def test_get_close_db(app): with app.app_context(): db = get_db() assert db is get_db() with pytest.raises(sqlite3.ProgrammingError) as e: db.execute('SELECT 1') assert 'closed' in str(e)
def app(): db_fh, db_path = tempfile.mkstemp() app = create_app({'TESTING': True, 'DATABASE': db_path}) with app.app_context(): init_db() # initialize temp database with tables get_db().executescript( _data_sql) # populate temp database with some data yield app os.close(db_fh) os.unlink(db_path)
def index(): db = get_db() posts = db.execute( 'SELECT p.id, title, body, created, author_id, username FROM' ' post p JOIN user u ON p.author_id = u.id ORDER BY created DESC' ).fetchall() return render_template('blog/index.html', posts=posts)
def load_logged_in_user(): user_id = session.get('user_id') if user_id is None: g.user = None else: g.user = get_db().execute('SELECT * FROM user WHERE id = ?', (user_id, )).fetchone()
def test_delete(auth, app, client): auth.login() response = client.post('delete/1') assert response.headers['Location'] == 'http://localhost/' with app.app_context(): db = get_db() post = db.execute('SELECT * FROM post WHERE id = 1').fetchone() assert post is None
def test_create(client, auth, app): auth.login() assert client.get('/create').status_code == 200 client.post('/create', data={'title': "another one", 'body': ""}) with app.app_context(): db = get_db() count = db.execute("SELECT COUNT(id) FROM post").fetchone()[0] assert count == 2
def test_register(client, app): assert client.get('/auth/register').status_code == 200 response = client.post('/auth/register', data={ 'username': '******', 'password': '******' }) assert "http://localhost/auth/login" == response.headers['Location'] with app.app_context(): assert get_db().execute( "SELECT * FROM user WHERE username = '******'").fetchone() is not None
def test_author_required(app, client, auth): # change the post author to another user with app.app_context(): db = get_db() db.execute('UPDATE post SET author_id = 2 WHERE id = 1') db.commit() auth.login() #current user can't modify other users' posts assert client.post('/update/1').status_code == 403 assert client.post('/delete/1').status_code == 403 # current user doesn't see edit link assert b'href="/update/1"' not in client.get('/').data
def test_update(client, auth, app): auth.login() assert client.get('/update/1').status_code == 200 client.post('/update/1', data={ 'title': "Welcome, friend", "body": "we rock" }) with app.app_context(): db = get_db() post = db.execute('SELECT * FROM post WHERE id = 1').fetchone() assert post['title'] == "Welcome, friend" assert post['body'] == "we rock"
def get_post(id, check_author=True): """Helper function that retrieves a post associated with a given id and verifies that the it's author is the currently logged in user""" post = get_db().execute( "SELECT p.id, title, body, created, author_id, username" ' FROM post p JOIN user u ON p.author_id = u.id' ' WHERE p.id = ?', (id, )).fetchone() if post is None: abort(404, "Post id {} doesn't exist".format(id)) # Not found if check_author and g.user['id'] != post['author_id']: abort(403) # Forbidden return post
def create(): if request.method == 'POST': title = request.form['title'] body = request.form['body'] error = None if not title: error = 'Title is required' if error is not None: flash(error) else: db = get_db() db.execute( 'INSERT INTO post (title, body, author_id) VALUES(?,?,?)', (title, body, g.user['id'])) db.commit() return redirect(url_for('blog.index')) return render_template('blog/create.html')
def login(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] error = None user = get_db().execute('SELECT * FROM user WHERE username = ?', (username, )).fetchone() if user is None: error = 'Incorrect username' elif not check_password_hash(user['password'], password): error = "Incorrect password" if error is None: session.clear() session['user_id'] = user['id'] return redirect(url_for('index')) flash(error) return render_template('auth/login.html')
def update(id): post = get_post(id) if request.method == 'POST': title = request.form['title'] body = request.form['body'] error = None if not title: error = "Title is required." if error is not None: flash(error) else: db = get_db() db.execute('UPDATE post SET title = ?, body = ? WHERE id = ?', (title, body, id)) db.commit() return redirect(url_for('index')) return render_template('blog/update.html', post=post)
def register(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] db = get_db() error = None if not username: error = 'username is required.' elif not password: error = 'password is required.' elif db.execute('SELECT id FROM user WHERE username = ?', (username, )).fetchone() is not None: error = 'User {} is already registered.'.format(username) if error is None: db.execute('INSERT INTO user (username, password) VALUES (?,?)', (username, generate_password_hash(password))) db.commit() return redirect(url_for('auth.login')) flash(error) return render_template('auth/register.html')
def delete(id): get_post(id) db = get_db() db.execute('DELETE FROM post WHERE id = ?', (id, )) db.commit() return redirect(url_for('blog.index'))