138 lines
4.8 KiB
Python
138 lines
4.8 KiB
Python
"""Personal API tokens: the pure rules (hashing, role ceiling, state) and the
|
|
route gate. Resolution and the routes' transactions run against real Postgres
|
|
in tests/integration/test_api_tokens.py."""
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
from datetime import datetime, timedelta, timezone
|
|
from unittest.mock import AsyncMock, MagicMock, patch
|
|
|
|
import pytest
|
|
|
|
from steward.core import api_tokens
|
|
from steward.models.api_tokens import ApiToken
|
|
from steward.models.users import UserRole
|
|
|
|
VW, OP, AD = UserRole.viewer, UserRole.operator, UserRole.admin
|
|
|
|
|
|
def test_generated_tokens_are_prefixed_and_unique():
|
|
a, b = api_tokens.generate_token(), api_tokens.generate_token()
|
|
assert a.startswith("stw_") and b.startswith("stw_")
|
|
assert a != b
|
|
assert len(a) > 40
|
|
|
|
|
|
def test_hash_is_sha256_of_the_plaintext():
|
|
raw = "stw_example"
|
|
assert api_tokens.hash_token(raw) == hashlib.sha256(raw.encode()).hexdigest()
|
|
|
|
|
|
def test_display_prefix_never_reveals_the_whole_token():
|
|
raw = api_tokens.generate_token()
|
|
shown = api_tokens.display_prefix(raw)
|
|
assert raw.startswith(shown)
|
|
assert len(shown) < len(raw) // 3
|
|
|
|
|
|
@pytest.mark.parametrize("ceiling,user_role,expected", [
|
|
(AD, AD, AD), (OP, AD, OP), (VW, AD, VW),
|
|
(AD, OP, OP), (OP, OP, OP), (VW, OP, VW),
|
|
(AD, VW, VW), (OP, VW, VW), (VW, VW, VW),
|
|
])
|
|
def test_effective_role_is_the_lower_of_ceiling_and_user(ceiling, user_role, expected):
|
|
assert api_tokens.effective_role(ceiling, user_role) == expected
|
|
|
|
|
|
def test_grantable_roles_stop_at_the_users_own():
|
|
assert api_tokens.grantable_roles(VW) == [VW]
|
|
assert api_tokens.grantable_roles(OP) == [VW, OP]
|
|
assert api_tokens.grantable_roles(AD) == [VW, OP, AD]
|
|
|
|
|
|
def _token(**kw) -> ApiToken:
|
|
return ApiToken(name="t", token_hash="x", prefix="stw_x", role=VW, **kw)
|
|
|
|
|
|
def test_token_state():
|
|
now = datetime.now(timezone.utc)
|
|
assert api_tokens.token_state(_token(), now) == "active"
|
|
assert api_tokens.token_state(_token(expires_at=now + timedelta(days=1)), now) == "active"
|
|
assert api_tokens.token_state(_token(expires_at=now), now) == "expired"
|
|
assert api_tokens.token_state(_token(revoked_at=now), now) == "revoked"
|
|
# Revoked wins over expired: it is the more deliberate fact.
|
|
assert api_tokens.token_state(
|
|
_token(revoked_at=now, expires_at=now - timedelta(days=1)), now) == "revoked"
|
|
|
|
|
|
def _fake_db():
|
|
db = MagicMock()
|
|
db.flush = AsyncMock()
|
|
return db
|
|
|
|
|
|
async def test_create_token_stores_only_the_hash():
|
|
db = _fake_db()
|
|
raw, token = await api_tokens.create_token(
|
|
db, user_id="u1", user_role=OP, name=" laptop ", role=OP, expires_in_days=30)
|
|
db.add.assert_called_once_with(token)
|
|
assert token.token_hash == api_tokens.hash_token(raw)
|
|
assert raw not in (token.token_hash, token.prefix)
|
|
assert token.name == "laptop"
|
|
assert token.role == OP
|
|
assert token.expires_at is not None
|
|
|
|
|
|
async def test_create_token_refuses_a_ceiling_above_the_users_role():
|
|
db = _fake_db()
|
|
with pytest.raises(ValueError, match="higher role"):
|
|
await api_tokens.create_token(db, user_id="u1", user_role=OP, name="x", role=AD)
|
|
db.add.assert_not_called()
|
|
|
|
|
|
async def test_create_token_requires_a_name():
|
|
with pytest.raises(ValueError, match="name"):
|
|
await api_tokens.create_token(_fake_db(), user_id="u1", user_role=AD, name=" ", role=VW)
|
|
|
|
|
|
async def test_resolve_rejects_non_steward_tokens_without_touching_the_db():
|
|
app = MagicMock()
|
|
for raw in (None, "", "Bearer x", "abc123"):
|
|
assert await api_tokens.resolve_token(app, raw) is None
|
|
app.db_sessionmaker.assert_not_called()
|
|
|
|
|
|
async def test_ai_access_requires_login(client):
|
|
resp = await client.get("/ai-access/")
|
|
assert resp.status_code == 302
|
|
assert "/login" in resp.headers["Location"]
|
|
|
|
|
|
async def test_ai_access_refuses_a_request_with_no_session_user():
|
|
# A share-link viewer passes require_role(viewer) but has no session user to
|
|
# own tokens; the guard must refuse rather than act for nobody.
|
|
from werkzeug.exceptions import Forbidden
|
|
from steward.ai_access import routes
|
|
|
|
db = MagicMock()
|
|
db.execute = AsyncMock()
|
|
with patch.object(routes, "current_user_id", return_value=None):
|
|
with pytest.raises(Forbidden):
|
|
await routes._session_user(db)
|
|
db.execute.assert_not_called()
|
|
|
|
|
|
async def test_ai_access_refuses_a_disabled_user():
|
|
from werkzeug.exceptions import Forbidden
|
|
from steward.ai_access import routes
|
|
from steward.models.users import User
|
|
|
|
user = User(id="u1", username="x", email="x@e", password_hash="h", role=AD, is_active=False)
|
|
result = MagicMock()
|
|
result.scalar_one_or_none.return_value = user
|
|
db = MagicMock()
|
|
db.execute = AsyncMock(return_value=result)
|
|
with patch.object(routes, "current_user_id", return_value="u1"):
|
|
with pytest.raises(Forbidden):
|
|
await routes._session_user(db)
|