test: cover middleware on composed app - #254
Conversation
|
|
Hi @l7wei — I opened #254 as a test-first reproduction for the public composed ASGI app’s middleware contract. It intentionally includes no composition patch. The tests reproduce:
The fork workflows currently show Could you advise whether the project would prefer a follow-up implementation PR after reviewing this regression contract, or an implementation added to #254? I will follow the preferred workflow. Drafted with AI assistance; reviewed and posted by SabrinaTso. |
There was a problem hiding this comment.
Pull request overview
Adds regression coverage to ensure the publicly exported, composed ASGI application preserves the REST API’s middleware behavior (notably CORS handling and the X-Process-Time header) when serving /openapi.json.
Changes:
- Introduces an in-process
httpx.AsyncClientfixture targeting the exporteddata_api.api.api.app. - Adds a CORS preflight regression test for
OPTIONS /openapi.json. - Adds an API response regression test for
GET /openapi.jsonasserting both CORS andX-Process-Timeare present.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| assert response.status_code == 200 | ||
| assert response.headers["access-control-allow-origin"] == "*" | ||
| assert "GET" in response.headers["access-control-allow-methods"] | ||
|
|
||
| async def test_public_app_keeps_cors_and_process_time_on_api_responses( | ||
| self, client: AsyncClient | ||
| ): | ||
| """The composed app keeps CORS and timing middleware on actual API responses.""" | ||
| response = await client.get("/openapi.json", headers={"Origin": "https://consumer.example"}) | ||
|
|
||
| assert response.status_code == 200 | ||
| assert response.headers["access-control-allow-origin"] == "*" | ||
| assert float(response.headers["x-process-time"]) >= 0 |
Internal
X-Process-Timemiddleware.Notes
main,pytest tests/test_app_middleware.py -qfails with:OPTIONS /openapi.jsonreturning405instead of a CORS preflight response.GET /openapi.jsonmissingAccess-Control-Allow-Origin.data_api.api.api.appand/openapi.json, so they do not depend on crawled campus data or external network access.