feat(cloud-console): add user authentication and administration

2026-07-13 17:54:53 +08:00
parent 035b177128
commit cdef630e67
35 changed files with 4126 additions and 113 deletions
@@ -102,6 +102,51 @@ def test_load_control_config_rejects_missing_production_credentials() -> None:
        )


+def test_load_control_config_parses_user_session_settings() -> None:
+    config = load_control_config(
+        {
+            "CLOUD_USER_SESSION_IDLE_SECONDS": "600",
+            "CLOUD_USER_SESSION_ABSOLUTE_SECONDS": "1200",
+            "CLOUD_LOGIN_FAILURE_LIMIT": "3",
+            "CLOUD_LOGIN_FAILURE_WINDOW_SECONDS": "60",
+            "CLOUD_LOGIN_BLOCK_SECONDS": "90",
+            "CLOUD_SESSION_COOKIE_SECURE": "true",
+            "CLOUD_TRUST_PROXY_HEADERS": "true",
+        }
+    )
+
+    assert config.user_session_idle_seconds == 600
+    assert config.user_session_absolute_seconds == 1200
+    assert config.login_failure_limit == 3
+    assert config.login_block_seconds == 90
+    assert config.session_cookie_secure is True
+    assert config.trust_proxy_headers is True
+
+
+def test_load_control_config_rejects_unsafe_user_session_ttls() -> None:
+    with pytest.raises(CloudConfigurationError, match="ABSOLUTE"):
+        load_control_config(
+            {
+                "CLOUD_USER_SESSION_IDLE_SECONDS": "1200",
+                "CLOUD_USER_SESSION_ABSOLUTE_SECONDS": "600",
+            }
+        )
+
+
+def test_production_requires_secure_user_session_cookie() -> None:
+    with pytest.raises(CloudConfigurationError, match="secure user session"):
+        load_control_config(
+            {
+                "CLOUD_ENVIRONMENT": "production",
+                "CLOUD_DATABASE_URL": "postgresql://db/cloud",
+                "CLOUD_PUBLIC_CREDENTIALS_JSON": (
+                    '[{"principal_id":"sdk","token":"secret","scopes":[]}]'
+                ),
+                "CLOUD_SESSION_COOKIE_SECURE": "false",
+            }
+        )
+
+
@pytest.mark.parametrize(
    "name,value",
    [