DL6ER 19de438450 Add security regression tests for auth and query hardening ...

Cover three fixes from the security pass: session cookies carry the Secure attribute only over TLS (and never over plain HTTP), an accepted TOTP code cannot be replayed, and /api/queries clamps an unbounded length parameter. The cookie and TOTP tests live in a self-contained module so they do not disturb the order-dependent workflow in test_z_auth.py; the TOTP test clears the shared secret via the session created by the accepted login so cleanup neither trips the replay guard nor emits a 2FA warning. Account for the module's four extra pihole.toml writes in test_final.bats.

Signed-off-by: DL6ER <dl6er@dl6er.de>

2026-07-04 20:25:14 +02:00

..

json

…

libs

Port API tests from BATS to pytest and fix ResponseVerifyer

2026-03-25 08:51:04 +01:00

checkAPI.py

Block Teleporter import for CLI sessions

2026-04-03 13:05:13 +03:00

conftest.py

tests: resolve iCloud Private Relay zones from local pdns

2026-06-24 06:25:39 +00:00

openapi-enforcer.js

…

pytest.ini

test: add pytest API test files and final BATS validation suite

2026-03-25 11:28:03 +01:00

test_api.py

Add security regression tests for auth and query hardening

2026-07-04 20:25:14 +02:00

test_m_mutations.py

fix: accept punycode domains that libidn2 rejects under IDNA2008

2026-04-06 11:08:42 +02:00

test_openapi.py

fix: correct auth_method in test error messages, fix stale comment

2026-03-29 21:14:22 +02:00

test_s_auth_stress.py

Address review comments

2026-05-06 19:10:21 +02:00

test_z_auth_security.py

Add security regression tests for auth and query hardening

2026-07-04 20:25:14 +02:00

test_z_auth.py

test: add PUT/DELETE, batch delete, query filter, and auth tests

2026-03-30 21:26:16 +02:00

test-rate-limit.py

Add rate-limiting on password login attempts

2023-10-07 19:59:32 +02:00