55 lines
1.6 KiB
Python
55 lines
1.6 KiB
Python
from datetime import timedelta
|
|
|
|
from jose import jwt
|
|
|
|
from app.core.config import Settings
|
|
from app.core.security import (
|
|
ALGORITHM,
|
|
TOKEN_TYPE_USER,
|
|
create_user_access_token,
|
|
decode_user_access_token,
|
|
hash_password,
|
|
verify_password,
|
|
)
|
|
|
|
|
|
def test_password_hashing_roundtrip() -> None:
|
|
hashed = hash_password("my-secret-password")
|
|
assert hashed != "my-secret-password"
|
|
assert verify_password("my-secret-password", hashed)
|
|
assert not verify_password("wrong", hashed)
|
|
|
|
|
|
def test_jwt_expiration_claim() -> None:
|
|
settings = Settings(
|
|
environment="development",
|
|
database_url="postgresql://localhost/test",
|
|
secret_key="unit-test-secret-key-at-least-32-chars",
|
|
access_token_expire_minutes=30,
|
|
)
|
|
token = create_user_access_token(42, settings)
|
|
payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM])
|
|
assert payload["sub"] == "42"
|
|
assert payload["type"] == TOKEN_TYPE_USER
|
|
assert "exp" in payload
|
|
|
|
user_id = decode_user_access_token(token, settings)
|
|
assert user_id == 42
|
|
|
|
|
|
def test_jwt_rejects_wrong_type() -> None:
|
|
settings = Settings(
|
|
environment="development",
|
|
database_url="postgresql://localhost/test",
|
|
secret_key="unit-test-secret-key-at-least-32-chars",
|
|
access_token_expire_minutes=30,
|
|
)
|
|
from datetime import datetime, timezone
|
|
|
|
expire = datetime.now(timezone.utc) + timedelta(minutes=5)
|
|
admin_style = jwt.encode(
|
|
{"sub": "admin@example.com", "exp": expire, "type": "admin"},
|
|
settings.secret_key,
|
|
algorithm=ALGORITHM,
|
|
)
|
|
assert decode_user_access_token(admin_style, settings) is None
|