bas-http 1.0.0__py3-none-any.whl

bas/tests/test_cookies.py

@@ -0,0 +1,778 @@
+"""
+Comprehensive tests for bas's cookie handling.
+
+These tests verify that bas fixes all the cookie bugs in curlcffi:
+  1. Cookies accumulate across session requests
+  2. Cookies survive redirects
+  3. Proper domain matching (RFC 6265)
+  4. Proper path matching (RFC 6265)
+  5. Cookie expiration
+  6. Secure flag enforcement
+  7. Set-Cookie header parsing
+  8. Thread safety
+  9. JSON/Netscape persistence
+"""
+
+import json
+import os
+import tempfile
+import threading
+import time
+
+from bas.cookies import Cookie, CookieJar, _parse_cookie_time, _guess_cookie_path
+
+
+# ── Cookie Creation Tests ───────────────────────────────────────────────────
+
+class TestCookieCreation:
+    def test_basic_cookie(self):
+        c = Cookie(name="session", value="abc123")
+        assert c.name == "session"
+        assert c.value == "abc123"
+        assert c.path == "/"
+        assert c.secure is False
+        assert c.http_only is False
+
+    def test_cookie_with_all_attributes(self):
+        c = Cookie(
+            name="token",
+            value="xyz",
+            domain="example.com",
+            path="/app",
+            expires=9999999999.0,
+            max_age=3600,
+            secure=True,
+            http_only=True,
+            same_site="Strict",
+        )
+        assert c.secure is True
+        assert c.http_only is True
+        assert c.same_site == "Strict"
+        assert c.effective_expires is not None
+
+    def test_cookie_to_dict_roundtrip(self):
+        c = Cookie(
+            name="test", value="val",
+            domain="example.com", path="/",
+            secure=True, http_only=True,
+        )
+        d = c.to_dict()
+        c2 = Cookie.from_dict(d)
+        assert c2.name == c.name
+        assert c2.value == c.value
+        assert c2.secure == c.secure
+        assert c2.http_only == c.http_only
+
+    def test_cookie_to_header(self):
+        c = Cookie(name="sid", value="12345")
+        assert c.to_header() == "sid=12345"
+
+    def test_cookie_equality(self):
+        c1 = Cookie(name="a", value="1", domain="example.com", path="/")
+        c2 = Cookie(name="a", value="2", domain="example.com", path="/")
+        c3 = Cookie(name="a", value="1", domain="other.com", path="/")
+        assert c1 == c2  # same name, domain, path
+        assert c1 != c3  # different domain
+
+    def test_cookie_repr(self):
+        c = Cookie(name="x", value="y")
+        r = repr(c)
+        assert "x" in r
+        assert "y" in r
+
+
+# ── Cookie Expiration Tests ─────────────────────────────────────────────────
+
+class TestCookieExpiration:
+    def test_no_expiry(self):
+        c = Cookie(name="a", value="b")
+        assert c.is_expired is False
+
+    def test_expired_max_age(self):
+        c = Cookie(name="a", value="b", max_age=0)
+        time.sleep(0.01)
+        assert c.is_expired is True
+
+    def test_not_expired_max_age(self):
+        c = Cookie(name="a", value="b", max_age=3600)
+        assert c.is_expired is False
+
+    def test_expired_expires(self):
+        c = Cookie(name="a", value="b", expires=time.time() - 1)
+        assert c.is_expired is True
+
+    def test_not_expired_expires(self):
+        c = Cookie(name="a", value="b", expires=time.time() + 3600)
+        assert c.is_expired is False
+
+    def test_max_age_overrides_expires(self):
+        c = Cookie(
+            name="a", value="b",
+            expires=time.time() + 3600,
+            max_age=0,
+        )
+        time.sleep(0.01)
+        assert c.effective_expires is not None
+        assert c.is_expired is True
+
+
+# ── Domain Matching Tests (RFC 6265 §5.1.3) ─────────────────────────────────
+
+class TestDomainMatching:
+    def test_exact_match(self):
+        c = Cookie(name="a", value="b", domain="example.com")
+        assert c.matches_domain("example.com") is True
+
+    def test_suffix_match_with_dot(self):
+        c = Cookie(name="a", value="b", domain=".example.com")
+        assert c.matches_domain("www.example.com") is True
+
+    def test_suffix_match_subdomain(self):
+        c = Cookie(name="a", value="b", domain=".example.com")
+        assert c.matches_domain("sub.example.com") is True
+
+    def test_suffix_no_leading_dot(self):
+        """Without leading dot, must still match as suffix."""
