Graham McIntire
8338d0af1e
- Extract Repo calls from LiveViews into Agents.get_agent_token_for_org/2 and Accounts.verify_new_totp_device/2 context functions - Remove Process dictionary usage for cookie consent; use explicit assigns - Reject url() references in status page custom CSS changeset - Add per-organization rate limit check alongside per-IP - Document Oban flush as emergency-only with audit logging - Gate /admin/headers behind dev_routes (debug endpoint)
24 lines
616 B
Elixir
24 lines
616 B
Elixir
defmodule ToweropsWeb.DebugControllerTest do
|
|
use ToweropsWeb.ConnCase, async: true
|
|
|
|
import Towerops.AccountsFixtures
|
|
import Towerops.OrganizationsFixtures
|
|
|
|
describe "GET /admin/headers" do
|
|
test "returns 404 in non-dev environments (gated behind dev_routes)", %{conn: conn} do
|
|
superuser =
|
|
user_fixture()
|
|
|> Ecto.Changeset.change(%{is_superuser: true})
|
|
|> Towerops.Repo.update!()
|
|
|
|
_org = organization_fixture(superuser.id)
|
|
|
|
conn =
|
|
conn
|
|
|> log_in_user(superuser)
|
|
|> get(~p"/admin/headers")
|
|
|
|
assert conn.status == 404
|
|
end
|
|
end
|
|
end
|