curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
567 Commits 1 Branch 1 Tag
f20420a4b5cb9f1041797083328436a2129f0ae4
Commit Graph
3 Commits
Author SHA1 Message Date
curo1305andClaude Sonnet 4.6 c77b97b6d3 fix(fgp): add null-byte separator in HMAC input to prevent concatenation collision 
Without a separator, UA='foobar'+AL='' and UA='foo'+AL='bar' produced the same
HMAC input, allowing a token fingerprint to match a different header split.
Fix: use '\x00' as separator between user_agent and accept_lang fields.

Regression test added: test_fgp_no_concatenation_collision (FGP-05).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 23:03:48 +02:00
curo1305 61b1e045c4 feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3 
- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"
 2026-06-06 22:12:57 +02:00
curo1305 7833edbf3b test(07.4-01): add Wave 0 xfail stubs for FGP-01..FGP-04 
- Create backend/tests/test_auth_fgp.py with 4 xfail(strict=False) stubs
- FGP-01: test_fgp_match_returns_200 (matching headers → 200)
- FGP-02: test_fgp_mismatch_returns_401 (wrong UA → 401)
- FGP-03: test_no_fgp_claim_allowed (no fgp claim → 200 migration grace)
- FGP-04: test_missing_headers_empty_string_binding (empty-string binding → 200)
- All 4 tests report XFAIL; full suite remains at 1 pre-existing failure only
 2026-06-06 21:49:46 +02:00