+        c = Cookie(name="a", value="b", domain="example.com")
+        assert c.matches_domain("www.example.com") is True
+
+    def test_no_suffix_match_evil(self):
+        """evil.example.com should NOT match example.com."""
+        c = Cookie(name="a", value="b", domain="example.com")
+        # Without initial dot, only exact match or dot-separated suffix
+        assert c.matches_domain("evil.example.com") is True  # RFC says this matches
+
+    def test_no_match(self):
+        c = Cookie(name="a", value="b", domain="example.com")
+        assert c.matches_domain("other.com") is False
+
+    def test_empty_domain(self):
+        c = Cookie(name="a", value="b", domain="")
+        assert c.matches_domain("example.com") is False
+
+    def test_case_insensitive(self):
+        c = Cookie(name="a", value="b", domain="Example.COM")
+        assert c.matches_domain("example.com") is True
+
+    def test_trailing_dot(self):
+        c = Cookie(name="a", value="b", domain="example.com.")
+        assert c.matches_domain("example.com") is True
+
+    def test_ip_address_match(self):
+        c = Cookie(name="a", value="b", domain="127.0.0.1")
+        assert c.matches_domain("127.0.0.1") is True
+
+
+# ── Path Matching Tests (RFC 6265 §5.1.4) ───────────────────────────────────
+
+class TestPathMatching:
+    def test_exact_match(self):
+        c = Cookie(name="a", value="b", path="/app")
+        assert c.matches_path("/app") is True
+
+    def test_root_matches_all(self):
+        c = Cookie(name="a", value="b", path="/")
+        assert c.matches_path("/anything") is True
+
+    def test_prefix_with_slash(self):
+        c = Cookie(name="a", value="b", path="/app/")
+        assert c.matches_path("/app/page") is True
+
+    def test_prefix_without_slash(self):
+        """Without trailing slash, must match / or end of string."""
+        c = Cookie(name="a", value="b", path="/app")
+        assert c.matches_path("/app/page") is True
+        assert c.matches_path("/app") is True
+
+    def test_no_match(self):
+        c = Cookie(name="a", value="b", path="/other")
+        assert c.matches_path("/app") is False
+
+    def test_no_match_partial(self):
+        """'/appx' should NOT match '/app'."""
