first commit

backend/tests/test_security.py

@@ -0,0 +1,55 @@
+from datetime import timedelta
+
+from jose import jwt
+
+from app.core.config import Settings
+from app.core.security import (
+    ALGORITHM,
+    TOKEN_TYPE_USER,
+    create_user_access_token,
+    decode_user_access_token,
+    hash_password,
+    verify_password,
+)
+
+
+def test_password_hashing_roundtrip() -> None:
+    hashed = hash_password("my-secret-password")
+    assert hashed != "my-secret-password"
+    assert verify_password("my-secret-password", hashed)
+    assert not verify_password("wrong", hashed)
+
+
+def test_jwt_expiration_claim() -> None:
+    settings = Settings(
+        environment="development",
+        database_url="postgresql://localhost/test",
+        secret_key="unit-test-secret-key-at-least-32-chars",
+        access_token_expire_minutes=30,
+    )
+    token = create_user_access_token(42, settings)
+    payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM])
+    assert payload["sub"] == "42"
+    assert payload["type"] == TOKEN_TYPE_USER
+    assert "exp" in payload
+
+    user_id = decode_user_access_token(token, settings)
+    assert user_id == 42
+
+
+def test_jwt_rejects_wrong_type() -> None:
+    settings = Settings(
+        environment="development",
+        database_url="postgresql://localhost/test",
+        secret_key="unit-test-secret-key-at-least-32-chars",
+        access_token_expire_minutes=30,
+    )
+    from datetime import datetime, timezone
+
+    expire = datetime.now(timezone.utc) + timedelta(minutes=5)
+    admin_style = jwt.encode(
+        {"sub": "admin@example.com", "exp": expire, "type": "admin"},
+        settings.secret_key,
+        algorithm=ALGORITHM,
+    )
+    assert decode_user_access_token(admin_style, settings) is None