chore: merge executor worktree (worktree-agent-a37beb50341e88a90)
This commit is contained in:
curo1305
+110
@@ -0,0 +1,110 @@
|
||||
---
|
||||
phase: 07.4-security-token-fingerprinting-token-binding-inserted
|
||||
plan: "01"
|
||||
subsystem: testing
|
||||
tags: [jwt, fgp, token-binding, token-fingerprinting, pytest, xfail, wave-0]
|
||||
|
||||
# Dependency graph
|
||||
requires:
|
||||
- phase: 07.3-security-es256-algorithm-upgrade-inserted
|
||||
provides: ES256 JWT signing; conftest _patch_es256_test_keys autouse fixture
|
||||
- phase: 07.2-security-jti-claim-redis-access-token-revocation-inserted
|
||||
provides: FakeRedis; make_test_app/auth_client/_create_user harness pattern
|
||||
|
||||
provides:
|
||||
- Wave 0 xfail stubs for FGP-01..FGP-04 in backend/tests/test_auth_fgp.py
|
||||
- Test harness scaffold ready for Wave 1 (Plan 07.4-02) implementation
|
||||
|
||||
affects:
|
||||
- 07.4-02 (Wave 1 implementation will promote these stubs to real assertions)
|
||||
|
||||
# Tech tracking
|
||||
tech-stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "xfail(strict=False) Wave 0 stub convention: single-line body `pytest.xfail('not implemented yet')`"
|
||||
- "FGP test harness copies make_test_app/auth_client/_create_user from test_auth_deps.py"
|
||||
|
||||
key-files:
|
||||
created:
|
||||
- backend/tests/test_auth_fgp.py
|
||||
modified: []
|
||||
|
||||
key-decisions:
|
||||
- "Wave 0 xfail stubs carry no assertion logic — body is only pytest.xfail(); implementation deferred to Wave 1"
|
||||
- "Harness copied verbatim from test_auth_deps.py (make_test_app, auth_client, _create_user) — no /test/admin route needed"
|
||||
|
||||
patterns-established:
|
||||
- "FGP tests use the same FakeRedis-backed make_test_app pattern established in Phase 7.2"
|
||||
|
||||
requirements-completed:
|
||||
- FGP-CONCERN
|
||||
|
||||
# Metrics
|
||||
duration: 8min
|
||||
completed: 2026-06-06
|
||||
---
|
||||
|
||||
# Phase 07.4 Plan 01: Wave 0 xfail Stubs for Token Fingerprinting (FGP-01..04) Summary
|
||||
|
||||
**4 xfail test stubs covering JWT token fingerprint (fgp) behaviours added to `backend/tests/test_auth_fgp.py` using the Phase 7.2/7.3 xfail(strict=False) Wave 0 convention**
|
||||
|
||||
## Performance
|
||||
|
||||
- **Duration:** ~8 min
|
||||
- **Started:** 2026-06-06T17:50:00Z
|
||||
- **Completed:** 2026-06-06T17:58:00Z
|
||||
- **Tasks:** 1
|
||||
- **Files modified:** 1
|
||||
|
||||
## Accomplishments
|
||||
|
||||
- Created `backend/tests/test_auth_fgp.py` with 4 xfail(strict=False) stubs following the Phase 7.2/7.3 Wave 0 convention
|
||||
- All 4 stubs report XFAIL in `pytest tests/test_auth_fgp.py -v` — zero failures, zero errors
|
||||
- Full test suite still runs with 1 pre-existing failure only (test_extract_docx ModuleNotFoundError — unrelated to this plan)
|
||||
- No production source files modified
|
||||
|
||||
## Task Commits
|
||||
|
||||
1. **Task 1: Create test_auth_fgp.py with 4 xfail stubs (FGP-01..FGP-04)** - `7833edb` (test)
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
- `backend/tests/test_auth_fgp.py` — Wave 0 xfail scaffold: make_test_app harness + 4 FGP stubs (FGP-01..04)
|
||||
|
||||
## Decisions Made
|
||||
|
||||
- Stub body is only `pytest.xfail("not implemented yet")` — no assertion logic; Wave 1 will replace with real assertions
|
||||
- Copied make_test_app/auth_client/_create_user verbatim from test_auth_deps.py as the plan specified; no /test/admin route added (not needed for FGP tests)
|
||||
- Did not include `import base64`, `import time`, `import jwt as _jwt`, or `from config import settings` in the stub file — these imports are needed by the implementation stubs in Wave 1, not the xfail-only Wave 0 stubs
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
None - plan executed exactly as written.
|
||||
|
||||
## Issues Encountered
|
||||
|
||||
None.
|
||||
|
||||
## Known Stubs
|
||||
|
||||
All 4 test functions are intentional xfail stubs. They will be promoted to full assertions in Plan 07.4-02 (Wave 1) when `_compute_fgp`, `create_access_token` signature extension, and the fgp validation block in `get_current_user` are implemented.
|
||||
|
||||
## Threat Flags
|
||||
|
||||
None — Wave 0 creates test-only stubs with no new security surface.