+        c = Cookie(name="a", value="b", path="/app")
+        assert c.matches_path("/appx") is False
+
+
+# ── CookieJar Tests ──────────────────────────────────────────────────────────
+
+class TestCookieJar:
+    def test_add_and_get(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com"))
+        c = jar.get("a", domain="example.com")
+        assert c is not None
+        assert c.value == "1"
+
+    def test_add_replaces_existing(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com"))
+        jar.add(Cookie(name="a", value="2", domain="example.com"))
+        c = jar.get("a", domain="example.com")
+        assert c.value == "2"
+        assert len(jar) == 1
+
+    def test_remove(self):
+        jar = CookieJar()
+        c = Cookie(name="a", value="1", domain="example.com")
+        jar.add(c)
+        jar.remove(c)
+        assert len(jar) == 0
+
+    def test_clear(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com"))
+        jar.add(Cookie(name="b", value="2", domain="example.com"))
+        jar.clear()
+        assert len(jar) == 0
+
+    def test_match_filters_by_domain(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com"))
+        jar.add(Cookie(name="b", value="2", domain="other.com"))
+        matched = jar.match("https://example.com/page")
+        assert len(matched) == 1
+        assert matched[0].name == "a"
+
+    def test_match_filters_by_path(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com", path="/app"))
+        jar.add(Cookie(name="b", value="2", domain="example.com", path="/other"))
+        matched = jar.match("https://example.com/app/page")
+        assert len(matched) == 1
+        assert matched[0].name == "a"
+
+    def test_match_excludes_secure_on_http(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com", secure=True))
+        matched = jar.match("http://example.com/")
+        assert len(matched) == 0
+
+    def test_match_includes_secure_on_https(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com", secure=True))
+        matched = jar.match("https://example.com/")
+        assert len(matched) == 1
+
+    def test_match_excludes_expired(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com", max_age=0))
+        time.sleep(0.01)
+        matched = jar.match("https://example.com/")
+        assert len(matched) == 0
+
+    def test_to_header(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com"))
+        jar.add(Cookie(name="b", value="2", domain="example.com"))
+        header = jar.to_header("https://example.com/")
+        assert "a=1" in header
+        assert "b=2" in header
+        assert "; " in header
+
+    def test_to_header_empty(self):
+        jar = CookieJar()
+        assert jar.to_header("https://example.com/") == ""
+
+    def test_to_header_dict(self):
+        jar = CookieJar()
+        jar.add(Cookie(name="a", value="1", domain="example.com"))
+        d = jar.to_header_dict("https://example.com/")
+        assert "Cookie" in d
+        assert "a=1" in d["Cookie"]
+
+    def test_update(self):
+        jar1 = CookieJar()
+        jar1.add(Cookie(name="a", value="1", domain="example.com"))
+        jar2 = CookieJar()
+        jar2.add(Cookie(name="b", value="2", domain="example.com"))
+        jar1.update(jar2)
+        assert len(jar1) == 2
+
+
+# ── Set-Cookie Parsing Tests ────────────────────────────────────────────────
+
+class TestSetCookieParsing:
+    def test_basic_set_cookie(self):
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "session=abc123; Path=/; HttpOnly",
+            "https://example.com/login",
+        )
+        assert cookie is not None
+        assert cookie.name == "session"
+        assert cookie.value == "abc123"
+        assert cookie.http_only is True
+        assert cookie.path == "/"
+
+    def test_set_cookie_with_domain(self):
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "token=xyz; Domain=.example.com; Path=/app; Secure",
+            "https://www.example.com/page",
+        )
+        assert cookie is not None
+        assert cookie.domain == "example.com"
+        assert cookie.secure is True
+        assert cookie.path == "/app"
+
+    def test_set_cookie_with_max_age(self):
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "sid=123; Max-Age=3600; Path=/",
+            "https://example.com/",
+        )
+        assert cookie is not None
+        assert cookie.max_age == 3600
+        assert cookie.is_expired is False
+
+    def test_set_cookie_with_expires(self):
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "sid=123; Expires=Thu, 01 Jan 2030 00:00:00 GMT; Path=/",
+            "https://example.com/",
+        )
+        assert cookie is not None
+        assert cookie.expires is not None
+        assert cookie.expires > time.time()
+
+    def test_set_cookie_with_samesite(self):
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "csrf=abc; SameSite=Strict; Path=/",
+            "https://example.com/",
+        )
+        assert cookie is not None
+        assert cookie.same_site == "Strict"
+
+    def test_delete_cookie(self):
+        """When expires is in the past, cookie should be expired."""
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "sid=123; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/",
+            "https://example.com/",
+        )
+        assert cookie is not None
+        assert cookie.is_expired is True
+
+    def test_parse_multiple_set_cookie(self):
+        jar = CookieJar()
+        headers = {
+            "Set-Cookie": [
+                "a=1; Path=/",
+                "b=2; Path=/app",
+                "c=3; Path=/other",
+            ]
+        }
+        cookies = jar.parse_set_cookie_headers(headers, "https://example.com/page")
+        assert len(cookies) == 3
+        assert len(jar) == 3
+
+    def test_set_cookie_default_path(self):
+        """Default path should be guessed from request path."""
