From 9a7d12f941cbc4a00eef8e0a798593a45f0cc418 Mon Sep 17 00:00:00 2001 From: Gustavo Date: Thu, 20 Aug 2026 09:11:08 -0300 Subject: [PATCH] fix: achados da revisao final (remove TAMANHO_PAGINA morto, httponly no cookie de paginacao, limpa testes) Co-Authored-By: Claude Sonnet 5 --- app/routers/clientes.py | 4 +--- tests/test_router_auth.py | 5 +++++ tests/test_router_clientes.py | 3 --- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/app/routers/clientes.py b/app/routers/clientes.py index e1ac150..33da3a5 100644 --- a/app/routers/clientes.py +++ b/app/routers/clientes.py @@ -32,8 +32,6 @@ from ..normalize import ( router = APIRouter(prefix="/clientes") templates = Jinja2Templates(directory="app/templates") -TAMANHO_PAGINA = 100 - OPCOES_POR_PAGINA = [5, 10, 15, 20, 30, 40, 50, 100] POR_PAGINA_PADRAO = 15 POR_PAGINA_COOKIE = "clientes_por_pagina" @@ -208,7 +206,7 @@ def listar( # reescrevendo o mesmo Set-Cookie em toda requisição à toa. resposta.set_cookie( POR_PAGINA_COOKIE, str(por_pagina), samesite="lax", - secure=request.url.scheme == "https", + secure=request.url.scheme == "https", httponly=True, ) return resposta diff --git a/tests/test_router_auth.py b/tests/test_router_auth.py index 8a3306e..e25311a 100644 --- a/tests/test_router_auth.py +++ b/tests/test_router_auth.py @@ -125,3 +125,8 @@ def test_post_logout_apaga_cookie_de_preferencia_de_paginacao(): assert resposta.status_code == 303 set_cookie = resposta.headers.get("set-cookie", "") assert POR_PAGINA_COOKIE in set_cookie + # confirma que o cookie foi de fato apagado (Max-Age=0), não só regravado + trecho_cookie = next( + parte for parte in resposta.headers.get_list("set-cookie") if POR_PAGINA_COOKIE in parte + ) + assert "Max-Age=0" in trecho_cookie diff --git a/tests/test_router_clientes.py b/tests/test_router_clientes.py index 8777d3f..42fd66d 100644 --- a/tests/test_router_clientes.py +++ b/tests/test_router_clientes.py @@ -36,13 +36,10 @@ def _sem_log_real(monkeypatch): @pytest.fixture(autouse=True) def _limpar_cookies(): """Limpa cookies entre testes para evitar compartilhamento de estado.""" - # Salva os cookies iniciais (csrf_token deve persistir) - csrf_token = client.cookies.get("csrf_token") client.cookies.clear() client.cookies.set("csrf_token", CSRF_TESTE) yield # Limpa novamente após o teste - csrf_token = client.cookies.get("csrf_token") client.cookies.clear() client.cookies.set("csrf_token", CSRF_TESTE)