curo1305
7833edbf3b
- Create backend/tests/test_auth_fgp.py with 4 xfail(strict=False) stubs - FGP-01: test_fgp_match_returns_200 (matching headers → 200) - FGP-02: test_fgp_mismatch_returns_401 (wrong UA → 401) - FGP-03: test_no_fgp_claim_allowed (no fgp claim → 200 migration grace) - FGP-04: test_missing_headers_empty_string_binding (empty-string binding → 200) - All 4 tests report XFAIL; full suite remains at 1 pre-existing failure only
116 lines
4.1 KiB
Python
116 lines
4.1 KiB
Python
"""
|
|
TDD scaffold for Phase 7.4: Token fingerprinting / token binding.
|
|
|
|
Covers FGP-01..FGP-04:
|
|
- FGP-01 test_fgp_match_returns_200: token issued with matching UA/lang →
|
|
request with same headers returns 200.
|
|
- FGP-02 test_fgp_mismatch_returns_401: token issued for one UA, request
|
|
arrives with different UA → 401 "Token fingerprint mismatch".
|
|
- FGP-03 test_no_fgp_claim_allowed: token manually crafted without "fgp"
|
|
key → 200 (graceful migration; tokens issued before Phase 7.4 keep
|
|
working).
|
|
- FGP-04 test_missing_headers_empty_string_binding: token issued with no
|
|
UA/lang (defaults to ""), request sent with no User-Agent / Accept-Language
|
|
headers → 200 (empty-string fingerprint matches).
|
|
|
|
All four tests are xfail(strict=False) until Wave 1 (Plan 07.4-02) implements
|
|
the fgp claim in services/auth.py and deps/auth.py.
|
|
"""
|
|
import uuid
|
|
|
|
import pytest
|
|
import pytest_asyncio
|
|
from httpx import ASGITransport, AsyncClient
|
|
from fastapi import FastAPI, Depends
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from tests.test_auth_api import FakeRedis
|
|
|
|
|
|
# ── Minimal test app with /test/me route ──────────────────────────────────────
|
|
|
|
|
|
def make_test_app():
|
|
"""Create a minimal FastAPI app that exercises the auth deps.
|
|
|
|
Phase 7.4: app.state.redis is set to a FakeRedis() instance so the
|
|
NBF check and fgp check in get_current_user can call
|
|
request.app.state.redis without raising AttributeError.
|
|
"""
|
|
from deps.auth import get_current_user
|
|
from db.models import User
|
|
|
|
test_app = FastAPI()
|
|
|
|
@test_app.get("/test/me")
|
|
async def get_me(current_user: User = Depends(get_current_user)):
|
|
return {"id": str(current_user.id), "role": current_user.role}
|
|
|
|
# Mount FakeRedis so NBF / fgp checks in get_current_user work
|
|
test_app.state.redis = FakeRedis()
|
|
|
|
return test_app
|
|
|
|
|
|
@pytest_asyncio.fixture
|
|
async def auth_client(db_session: AsyncSession):
|
|
"""Async HTTP test client for the auth-dep test app."""
|
|
from deps.db import get_db
|
|
|
|
app = make_test_app()
|
|
app.dependency_overrides[get_db] = lambda: db_session
|
|
|
|
async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
|
|
yield c
|
|
|
|
app.dependency_overrides.clear()
|
|
|
|
|
|
async def _create_user(db_session, role: str = "user", is_active: bool = True):
|
|
"""Helper: insert a minimal User row into the test DB."""
|
|
from db.models import User
|
|
from services.auth import hash_password
|
|
|
|
user = User(
|
|
id=uuid.uuid4(),
|
|
handle=f"user_{uuid.uuid4().hex[:6]}",
|
|
email=f"{uuid.uuid4().hex[:6]}@example.com",
|
|
password_hash=hash_password("testpassword"),
|
|
role=role,
|
|
is_active=is_active,
|
|
)
|
|
db_session.add(user)
|
|
await db_session.commit()
|
|
return user
|
|
|
|
|
|
# ── FGP stubs (Wave 0) ────────────────────────────────────────────────────────
|
|
|
|
|
|
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
|
@pytest.mark.asyncio
|
|
async def test_fgp_match_returns_200(auth_client, db_session):
|
|
"""FGP-01: token issued with matching UA/Accept-Language → 200."""
|
|
pytest.xfail("not implemented yet")
|
|
|
|
|
|
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
|
@pytest.mark.asyncio
|
|
async def test_fgp_mismatch_returns_401(auth_client, db_session):
|
|
"""FGP-02: token issued for one UA, request from different UA → 401."""
|
|
pytest.xfail("not implemented yet")
|
|
|
|
|
|
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
|
@pytest.mark.asyncio
|
|
async def test_no_fgp_claim_allowed(auth_client, db_session):
|
|
"""FGP-03: token without fgp claim → 200 (migration grace period)."""
|
|
pytest.xfail("not implemented yet")
|
|
|
|
|
|
@pytest.mark.xfail(strict=False, reason="not implemented yet")
|
|
@pytest.mark.asyncio
|
|
async def test_missing_headers_empty_string_binding(auth_client, db_session):
|
|
"""FGP-04: token issued with no headers (empty-string binding), request with no headers → 200."""
|
|
pytest.xfail("not implemented yet")
|