chore: prepare repository for public release

backend/tests/test_auth.py

@@ -20,23 +20,30 @@ from app.services.segmentation_service import SegmentationService
 from app.services.job_service import JobService
 
 
-def auth_client(monkeypatch, *, guest_access: bool = False) -> TestClient:
+def auth_client(
+    monkeypatch,
+    *,
+    guest_access: bool = False,
+    require_https: bool = False,
+    base_url: str = "http://testserver",
+) -> TestClient:
     password_hash = AuthService.hash_password(
         "correct horse battery staple",
         salt=b"geointel-test-salt",
         iterations=100_000,
     )
     monkeypatch.setenv("GEOINTEL_AUTH_ENABLED", "true")
+    monkeypatch.setenv("GEOINTEL_AUTH_REQUIRE_HTTPS", "true" if require_https else "false")
     monkeypatch.setenv("GEOINTEL_AUTH_USERNAME", "operator")
     monkeypatch.setenv("GEOINTEL_AUTH_PASSWORD_HASH", password_hash)
     monkeypatch.setenv("GEOINTEL_AUTH_SESSION_SECRET", "test-session-secret-that-is-long-enough")
     monkeypatch.setenv("GEOINTEL_GUEST_ACCESS_ENABLED", "true" if guest_access else "false")
     monkeypatch.setenv("GEOINTEL_GUEST_DISPLAY_NAME", "Gast")
     monkeypatch.setenv("GEOINTEL_GUEST_SESSION_TTL_SECONDS", "7200")
-    return TestClient(create_app())
+    return TestClient(create_app(), base_url=base_url)
 
 
-def test_guest_access_defaults_on_when_operator_authentication_is_enabled(monkeypatch) -> None:
+def test_guest_access_defaults_off_when_operator_authentication_is_enabled(monkeypatch) -> None:
     password_hash = AuthService.hash_password(
         "correct horse battery staple",
         salt=b"geointel-test-salt",
@@ -53,7 +60,7 @@ def test_guest_access_defaults_on_when_operator_authentication_is_enabled(monkey
 
     assert session.status_code == 200
     assert session.json()["data"]["authentication_required"] is True
-    assert session.json()["data"]["guest_access_enabled"] is True
+    assert session.json()["data"]["guest_access_enabled"] is False
 
 
 def test_guest_default_is_inactive_but_valid_when_operator_authentication_is_disabled(monkeypatch) -> None:
@@ -135,6 +142,35 @@ def test_login_uses_http_only_session_cookie_and_logout_revokes_browser_access(m
     assert protected_after_logout.status_code == 401
 
 
+def test_operator_login_can_require_https(monkeypatch) -> None:
+    insecure_client = auth_client(monkeypatch, require_https=True)
+    rejected = insecure_client.post(
+        "/api/v1/auth/login",
+        json={"username": "operator", "password": "correct horse battery staple"},
+    )
+    spoofed = insecure_client.post(
+        "/api/v1/auth/login",
+        headers={"x-forwarded-proto": "https", "x-real-ip": "203.0.113.9"},
+        json={"username": "operator", "password": "correct horse battery staple"},
+    )
+
+    secure_client = auth_client(
+        monkeypatch,
+        require_https=True,
+        base_url="https://testserver",
+    )
+    accepted = secure_client.post(
+        "/api/v1/auth/login",
+        json={"username": "operator", "password": "correct horse battery staple"},
+    )
+
+    assert rejected.status_code == 426
+    assert rejected.json()["error"] == "AUTH_HTTPS_REQUIRED"
+    assert spoofed.status_code == 426
+    assert accepted.status_code == 200
+    assert "secure" in accepted.headers["set-cookie"].lower()
+
+
 def test_guest_login_exposes_models_but_rejects_management_and_cross_project_requests(monkeypatch) -> None:
     project_id = UUID("00000000-0000-0000-0000-000000000123")
     demo = DemoWorkflowResponse(
@@ -460,6 +496,10 @@ def test_unraid_runtime_carries_only_hashed_operator_credentials() -> None:
     assert "GEOINTEL_AUTH_PASSWORD_HASH=" in example
     assert "GEOINTEL_AUTHENTIK_CLIENT_SECRET=" in example
     assert "GEOINTEL_AUTH_PASSWORD=" not in runner
-    assert "GEOINTEL_GUEST_ACCESS_ENABLED=true" in example
-    assert 'GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-true}"' in runner
+    assert "GEOINTEL_AUTH_ENABLED=true" in example
+    assert "GEOINTEL_AUTH_REQUIRE_HTTPS=true" in example
+    assert "GEOINTEL_GUEST_ACCESS_ENABLED=false" in example
+    assert 'GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-true}"' in runner
+    assert 'GEOINTEL_AUTH_REQUIRE_HTTPS="${GEOINTEL_AUTH_REQUIRE_HTTPS:-true}"' in runner
+    assert 'GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-false}"' in runner
     assert "/api/v1/auth/session" in browser_smoke