Initial deploy setup

tests/security/test_policy.py

@@ -0,0 +1,94 @@
+from datetime import timedelta
+
+import pytest
+from django.utils import timezone
+
+from apps.sources.models import Source, SourcePolicyReview
+from apps.sources.services.policy import assess_url, create_policy_review, is_denied_domain
+
+
+def test_platform_domains_are_denied_including_subdomains():
+    assert is_denied_domain("www.linkedin.com")
+    assert is_denied_domain("be.indeed.com")
+    assert not is_denied_domain("jobs.example.org")
+    assert not assess_url("https://www.linkedin.com/jobs/view/123").allowed
+
+
+@pytest.mark.security
+def test_source_policy_without_review_is_blocked(db):
+    source = Source.objects.create(
+        name="Example jobs",
+        source_type=Source.Type.EMPLOYER,
+        base_url="https://jobs.example.org/vacatures/",
+        domain="jobs.example.org",
+        status=Source.Status.ACTIVE,
+        policy=Source.Policy.ALLOW,
+    )
+    decision = assess_url(source.base_url, source=source)
+    assert not decision.allowed
+    assert decision.status == Source.Policy.REVIEW
+
+
+@pytest.mark.security
+def test_source_review_expiry_blocks_fetch_decision(db):
+    source = Source.objects.create(
+        name="Example jobs",
+        source_type=Source.Type.EMPLOYER,
+        base_url="https://jobs.example.org/vacatures/",
+        domain="jobs.example.org",
+        status=Source.Status.ACTIVE,
+        policy=Source.Policy.ALLOW,
+    )
+    create_policy_review(
+        source,
+        actor=None,
+        decision=SourcePolicyReview.Decision.ALLOW,
+        reason="Aanvankelijk goedgekeurd",
+        scope=SourcePolicyReview.Scope.SOURCE,
+        expires_at=timezone.now() - timedelta(days=1),
+    )
+    decision = assess_url(source.base_url, source=source)
+    assert not decision.allowed
+
+
+@pytest.mark.security
+def test_policy_conflict_denies_even_when_allow_policy_set(db):
+    source = Source.objects.create(
+        name="Example jobs",
+        source_type=Source.Type.EMPLOYER,
+        base_url="https://jobs.example.org/vacatures/",
+        domain="jobs.example.org",
+        status=Source.Status.ACTIVE,
+        policy=Source.Policy.ALLOW,
+    )
+    create_policy_review(
+        source,
+        actor=None,
+        decision=SourcePolicyReview.Decision.DENY,
+        reason="Juridische review: geblokkeerd",
+        scope=SourcePolicyReview.Scope.SOURCE,
+    )
+    decision = assess_url(source.base_url, source=source)
+    assert not decision.allowed
+    assert decision.status == Source.Policy.DENY
+
+
+@pytest.mark.security
+def test_trial_review_can_allow_fetch(db):
+    source = Source.objects.create(
+        name="Example jobs",
+        source_type=Source.Type.EMPLOYER,
+        base_url="https://jobs.example.org/vacatures/",
+        domain="jobs.example.org",
+        status=Source.Status.TRIAL,
+        policy=Source.Policy.REVIEW,
+    )
+    create_policy_review(
+        source,
+        actor=None,
+        decision=SourcePolicyReview.Decision.TRIAL,
+        reason="Technische proefrun gestart",
+        scope=SourcePolicyReview.Scope.SOURCE,
+    )
+    decision = assess_url(source.base_url, source=source)
+    assert decision.allowed