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "a=1",
+            "https://example.com/app/page",
+        )
+        assert cookie is not None
+        # Should guess /app as the default path
+        assert cookie.path == "/app"
+
+    def test_set_cookie_root_default_path(self):
+        jar = CookieJar()
+        cookie = jar.parse_set_cookie(
+            "a=1",
+            "https://example.com/",
+        )
+        assert cookie is not None
+        assert cookie.path == "/"
+
+
+# ── Cookie Persistence Tests ────────────────────────────────────────────────
+
+class TestCookiePersistence:
+    def test_json_save_load(self):
+        jar = CookieJar()
+        jar.add(Cookie(
+            name="session", value="abc123",
+            domain="example.com", path="/app",
+            secure=True, http_only=True,
+        ))
+        jar.add(Cookie(
+            name="csrf", value="xyz",
+            domain="example.com", path="/",
+        ))
+
+        with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
+            filepath = f.name
+
+        try:
+            jar.save_json(filepath)
+
+            jar2 = CookieJar()
+            jar2.load_json(filepath)
+
+            assert len(jar2) == 2
+            c = jar2.get("session", domain="example.com", path="/app")
+            assert c is not None
+            assert c.value == "abc123"
+            assert c.secure is True
+            assert c.http_only is True
+        finally:
+            os.unlink(filepath)
+
+    def test_netscape_save_load(self):
+        jar = CookieJar()
+        jar.add(Cookie(
+            name="sid", value="xyz",
+            domain="example.com", path="/",
+            secure=True,
+            domain_initial_dot=True,
+        ))
+
+        with tempfile.NamedTemporaryFile(mode="w", suffix=".txt", delete=False) as f:
+            filepath = f.name
+
+        try:
+            jar.save_netscape(filepath)
+
+            jar2 = CookieJar()
+            jar2.load_netscape(filepath)
+
+            assert len(jar2) == 1
+            c = jar2.get("sid", domain="example.com")
+            assert c is not None
+            assert c.value == "xyz"
+        finally:
+            os.unlink(filepath)
+
+    def test_load_nonexistent_file(self):
+        jar = CookieJar()
+        jar.load_json("/nonexistent/path.json")
+        assert len(jar) == 0
+
+    def test_json_preserves_attributes(self):
+        jar = CookieJar()
+        jar.add(Cookie(
+            name="a", value="b",
+            domain="example.com", path="/app",
+            secure=True, http_only=True,
+            same_site="Lax",
+            max_age=3600,
+        ))
+
+        with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
+            filepath = f.name
+
+        try:
+            jar.save_json(filepath)
+            jar2 = CookieJar()
+            jar2.load_json(filepath)
+            c = jar2.get("a")
+            assert c.secure is True
+            assert c.http_only is True
+            assert c.same_site == "Lax"
+            assert c.max_age == 3600
+        finally:
+            os.unlink(filepath)
+
+
+# ── Thread Safety Tests ─────────────────────────────────────────────────────
+
+class TestThreadSafety:
+    def test_concurrent_add(self):
+        jar = CookieJar()
+        errors = []
+
+        def add_cookies(prefix, count):
+            try:
+                for i in range(count):
+                    jar.add(Cookie(
+                        name=f"{prefix}_{i}",
+                        value=str(i),
+                        domain="example.com",
+                    ))
+            except Exception as e:
+                errors.append(e)
+
+        threads = [
+            threading.Thread(target=add_cookies, args=(f"t{t}", 100))
+            for t in range(10)
+        ]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join()
+
+        assert len(errors) == 0
+        assert len(jar) == 1000  # 10 threads * 100 cookies
+
+    def test_concurrent_match(self):
+        jar = CookieJar()
+        for i in range(100):
+            jar.add(Cookie(
+                name=f"c{i}", value=str(i),
+                domain="example.com", path="/",
+            ))
+
+        errors = []
+
+        def match_cookies():
+            try:
+                for _ in range(100):
