demo mode

tests/integration/test_auth_login.py

@@ -11,7 +11,6 @@ from django.urls import reverse
 
 pytestmark = [pytest.mark.integration, pytest.mark.django_db]
 
-
 def test_login_page_renders_stitch_design(client):
     response = client.get(reverse("login"))
     assert response.status_code == 200
@@ -42,7 +41,6 @@ def test_login_page_keeps_official_brand_separate_from_owner_setting(client):
     assert "Eigen merk" not in body
     assert 'content="VacatureRadar"' in body
 
-
 def test_login_with_email(client, user):
     response = client.post(
         reverse("login"),
@@ -52,7 +50,6 @@ def test_login_with_email(client, user):
     assert response.url == reverse("dashboard:today")
     assert client.session.get("_auth_user_id") == str(user.pk)
 
-
 def test_login_with_username_still_works(client, user):
     response = client.post(
         reverse("login"),
@@ -61,7 +58,6 @@ def test_login_with_username_still_works(client, user):
     assert response.status_code == 302
     assert client.session.get("_auth_user_id") == str(user.pk)
 
-
 def test_login_email_case_insensitive(client, user):
     response = client.post(
         reverse("login"),
@@ -70,7 +66,6 @@ def test_login_email_case_insensitive(client, user):
     assert response.status_code == 302
     assert client.session.get("_auth_user_id") == str(user.pk)
 
-
 def test_login_wrong_password_shows_error(client, user):
     response = client.post(
         reverse("login"),
@@ -79,7 +74,6 @@ def test_login_wrong_password_shows_error(client, user):
     assert response.status_code == 200
     assert "klopt niet" in response.content.decode("utf-8")
 
-
 def test_password_reset_sends_email(client, user):
     response = client.post(reverse("password_reset"), {"email": user.email})
     assert response.status_code == 302
@@ -90,13 +84,11 @@ def test_password_reset_sends_email(client, user):
     assert "wachtwoord" in message.subject.lower()
     assert "/wachtwoord/herstellen/" in message.body
 
-
 def test_password_reset_unknown_email_is_silent(client):
     response = client.post(reverse("password_reset"), {"email": "onbekend@example.invalid"})
     assert response.status_code == 302
     assert len(mail.outbox) == 0
 
-
 def test_demo_button_visible_by_default(client):
     assert reverse("demo-login") in client.get(reverse("login")).content.decode("utf-8")
 
@@ -113,7 +105,6 @@ def test_demo_login_disabled_redirects(client):
 def test_demo_button_hidden_when_disabled(client):
     assert "demo-login" not in client.get(reverse("login")).content.decode("utf-8")
 
-
 def test_demo_login_logs_in_and_seeds_environment(client):
     from apps.jobs.models import Application, JobPosting, ScoreRun
     from apps.profiles.models import SearchProfile
@@ -136,7 +127,6 @@ def test_demo_login_logs_in_and_seeds_environment(client):
     dashboard = client.get(reverse("dashboard:today"))
     assert dashboard.status_code == 200
 
-
 def test_demo_login_is_idempotent(client):
     from apps.jobs.models import JobPosting
 
@@ -145,6 +135,39 @@ def test_demo_login_is_idempotent(client):
     client.post(reverse("demo-login"))
     assert JobPosting.objects.count() == first
 
+def test_demo_account_is_read_only_and_session_is_bounded(client):
+    from apps.profiles.models import SearchProfile
+
+    client.post(reverse("demo-login"))
+    demo_user = get_user_model().objects.get(username=settings.DEMO_USERNAME)
+    active = SearchProfile.objects.get(user=demo_user, is_active=True)
+    alternative = SearchProfile.objects.create(user=demo_user, name="Alternatief", is_active=False)
+
+    response = client.post(
+        reverse("profiles:activate", args=[alternative.pk]),
+        HTTP_REFERER=reverse("profiles:list"),
+    )
+
+    assert response.status_code == 302
+    assert response.url == reverse("profiles:list")
+    active.refresh_from_db()
+    alternative.refresh_from_db()
+    assert active.is_active is True
+    assert alternative.is_active is False
+    assert client.session.get_expiry_age() <= settings.DEMO_SESSION_SECONDS
+
+def test_demo_account_can_still_log_out(client):
+    client.post(reverse("demo-login"))
+    response = client.post(reverse("logout"))
+    assert response.status_code == 302
+    assert client.session.get("_auth_user_id") is None
+
+def test_authenticated_demo_page_disables_mutating_forms(client):
+    client.post(reverse("demo-login"))
+    body = client.get(reverse("dashboard:today")).content.decode("utf-8")
+    assert 'data-demo-read-only="true"' in body
+    assert "Publieke demo · alleen-lezen" in body
+    assert "data-demo-allow" in body
 
 def test_entra_login_disabled_redirects(client):
     response = client.post(reverse("entra-login"))