Upgrade async GPU analysis and workbench UX

backend/tests/test_outbound_request_guard.py

@@ -18,8 +18,10 @@ import pytest
 
 from app.core.errors import AppError
 from app.services.outbound_request_guard import (
+    _ValidatedRedirects,
     assert_public_http_url,
     assert_same_origin_redirect,
+    validated_redirect_opener,
 )
 
 
@@ -89,6 +91,30 @@ class TestRedirects:
     def test_an_upgrade_to_https_stays_allowed(self) -> None:
         assert_same_origin_redirect("http://geo.example.be/wcs", "https://geo.example.be/wcs")
 
+    def test_a_redirect_to_another_port_is_refused(self) -> None:
+        with pytest.raises(AppError) as exc_info:
+            assert_same_origin_redirect(
+                "https://geo.api.vlaanderen.be/wcs",
+                "https://geo.api.vlaanderen.be:8443/wcs",
+            )
+
+        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"
+
+    def test_embedded_credentials_are_refused(self) -> None:
+        with pytest.raises(AppError) as exc_info:
+            assert_public_http_url("https://operator:secret@geo.example.be/wcs")
+
+        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"
+
+    def test_a_redirect_with_an_invalid_port_fails_closed(self) -> None:
+        with pytest.raises(AppError) as exc_info:
+            assert_same_origin_redirect(
+                "https://geo.api.vlaanderen.be/wcs",
+                "https://geo.api.vlaanderen.be:not-a-port/wcs",
+            )
+
+        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"
+
 
 def test_the_guard_opener_refuses_a_cross_host_redirect() -> None:
     """The opener is what the acquisition services actually call."""
@@ -249,6 +275,26 @@ def test_a_refused_redirect_is_never_requested() -> None:
     assert "_RejectRedirects" in handlers
 
 
+def test_the_default_guard_validates_before_following_a_redirect() -> None:
+    opener = validated_redirect_opener("https://geo.api.vlaanderen.be/wcs")
+    handlers = [type(handler).__name__ for handler in opener.handlers]
+
+    assert "_ValidatedRedirects" in handlers
+
+    handler = _ValidatedRedirects("https://geo.api.vlaanderen.be/wcs")
+    with pytest.raises(AppError) as exc_info:
+        handler.redirect_request(
+            None,
+            None,
+            302,
+            "Found",
+            {},
+            "http://169.254.169.254/latest/meta-data/",
+        )
+
+    assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"
+
+
 def test_the_rejecting_handler_returns_no_new_request() -> None:
     from app.services.outbound_request_guard import _RejectRedirects