learningcircuit--local-deep-research/tests/security/test_csrf_hardening.py

# allow: no-sut-import — exercises the real app fixture; asserts CSRF exemptions on the live blueprint config
"""Test CSRF hardening configuration against the real app."""


class TestCsrfHardening:
    """Verify CSRF exemptions are narrowly scoped."""

    def test_api_v1_is_csrf_exempt(self, app):
        """api_v1 blueprint should be CSRF-exempt (programmatic REST API)."""
        csrf = app.extensions.get("csrf")
        assert csrf is not None, "CSRFProtect extension not initialized"
        exempt_names = {bp.name for bp in csrf._exempt_blueprints}
        assert "api_v1" in exempt_names

    def test_api_blueprint_not_exempt(self, app):
        """api blueprint (browser-facing) should require CSRF tokens."""
        csrf = app.extensions["csrf"]
        exempt_names = {bp.name for bp in csrf._exempt_blueprints}
        assert "api" not in exempt_names

    def test_benchmark_blueprint_not_exempt(self, app):
        """benchmark blueprint (browser-facing) should require CSRF tokens."""
        csrf = app.extensions["csrf"]
        exempt_names = {bp.name for bp in csrf._exempt_blueprints}
        assert "benchmark" not in exempt_names

    def test_research_blueprint_not_exempt(self, app):
        """research blueprint (browser-facing) should require CSRF tokens."""
        csrf = app.extensions["csrf"]
        exempt_names = {bp.name for bp in csrf._exempt_blueprints}
        assert "research" not in exempt_names