+                    jar.match("https://example.com/page")
+            except Exception as e:
+                errors.append(e)
+
+        threads = [threading.Thread(target=match_cookies) for _ in range(10)]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join()
+
+        assert len(errors) == 0
+
+    def test_concurrent_mixed(self):
+        jar = CookieJar()
+        errors = []
+
+        def writer():
+            try:
+                for i in range(50):
+                    jar.add(Cookie(name=f"w{i}", value=str(i), domain="example.com"))
+            except Exception as e:
+                errors.append(e)
+
+        def reader():
+            try:
+                for _ in range(50):
+                    jar.match("https://example.com/")
+            except Exception as e:
+                errors.append(e)
+
+        def clearer():
+            try:
+                for _ in range(5):
+                    jar.clear()
+            except Exception as e:
+                errors.append(e)
+
+        threads = [
+            threading.Thread(target=writer),
+            threading.Thread(target=reader),
+            threading.Thread(target=clearer),
+        ]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join()
+
+        assert len(errors) == 0
+
+
+# ── URL Resolution Tests ────────────────────────────────────────────────────
+
+class TestUrlResolution:
+    def test_default_path_guessing(self):
+        assert _guess_cookie_path("/app/page") == "/app"
+        assert _guess_cookie_path("/") == "/"
+        assert _guess_cookie_path("/a/b/c") == "/a/b"
+        assert _guess_cookie_path("") == "/"
+        assert _guess_cookie_path("relative") == "/"
+
+
+# ── Cookie Time Parsing Tests ──────────────────────────────────────────────
+
+class TestCookieTimeParsing:
+    def test_rfc1123(self):
+        t = _parse_cookie_time("Thu, 01 Dec 2030 16:00:00 GMT")
+        assert t is not None
+        assert t > time.time()
+
+    def test_rfc1036(self):
+        t = _parse_cookie_time("Thursday, 01-Dec-30 16:00:00 GMT")
+        assert t is not None
+
+    def test_invalid_format(self):
+        t = _parse_cookie_time("not-a-date")
+        assert t is None
+
+
+# ── curlcffi Bug Regression Tests ───────────────────────────────────────────
+
+class TestCurlCffiRegressions:
+    """
+    Tests specifically targeting the bugs reported in curlcffi.
+    """
+
+    def test_cookie_accumulation_across_requests(self):
+        """
+        Regression: curlcffi issue #582
+        Cookies from previous requests were not available in the session.
+
+        In bas, cookies accumulate in our Python CookieJar,
+        independent of curl's internal state.
+        """
+        jar = CookieJar()
+
+        # Simulate response 1: server sets session cookie
+        jar.parse_set_cookie(
+            "session-id=141-7615304-0276820; Path=/",
+            "https://www.amazon.com/",
+        )
+        jar.parse_set_cookie(
+            "session-id-time=2082787201l; Path=/",
+            "https://www.amazon.com/",
+        )
+
+        # Verify cookies are in the jar
+        header1 = jar.to_header("https://www.amazon.com/")
+        assert "session-id=141-7615304-0276820" in header1
+        assert "session-id-time=2082787201l" in header1
+
+        # Simulate response 2: server sets more cookies
+        jar.parse_set_cookie(
+            "ubid-main=131-0018707-6925852; Path=/",
+            "https://www.amazon.com/",
+        )
+
+        # ALL cookies should be present now
+        header2 = jar.to_header("https://www.amazon.com/")
+        assert "session-id=141-7615304-0276820" in header2
+        assert "session-id-time=2082787201l" in header2
+        assert "ubid-main=131-0018707-6925852" in header2
+
+        # Simulate response 3: even more cookies
+        jar.parse_set_cookie(
+            "session-token=+6MN/6QJEjQ3Q; Path=/",
+            "https://www.amazon.com/",
+        )
+
+        header3 = jar.to_header("https://www.amazon.com/")
+        assert "session-id=141-7615304-0276820" in header3
+        assert "ubid-main=131-0018707-6925852" in header3
+        assert "session-token=+6MN/6QJEjQ3Q" in header3
+
+    def test_redirect_cookie_inheritance(self):
+        """
+        Regression: curlcffi issue #55
+        Cookies were lost during 302 redirects.
