NixReaperandClaude Sonnet 5
7bee596a0e
CI / lint (push) Canceled after 0s
CI / typecheck (push) Canceled after 0s
CI / unit-tests (push) Canceled after 0s
CI / integration-tests (push) Canceled after 0s
CI / container-build (push) Canceled after 0s
CI / dependency-audit (push) Canceled after 0s
The first authenticated-user concept in Aurora Core -- everything else in this codebase is public, read-only catalog data. Foundation for ratings and a watchlist (not yet built): POST /auth/register, POST /auth/login, GET /auth/me. Security specifics worth knowing: - Passwords hashed with argon2 (via argon2-cffi), never stored plain or logged. - Login returns an identical 401 for a nonexistent email and a wrong password on a real one, including matching response timing (burn_time_like_a_password_check) -- otherwise either the status code or the timing alone lets a client enumerate registered emails. - AURORA_SECRET_KEY now actually signs JWTs (previously defined but unused anywhere) -- .env.example's existing token_urlsafe(48) guidance already produces a long enough key, just flagged its new stakes. - Email matched case-insensitively via explicit normalization in the service layer, not relied on from Pydantic's EmailStr (which does not lowercase the local part). 12 new integration tests (register/login/me over real HTTP via the `client` fixture) plus 10 unit tests for the hashing/JWT logic itself, following the same-day lesson that only unit tests actually execute locally without Postgres -- the auth core is tested for real here rather than only through integration tests that might not run before a deploy. Co-Authored-By: Claude Sonnet 5 <[email protected]>
97 lines
3.0 KiB
Python
97 lines
3.0 KiB
Python
"""Unit tests for app/core/auth.py -- pure functions, no DB needed. Written
|
|
after a real bug (watch_provider never registered as an Aurora ID entity
|
|
type) shipped unnoticed because every test touching that path skips
|
|
locally without Postgres -- this module's logic is exercised for real
|
|
here rather than only through integration tests that might not run."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
|
|
import pytest
|
|
|
|
from app.core.auth import (
|
|
InvalidTokenError,
|
|
burn_time_like_a_password_check,
|
|
create_access_token,
|
|
decode_access_token,
|
|
hash_password,
|
|
normalize_email,
|
|
verify_password,
|
|
)
|
|
|
|
|
|
def test_hash_password_round_trips():
|
|
hashed = hash_password("correct horse battery staple")
|
|
assert verify_password("correct horse battery staple", hashed) is True
|
|
|
|
|
|
def test_verify_password_rejects_wrong_password():
|
|
hashed = hash_password("correct horse battery staple")
|
|
assert verify_password("wrong password", hashed) is False
|
|
|
|
|
|
def test_hash_password_is_salted():
|
|
# Same input, different output each time -- otherwise two users with
|
|
# the same password would have identical hashed_password rows,
|
|
# trivially revealing the match to anyone with DB access.
|
|
assert hash_password("same password") != hash_password("same password")
|
|
|
|
|
|
def test_normalize_email_lowercases_and_strips():
|
|
assert normalize_email(" [email protected] ") == "[email protected]"
|
|
|
|
|
|
def test_access_token_round_trips():
|
|
user_id = uuid.uuid4()
|
|
token = create_access_token(user_id)
|
|
assert decode_access_token(token) == user_id
|
|
|
|
|
|
def test_decode_rejects_garbage_token():
|
|
with pytest.raises(InvalidTokenError):
|
|
decode_access_token("not.a.valid.token")
|
|
|
|
|
|
def test_decode_rejects_token_signed_with_a_different_key(monkeypatch):
|
|
import jwt
|
|
|
|
from app.core import auth as auth_module
|
|
|
|
forged = jwt.encode({"sub": str(uuid.uuid4())}, "a-different-secret", algorithm="HS256")
|
|
with pytest.raises(InvalidTokenError):
|
|
auth_module.decode_access_token(forged)
|
|
|
|
|
|
def test_decode_rejects_expired_token():
|
|
from datetime import UTC, datetime, timedelta
|
|
|
|
import jwt
|
|
|
|
from app.core import auth as auth_module
|
|
from app.core.config import get_settings
|
|
|
|
expired_payload = {
|
|
"sub": str(uuid.uuid4()),
|
|
"iat": datetime.now(UTC) - timedelta(hours=48),
|
|
"exp": datetime.now(UTC) - timedelta(hours=24),
|
|
}
|
|
token = jwt.encode(expired_payload, get_settings().AURORA_SECRET_KEY, algorithm="HS256")
|
|
with pytest.raises(InvalidTokenError):
|
|
auth_module.decode_access_token(token)
|
|
|
|
|
|
def test_decode_rejects_token_missing_subject():
|
|
import jwt
|
|
|
|
from app.core import auth as auth_module
|
|
from app.core.config import get_settings
|
|
|
|
token = jwt.encode({"nope": "no sub claim"}, get_settings().AURORA_SECRET_KEY, algorithm="HS256")
|
|
with pytest.raises(InvalidTokenError):
|
|
auth_module.decode_access_token(token)
|
|
|
|
|
|
def test_burn_time_like_a_password_check_does_not_raise():
|
|
burn_time_like_a_password_check()
|