first commit

backend/tests/test_security_hardening.py

@@ -0,0 +1,50 @@
+from unittest.mock import patch
+
+import pytest
+from pydantic import ValidationError
+
+from app.core.config import Settings
+from tests.helpers import client
+
+
+def _base_settings_kwargs(**overrides):
+    return {
+        "environment": "development",
+        "database_url": "postgresql://localhost/test",
+        "secret_key": "unit-test-secret-key-at-least-32-chars",
+        **overrides,
+    }
+
+
+def test_production_requires_gate_key_and_razorpay() -> None:
+    with pytest.raises(ValidationError):
+        Settings(
+            **_base_settings_kwargs(
+                environment="production",
+                payment_provider="mock",
+                ticket_verify_api_key="short",
+            )
+        )
+
+    settings = Settings(
+        **_base_settings_kwargs(
+            environment="production",
+            payment_provider="razorpay",
+            ticket_verify_api_key="gate-key-min-16-chars",
+            razorpay_key_id="rzp_test",
+            razorpay_key_secret="secret",
+            razorpay_webhook_secret="whsec",
+            admin_password="not-the-default",
+            cors_origins="https://desiclans.in",
+        )
+    )
+    assert settings.environment == "production"
+
+
+@patch("app.api.routes.webhooks.get_settings")
+def test_mock_webhook_disabled_outside_development(mock_get_settings) -> None:
+    mock_get_settings.return_value = Settings(
+        **_base_settings_kwargs(environment="staging"),
+    )
+    response = client.post("/api/webhooks/mock", content=b"{}", headers={"X-Mock-Signature": "x"})
+    assert response.status_code == 404