ajyy/backend/tests/test_minio_public_policy.py

"""MinIO bucket allows anonymous GetObject only under qrcode/*."""
import json
from unittest.mock import MagicMock, patch

import pytest


def test_minio_ensure_bucket_sets_public_read_policy(monkeypatch):
    monkeypatch.setenv("STORAGE_TYPE", "minio")
    monkeypatch.setenv("MINIO_ENDPOINT", "127.0.0.1:9000")
    monkeypatch.setenv("MINIO_ACCESS_KEY", "ak")
    monkeypatch.setenv("MINIO_SECRET_KEY", "sk")
    monkeypatch.setenv("MINIO_BUCKET", "ajyy")
    monkeypatch.setenv("MINIO_SECURE", "false")
    monkeypatch.setenv("MINIO_BASE_URL", "")

    from app.core.config import get_settings

    get_settings.cache_clear()

    mock_client = MagicMock()
    mock_client.bucket_exists.return_value = True

    with patch("minio.Minio", return_value=mock_client):
        from app.core.storage import MinIOStorage

        MinIOStorage()

    mock_client.set_bucket_policy.assert_called_once()
    bucket, policy_json = mock_client.set_bucket_policy.call_args[0]
    assert bucket == "ajyy"
    policy = json.loads(policy_json)
    assert policy["Statement"][0]["Action"] == ["s3:GetObject"]
    assert policy["Statement"][0]["Principal"] == {"AWS": ["*"]}
    assert policy["Statement"][0]["Resource"] == ["arn:aws:s3:::ajyy/qrcode/*"]

    get_settings.cache_clear()