---
phase: 07.4-security-token-fingerprinting-token-binding-inserted
plan: "01"
subsystem: testing
tags: [jwt, fgp, token-binding, token-fingerprinting, pytest, xfail, wave-0]

# Dependency graph
requires:
  - phase: 07.3-security-es256-algorithm-upgrade-inserted
    provides: ES256 JWT signing; conftest _patch_es256_test_keys autouse fixture
  - phase: 07.2-security-jti-claim-redis-access-token-revocation-inserted
    provides: FakeRedis; make_test_app/auth_client/_create_user harness pattern

provides:
  - Wave 0 xfail stubs for FGP-01..FGP-04 in backend/tests/test_auth_fgp.py
  - Test harness scaffold ready for Wave 1 (Plan 07.4-02) implementation

affects:
  - 07.4-02 (Wave 1 implementation will promote these stubs to real assertions)

# Tech tracking
tech-stack:
  added: []
  patterns:
    - "xfail(strict=False) Wave 0 stub convention: single-line body `pytest.xfail('not implemented yet')`"
    - "FGP test harness copies make_test_app/auth_client/_create_user from test_auth_deps.py"

key-files:
  created:
    - backend/tests/test_auth_fgp.py
  modified: []

key-decisions:
  - "Wave 0 xfail stubs carry no assertion logic — body is only pytest.xfail(); implementation deferred to Wave 1"
  - "Harness copied verbatim from test_auth_deps.py (make_test_app, auth_client, _create_user) — no /test/admin route needed"

patterns-established:
  - "FGP tests use the same FakeRedis-backed make_test_app pattern established in Phase 7.2"

requirements-completed:
  - FGP-CONCERN

# Metrics
duration: 8min
completed: 2026-06-06
---

# Phase 07.4 Plan 01: Wave 0 xfail Stubs for Token Fingerprinting (FGP-01..04) Summary

**4 xfail test stubs covering JWT token fingerprint (fgp) behaviours added to `backend/tests/test_auth_fgp.py` using the Phase 7.2/7.3 xfail(strict=False) Wave 0 convention**

## Performance

- **Duration:** ~8 min
- **Started:** 2026-06-06T17:50:00Z
- **Completed:** 2026-06-06T17:58:00Z
- **Tasks:** 1
- **Files modified:** 1

## Accomplishments

- Created `backend/tests/test_auth_fgp.py` with 4 xfail(strict=False) stubs following the Phase 7.2/7.3 Wave 0 convention
- All 4 stubs report XFAIL in `pytest tests/test_auth_fgp.py -v` — zero failures, zero errors
- Full test suite still runs with 1 pre-existing failure only (test_extract_docx ModuleNotFoundError — unrelated to this plan)
- No production source files modified

## Task Commits

1. **Task 1: Create test_auth_fgp.py with 4 xfail stubs (FGP-01..FGP-04)** - `7833edb` (test)

## Files Created/Modified

- `backend/tests/test_auth_fgp.py` — Wave 0 xfail scaffold: make_test_app harness + 4 FGP stubs (FGP-01..04)

## Decisions Made

- Stub body is only `pytest.xfail("not implemented yet")` — no assertion logic; Wave 1 will replace with real assertions
- Copied make_test_app/auth_client/_create_user verbatim from test_auth_deps.py as the plan specified; no /test/admin route added (not needed for FGP tests)
- Did not include `import base64`, `import time`, `import jwt as _jwt`, or `from config import settings` in the stub file — these imports are needed by the implementation stubs in Wave 1, not the xfail-only Wave 0 stubs

## Deviations from Plan

None - plan executed exactly as written.

## Issues Encountered

None.

## Known Stubs

All 4 test functions are intentional xfail stubs. They will be promoted to full assertions in Plan 07.4-02 (Wave 1) when `_compute_fgp`, `create_access_token` signature extension, and the fgp validation block in `get_current_user` are implemented.

## Threat Flags

None — Wave 0 creates test-only stubs with no new security surface.

## Self-Check: PASSED

- `backend/tests/test_auth_fgp.py` exists and contains 4 test functions
- `7833edb` commit found in git log
- `pytest tests/test_auth_fgp.py -v` reports 4 XFAIL, 0 FAILED, 0 ERROR

## Next Phase Readiness

- Wave 0 scaffold complete; Plan 07.4-02 (Wave 1) can now implement `_compute_fgp` in `services/auth.py`, extend `create_access_token`, add fgp validation in `deps/auth.py`, update login/refresh callers in `api/auth.py`, and promote these 4 stubs to real assertions

---

*Phase: 07.4-security-token-fingerprinting-token-binding-inserted*
*Completed: 2026-06-06*