|
||||
|
||||
## Self-Check: PASSED
|
||||
|
||||
- `backend/tests/test_auth_fgp.py` exists and contains 4 test functions
|
||||
- `7833edb` commit found in git log
|
||||
- `pytest tests/test_auth_fgp.py -v` reports 4 XFAIL, 0 FAILED, 0 ERROR
|
||||
|
||||
## Next Phase Readiness
|
||||
|
||||
- Wave 0 scaffold complete; Plan 07.4-02 (Wave 1) can now implement `_compute_fgp` in `services/auth.py`, extend `create_access_token`, add fgp validation in `deps/auth.py`, update login/refresh callers in `api/auth.py`, and promote these 4 stubs to real assertions
|
||||
|
||||
---
|
||||
|
||||
*Phase: 07.4-security-token-fingerprinting-token-binding-inserted*
|
||||
*Completed: 2026-06-06*
|
||||
@@ -0,0 +1,115 @@
|
||||
"""
|
||||
TDD scaffold for Phase 7.4: Token fingerprinting / token binding.
|
||||
|
||||
Covers FGP-01..FGP-04:
|
||||
- FGP-01 test_fgp_match_returns_200: token issued with matching UA/lang →
|
||||
request with same headers returns 200.
|
||||
- FGP-02 test_fgp_mismatch_returns_401: token issued for one UA, request
|
||||
arrives with different UA → 401 "Token fingerprint mismatch".
|
||||
- FGP-03 test_no_fgp_claim_allowed: token manually crafted without "fgp"
|
||||
key → 200 (graceful migration; tokens issued before Phase 7.4 keep
|
||||
working).
|
||||
- FGP-04 test_missing_headers_empty_string_binding: token issued with no
|
||||
UA/lang (defaults to ""), request sent with no User-Agent / Accept-Language
|
||||
headers → 200 (empty-string fingerprint matches).
|
||||
|
||||
All four tests are xfail(strict=False) until Wave 1 (Plan 07.4-02) implements
|
||||
the fgp claim in services/auth.py and deps/auth.py.
|
||||
"""
|
||||
import uuid
|
||||
|
||||
import pytest
|
||||
import pytest_asyncio
|
||||
from httpx import ASGITransport, AsyncClient
|
||||
from fastapi import FastAPI, Depends
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from tests.test_auth_api import FakeRedis
|
||||
|
||||
|
||||
# ── Minimal test app with /test/me route ──────────────────────────────────────
|
||||
|
||||
|
||||
def make_test_app():
|
||||
"""Create a minimal FastAPI app that exercises the auth deps.
|
||||
|
||||
Phase 7.4: app.state.redis is set to a FakeRedis() instance so the
|
||||
NBF check and fgp check in get_current_user can call
|
||||
request.app.state.redis without raising AttributeError.
|
||||
"""
|
||||
from deps.auth import get_current_user
|
||||
from db.models import User
|
||||
|
||||
test_app = FastAPI()
|
||||
|
||||
@test_app.get("/test/me")
|
||||
async def get_me(current_user: User = Depends(get_current_user)):
|
||||
return {"id": str(current_user.id), "role": current_user.role}
|
||||
|
||||
# Mount FakeRedis so NBF / fgp checks in get_current_user work
|
||||
test_app.state.redis = FakeRedis()
|
||||
|
||||
return test_app
|
||||
|
||||
|
||||
@pytest_asyncio.fixture
|
||||
async def auth_client(db_session: AsyncSession):
|
||||
"""Async HTTP test client for the auth-dep test app."""
|
||||
from deps.db import get_db
|
||||
|
||||
app = make_test_app()
|
||||
app.dependency_overrides[get_db] = lambda: db_session
|
||||
|
||||
async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
|
||||
yield c
|
||||
|
||||
app.dependency_overrides.clear()
|
||||
|
||||
|
||||
async def _create_user(db_session, role: str = "user", is_active: bool = True):
|
||||
"""Helper: insert a minimal User row into the test DB."""
|
||||
from db.models import User
|
||||
from services.auth import hash_password
|
||||
|
||||
user = User(
|
||||
id=uuid.uuid4(),
|
||||
handle=f"user_{uuid.uuid4().hex[:6]}",
|
||||
email=f"{uuid.uuid4().hex[:6]}@example.com",
|
||||
password_hash=hash_password("testpassword"),
|
||||
role=role,
|
||||
is_active=is_active,
|
||||
)
|
||||
db_session.add(user)
|
||||
await db_session.commit()
|
||||
return user
|
||||
|
||||
|
||||
# ── FGP stubs (Wave 0) ────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
||||
@pytest.mark.asyncio
|
||||
async def test_fgp_match_returns_200(auth_client, db_session):
|
||||
"""FGP-01: token issued with matching UA/Accept-Language → 200."""
|
||||
pytest.xfail("not implemented yet")
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
||||
@pytest.mark.asyncio
|
||||
async def test_fgp_mismatch_returns_401(auth_client, db_session):
|
||||
"""FGP-02: token issued for one UA, request from different UA → 401."""
|
||||
pytest.xfail("not implemented yet")
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
||||
@pytest.mark.asyncio
|
||||
async def test_no_fgp_claim_allowed(auth_client, db_session):
|
||||
"""FGP-03: token without fgp claim → 200 (migration grace period)."""
|
||||
pytest.xfail("not implemented yet")
|
||||
|
||||
|
||||
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
||||
@pytest.mark.asyncio
|
||||
async def test_missing_headers_empty_string_binding(auth_client, db_session):
|
||||
"""FGP-04: token issued with no headers (empty-string binding), request with no headers → 200."""
|
||||
pytest.xfail("not implemented yet")
|
||||
Reference in New Issue
Block a user