|
body = e.read().decode('utf-8', errors='ignore')
|
|
try:
|
|
parsed = json.loads(body)
|
|
except:
|
|
parsed = body
|
|
return e.code, parsed, e.headers
|
|
|
|
def run_automated_production_tests():
|
|
test_results = []
|
|
|
|
# 1. Test Authentication Security
|
|
c_no_auth, _, _ = http_post(f'{BASE_URL}/v1/onboarding/start', {"patient": {"id": "P1"}})
|
|
test_results.append({"test": "1. Reject Unauthenticated Request (401)", "passed": c_no_auth == 401, "status": c_no_auth})
|
|
|
|
c_auth, r_auth, _ = http_post(f'{BASE_URL}/v1/onboarding/start', {
|
|
"patient": {"id": "PAT-PROD-01", "name": "Prod Patient", "age": 32, "gender": "female"},
|
|
"category": {"type": "general", "code": "general_medicine", "name": "General Medicine"}
|
|
}, token="test_token_PAT-PROD-01")
|
|
s_id = r_auth.get("session_id") if isinstance(r_auth, dict) else None
|
|
test_results.append({"test": "2. Authenticated Session Creation (200)", "passed": c_auth == 200, "status": c_auth})
|
|
|
|
# 2. Test IDOR Session Isolation
|
|
if s_id:
|
|
c_idor, r_idor, _ = http_post(f'{BASE_URL}/v1/onboarding/{s_id}/message', {"message": "Unauthorized message"}, token="test_token_PAT-PROD-02")
|
|
test_results.append({"test": "3. IDOR Prevention Cross-Session Access (403)", "passed": c_idor == 403, "status": c_idor})
|
|
|
|
# 3. Test Response Security Headers & X-Request-ID
|
|
c_hdr, _, hdrs = http_get(f'{BASE_URL}/health')
|
|
req_id = hdrs.get("X-Request-ID")
|
|
nosniff = hdrs.get("X-Content-Type-Options")
|
|
frame = hdrs.get("X-Frame-Options")
|
|
hdr_passed = req_id is not None and nosniff == "nosniff" and frame == "DENY"
|
|
test_results.append({"test": "4. Security Headers & X-Request-ID Correlation", "passed": hdr_passed, "status": c_hdr})
|
|
|
|
# 4. Test Age Validation Schema Bounds
|
|
c_age_neg, _, _ = http_post(f'{BASE_URL}/v1/onboarding/start', {
|
|
"patient": {"id": "PAT-NEG", "name": "Invalid Age", "age": -10, "gender": "female"},
|
|
"category": {"type": "general", "code": "general_medicine", "name": "General Medicine"}
|
|
}, token=VALID_KEY)
|
|
test_results.append({"test": "5. Schema Validation Negative Age Rejection (422)", "passed": c_age_neg == 422, "status": c_age_neg})
|
|
|
|
total = len(test_results)
|
|
passed = sum(1 for t in test_results if t['passed'])
|
|
print(f"AUTOMATED PRODUCTION TESTS COMPLETED: {passed}/{total} Passed.")
|
|
|
|
with open('tests_production_results.json', 'w', encoding='utf-8') as f:
|
|
json.dump({"total": total, "passed": passed, "results": test_results}, f, indent=2)
|
|
|
|
if __name__ == '__main__':
|
|
run_automated_production_tests()
|