Deploy Stride with encrypted manual and scheduled Garmin sync

tests/test_app.py

@@ -86,6 +86,27 @@ def test_owner_dashboard_activity_json_and_settings_render(app):
     assert "point" not in data["chart"][0]
 
 
+def test_dashboard_replays_latest_accessible_gps_run(app):
+    client = app.test_client()
+    login(client)
+    page = client.get("/dashboard").data
+    assert b'id="dashboard-route-map" data-url="/activities/1/data"' in page
+    assert b'id="toggle-route-replay"' in page
+    assert b'vendor/leaflet.js' in page
+    assert b'class="dashboard-map"' not in page
+    client.post("/logout")
+    login(client, "other")
+    page = client.get("/dashboard").data
+    assert b'No GPS running route available yet.' in page
+    assert b'/activities/1/data' not in page
+    with app.app_context():
+        db.session.get(Activity, 1).samples = []
+        db.session.commit()
+    client.post("/logout")
+    login(client)
+    assert b'No GPS running route available yet.' in client.get("/dashboard").data
+
+
 def test_friend_access_requires_acceptance_and_revokes_immediately(app):
     owner = app.test_client()
     friend = app.test_client()
@@ -132,6 +153,66 @@ def test_full_route_includes_start_and_finish():
     assert activity_data(row)["segments"] == [points]
 
 
+def test_public_run_link_copy_view_revoke_and_recreate(app):
+    owner = app.test_client()
+    anonymous = app.test_client()
+    login(owner)
+    assert b'id="copy-run-link"' in owner.get("/activities/1").data
+    response = owner.post("/activities/1/share")
+    assert response.status_code == 200
+    url = response.json["url"]
+    assert url.startswith("http://localhost/shared/runs/")
+    assert len(url.rsplit("/", 1)[1]) >= 40
+    assert owner.post("/activities/1/share").json["url"] == url
+    page = anonymous.get(url)
+    assert page.status_code == 200
+    assert b"A quiet morning run" in page.data
+    assert b"Shared via link" in page.data
+    assert b'id="copy-run-link"' not in page.data
+    assert b"/activities/1/edit" not in page.data
+    assert b"/u/runner" not in page.data
+    assert (url.removeprefix("http://localhost") + "/data").encode() in page.data
+    assert page.headers["X-Robots-Tag"] == "noindex, nofollow"
+    assert page.headers["Referrer-Policy"] == "no-referrer"
+    data = anonymous.get(url + "/data")
+    assert data.status_code == 200
+    assert data.json["segments"] == [[[-33, 151]]]
+    assert "no-store" in data.headers["Cache-Control"]
+    assert anonymous.get("/activities/1").status_code == 404
+    assert anonymous.get("/activities/1/data").status_code == 404
+    with app.app_context():
+        assert db.session.get(Activity, 1).visibility == "private"
+    assert owner.post("/activities/1/share/revoke").status_code == 302
+    assert anonymous.get(url).status_code == 404
+    assert anonymous.get(url + "/data").status_code == 404
+    assert owner.post("/activities/1/share").json["url"] != url
+
+
+def test_only_owner_can_create_or_revoke_public_run_links(app):
+    client = app.test_client()
+    for suffix in ("share", "share/revoke"):
+        assert client.post(f"/activities/1/{suffix}").status_code == 302
+    login(client, "other")
+    with app.app_context():
+        db.session.add(Friendship(low_id=1, high_id=2, requested_by=1, status="accepted"))
+        db.session.get(Activity, 1).visibility = "friends"
+        db.session.commit()
+    assert client.get("/activities/1").status_code == 200
+    assert b'id="copy-run-link"' not in client.get("/activities/1").data
+    for suffix in ("share", "share/revoke"):
+        assert client.post(f"/activities/1/{suffix}").status_code == 404
+    for suffix in ("", "/data"):
+        assert client.get(f"/shared/runs/invalid-token{suffix}").status_code == 404
+
+
+def test_public_run_link_mutations_require_csrf(app):
+    client = app.test_client()
+    login(client)
+    app.config["WTF_CSRF_ENABLED"] = True
+    for suffix in ("share", "share/revoke"):
+        assert client.post(f"/activities/1/{suffix}").status_code == 400
+
+
 def test_register_creates_separate_user_with_no_local_account(app):
     client = app.test_client()
     response = client.post(