feat: professionalize platform release 0.3.13

tests/unit/test_auth_services.py

@@ -0,0 +1,87 @@
+from django.contrib.auth import get_user_model
+from django.test import override_settings
+
+from apps.core.auth_backends import EmailOrUsernameModelBackend
+from apps.core.entra import (
+    EntraConfigError,
+    domain_allowed,
+    entra_enabled,
+    extract_identity,
+    load_config,
+)
+
+
+def test_auth_backend_rejects_missing_and_unknown_credentials(db):
+    backend = EmailOrUsernameModelBackend()
+    assert backend.authenticate(None, username=None, password=None) is None
+    assert backend.authenticate(None, username="unknown@example.invalid", password="secret") is None
+
+
+def test_auth_backend_rejects_inactive_and_wrong_password(db):
+    user = get_user_model().objects.create_user(
+        username="inactive", email="inactive@example.invalid", password="correct", is_active=False
+    )
+    backend = EmailOrUsernameModelBackend()
+
+    assert backend.authenticate(None, username=user.email, password="wrong") is None
+    assert backend.authenticate(None, username=user.email, password="correct") is None
+
+
+def test_auth_backend_handles_duplicate_email_without_ambiguous_login(db):
+    user_model = get_user_model()
+    first = user_model.objects.create_user(
+        username="first", email="shared@example.invalid", password="correct"
+    )
+    user_model.objects.create_user(
+        username="second", email="shared@example.invalid", password="correct"
+    )
+    backend = EmailOrUsernameModelBackend()
+
+    assert backend.authenticate(None, username="shared@example.invalid", password="correct") is None
+    assert backend.authenticate(None, username="first", password="correct") == first
+
+
+@override_settings(ENTRA_ID_ENABLED=True)
+def test_entra_enabled_reflects_configuration():
+    assert entra_enabled() is True
+
+
+@override_settings(
+    ENTRA_ID_ENABLED=True, ENTRA_CLIENT_ID="", ENTRA_CLIENT_SECRET="", ENTRA_TENANT_ID=""
+)
+def test_entra_config_fails_closed_when_credentials_are_incomplete():
+    try:
+        load_config()
+    except EntraConfigError as exc:
+        assert "niet allemaal ingesteld" in str(exc)
+    else:  # pragma: no cover - defensive assertion
+        raise AssertionError("Onvolledige Entra-configuratie werd geaccepteerd")
+
+
+@override_settings(
+    ENTRA_CLIENT_ID="client",
+    ENTRA_CLIENT_SECRET="secret",
+    ENTRA_TENANT_ID="tenant",
+    ENTRA_SCOPES=["User.Read"],
+    ENTRA_ALLOWED_DOMAINS=["@Example.COM"],
+    ENTRA_REDIRECT_URI="https://example.invalid/callback",
+)
+def test_entra_config_normalizes_domains_and_identity_claims():
+    config = load_config()
+    assert config.authority.endswith("/tenant")
+    assert config.allowed_domains == ("example.com",)
+    assert domain_allowed(config, "person@example.com") is True
+    assert domain_allowed(config, "person@other.invalid") is False
+    assert extract_identity(
+        {"id_token_claims": {"preferred_username": " person@example.com ", "name": " Person "}}
+    ) == ("person@example.com", "Person")
+
+
+@override_settings(
+    ENTRA_CLIENT_ID="client",
+    ENTRA_CLIENT_SECRET="secret",
+    ENTRA_TENANT_ID="tenant",
+    ENTRA_ALLOWED_DOMAINS=[],
+)
+def test_entra_allows_any_domain_only_when_allowlist_is_empty():
+    assert domain_allowed(load_config(), "person@example.invalid") is True

tests/unit/test_deployment_configuration.py

@@ -96,7 +96,7 @@ def test_public_https_origin_uses_external_port_not_internal_app_port() -> None:
     assert 'app_public_port="${APP_PUBLIC_PORT:-}"' in deploy_script
     assert 'app_public_port="443"' in deploy_script
     assert 'write_env "PUBLIC_BASE_URL" "$app_base_url" 1' in deploy_script
-    assert 'https://$app_host:$app_port' not in deploy_script
+    assert "https://$app_host:$app_port" not in deploy_script
 
 
 def test_health_endpoints_are_exempt_from_internal_https_redirect() -> None:
@@ -123,4 +123,4 @@ def test_deploy_uses_selected_environment_file_for_compose() -> None:
     assert compose["x-app"]["env_file"] == ["${VACATURERADAR_ENV_FILE:-.env}"]
     assert 'export VACATURERADAR_ENV_FILE="$env_file"' in deploy_script
     assert 'docker compose --env-file "$env_file" -f "$compose_file" up -d --build' in deploy_script
-    assert 'waarde uit ${env_file}' in deploy_script
+    assert "waarde uit ${env_file}" in deploy_script

tests/unit/test_runtime_observability.py

@@ -0,0 +1,27 @@
+from django.core.cache import cache
+from django.test import override_settings
+
+from apps.core.services.automation import _runtime_heartbeat_state
+from apps.core.tasks import RUNTIME_HEARTBEAT_KEY, record_runtime_heartbeat
+
+
+@override_settings(CELERY_TASK_ALWAYS_EAGER=False)
+def test_runtime_heartbeat_reports_real_worker_execution():
+    cache.delete(RUNTIME_HEARTBEAT_KEY)
+    assert _runtime_heartbeat_state()["healthy"] is False
+
+    timestamp = record_runtime_heartbeat()
+
+    state = _runtime_heartbeat_state()
+    assert cache.get(RUNTIME_HEARTBEAT_KEY) == timestamp
+    assert state["healthy"] is True
+    assert state["label"].startswith("Actief")
+
+
+@override_settings(CELERY_TASK_ALWAYS_EAGER=True)
+def test_runtime_heartbeat_is_honest_in_eager_mode():
+    assert _runtime_heartbeat_state() == {
+        "label": "Eager/lokaal",
+        "healthy": True,
+        "observed_at": None,
+    }