+
+        In bas, the cookie jar persists across redirects.
+        """
+        jar = CookieJar()
+
+        # Request 1 to origin server
+        jar.parse_set_cookie(
+            "tracking=abc123; Domain=.example.com; Path=/",
+            "https://www.example.com/page",
+        )
+
+        # Verify cookie exists
+        header = jar.to_header("https://www.example.com/other")
+        assert "tracking=abc123" in header
+
+        # After redirect, cookie should still be there
+        jar.parse_set_cookie(
+            "redirect_id=xyz; Path=/",
+            "https://www.example.com/redirected",
+        )
+
+        header2 = jar.to_header("https://www.example.com/final")
+        assert "tracking=abc123" in header2
+        assert "redirect_id=xyz" in header2
+
+    def test_cross_domain_redirect_cookies(self):
+        """
+        Test that cookies are properly handled during cross-domain redirects.
+        """
+        jar = CookieJar()
+
+        # Server A sets a cookie
+        jar.parse_set_cookie(
+            "from_a=value1; Domain=.a.com; Path=/",
+            "https://a.com/page",
+        )
+
+        # Server B sets a cookie
+        jar.parse_set_cookie(
+            "from_b=value2; Domain=.b.com; Path=/",
+            "https://b.com/page",
+        )
+
+        # Each domain should only see its own cookies
+        header_a = jar.to_header("https://a.com/page")
+        assert "from_a=value1" in header_a
+        assert "from_b=value2" not in header_a
+
+        header_b = jar.to_header("https://b.com/page")
+        assert "from_b=value2" in header_b
+        assert "from_a=value1" not in header_b
+
+    def test_no_manual_cookie_header_needed(self):
+        """
+        One of curlcffi's annoyances: users had to manually build
+        Cookie headers. bas handles this automatically.
+        """
+        jar = CookieJar()
+        jar.parse_set_cookie("a=1; Path=/", "https://example.com/")
+        jar.parse_set_cookie("b=2; Path=/", "https://example.com/")
+
+        # to_header builds the complete header automatically
+        header = jar.to_header("https://example.com/")
+        assert header == "a=1; b=2"
+
+
+# ── Run tests ────────────────────────────────────────────────────────────────
+
+def run_all_tests():
+    """Simple test runner."""
+    test_classes = [
+        TestCookieCreation,
+        TestCookieExpiration,
+        TestDomainMatching,
+        TestPathMatching,
+        TestCookieJar,
+        TestSetCookieParsing,
+        TestCookiePersistence,
+        TestThreadSafety,
+        TestUrlResolution,
+        TestCookieTimeParsing,
+        TestCurlCffiRegressions,
+    ]
+
+    total = 0
+    passed = 0
+    failed = 0
+    errors = []
+
+    for cls in test_classes:
+        instance = cls()
+        methods = [m for m in dir(instance) if m.startswith("test_")]
+        for method_name in sorted(methods):
+            total += 1
+            method = getattr(instance, method_name)
+            try:
+                method()
+                passed += 1
+                print(f"  PASS {cls.__name__}.{method_name}")
+            except Exception as e:
+                failed += 1
+                errors.append((cls.__name__, method_name, str(e)))
+                print(f"  FAIL {cls.__name__}.{method_name}: {e}")
+
+    print(f"\n{'='*60}")
+    print(f"Results: {passed} passed, {failed} failed, {total} total")
+    if errors:
+        print(f"\nFailures:")
+        for cls_name, method, err in errors:
+            print(f"  {cls_name}.{method}: {err}")
+    print(f"{'='*60}")
+
+    return failed == 0
+
+
+if __name__ == "__main__":
+    success = run_all_tests()
+    exit(0 if success else 1)