From 5c1a1f95044bc5c0e8a9b801a0140743b6bd530a Mon Sep 17 00:00:00 2001
From: curo1305 <curo1305@proton.me>
Date: Sat, 6 Jun 2026 16:49:58 +0200
Subject: [PATCH] =?UTF-8?q?test(07.3-01):=20add=20Wave=200=20xfail=20scaff?=
 =?UTF-8?q?old=20=E2=80=94=209=20ES256/RM/CFG=20stubs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Create backend/tests/test_auth_es256.py with 9 xfail(strict=True) stubs
- Cover ES256-01..05 (access token, HS256 rejection, reset token, startup rotation)
- Cover RM-01..03 (16h default TTL, 30d remember_me TTL, cookie max_age)
- Cover CFG-01 satellite (jwt_private_key/jwt_public_key presence)
- Add es256_keys autouse fixture generating fresh P-256 keypair per test
- All 9 stubs collect and run as XFAIL; zero XPASS, zero ERROR
---
 backend/tests/test_auth_es256.py | 94 ++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 backend/tests/test_auth_es256.py

diff --git a/backend/tests/test_auth_es256.py b/backend/tests/test_auth_es256.py
new file mode 100644
index 0000000..5132d38
--- /dev/null
+++ b/backend/tests/test_auth_es256.py
@@ -0,0 +1,94 @@
+"""
+TDD scaffold for Phase 7.3: ES256 algorithm upgrade, startup token rotation,
+and remember_me session TTL — all stubs xfail strict=True until promoted.
+"""
+import base64
+import hashlib
+import json
+import time
+import uuid
+from datetime import datetime, timedelta, timezone
+
+import pytest
+import pytest_asyncio
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+
+
+@pytest.fixture(autouse=True)
+def es256_keys(monkeypatch):
+    """Patch settings with a freshly generated P-256 key pair for each test."""
+    k = ec.generate_private_key(ec.SECP256R1())
+    priv = base64.b64encode(
+        k.private_bytes(
+            serialization.Encoding.PEM,
+            serialization.PrivateFormat.PKCS8,
+            serialization.NoEncryption(),
+        )
+    ).decode()
+    pub = base64.b64encode(
+        k.public_key().public_bytes(
+            serialization.Encoding.PEM,
+            serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+    ).decode()
+    monkeypatch.setattr("config.settings.jwt_private_key", priv, raising=False)
+    monkeypatch.setattr("config.settings.jwt_public_key", pub, raising=False)
+
+
+# ── ES256 algorithm stubs ─────────────────────────────────────────────────────
+
+@pytest.mark.xfail(strict=True, reason="ES256-01: not yet implemented")
+def test_access_token_uses_es256():
+    pytest.xfail("not yet implemented")
+
+
+@pytest.mark.xfail(strict=True, reason="ES256-02: not yet implemented")
+def test_hs256_token_rejected():
+    pytest.xfail("not yet implemented")
+
+
+@pytest.mark.xfail(strict=True, reason="ES256-03: not yet implemented")
+def test_reset_token_uses_es256():
+    pytest.xfail("not yet implemented")
+
+
+# ── Startup token rotation stubs ──────────────────────────────────────────────
+
+@pytest.mark.xfail(strict=True, reason="ES256-04: not yet implemented")
+@pytest.mark.asyncio
+async def test_startup_rotation_revokes_tokens(db_session):
+    pytest.xfail("not yet implemented")
+
+
+@pytest.mark.xfail(strict=True, reason="ES256-05: not yet implemented")
+@pytest.mark.asyncio
+async def test_startup_rotation_idempotent(db_session):
+    pytest.xfail("not yet implemented")
+
+
+# ── Remember-me TTL stubs ─────────────────────────────────────────────────────
+
+@pytest.mark.xfail(strict=True, reason="RM-01: not yet implemented")
+@pytest.mark.asyncio
+async def test_default_ttl_16_hours(async_client, db_session, auth_user):
+    pytest.xfail("not yet implemented")
+
+
+@pytest.mark.xfail(strict=True, reason="RM-02: not yet implemented")
+@pytest.mark.asyncio
+async def test_remember_me_ttl_30_days(async_client, db_session, auth_user):
+    pytest.xfail("not yet implemented")
+
+
+@pytest.mark.xfail(strict=True, reason="RM-03: not yet implemented")
+@pytest.mark.asyncio
+async def test_remember_me_cookie_max_age(async_client, auth_user):
+    pytest.xfail("not yet implemented")
+
+
+# ── Config field stubs ────────────────────────────────────────────────────────
+
+@pytest.mark.xfail(strict=True, reason="CFG-01: not yet implemented")
+def test_settings_has_jwt_keys():
+    pytest.xfail("not yet implemented")