xiaoxia
560856cf22
Deploy / Build Production Runtime Images (push) Has been skipped
Deploy / Deploy Production (push) Has been skipped
Deploy / Production Browser E2E (push) Has been skipped
Deploy / Deploy Staging (push) Failing after 210h26m26s
CI/CD Pipeline / Frontend Lint (push) Failing after 210h27m0s
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 210h27m7s
111 lines
3.1 KiB
Python
111 lines
3.1 KiB
Python
import asyncio
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import jwt
|
|
import pytest
|
|
from fastapi import HTTPException
|
|
from fastapi.security import HTTPAuthorizationCredentials
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
API_ROOT = ROOT / "apps" / "api"
|
|
if str(API_ROOT) not in sys.path:
|
|
sys.path.insert(0, str(API_ROOT))
|
|
|
|
from app.config import settings
|
|
from app.middleware.auth import get_current_user, get_current_user_optional, require_workspace_access
|
|
|
|
from packages.application.auth.password_hasher import password_hasher
|
|
from packages.domain.entities import User
|
|
|
|
|
|
class InMemoryUserRepository:
|
|
def __init__(self):
|
|
self.users = {}
|
|
|
|
def save(self, user):
|
|
self.users[user.id] = user
|
|
|
|
def find_by_id(self, user_id):
|
|
return self.users.get(user_id)
|
|
|
|
def find_by_email(self, email):
|
|
return next((user for user in self.users.values() if user.email == email), None)
|
|
|
|
def find_by_username(self, username):
|
|
return next((user for user in self.users.values() if user.username == username), None)
|
|
|
|
def find_by_verification_token(self, token):
|
|
return None
|
|
|
|
def find_by_password_reset_token(self, token):
|
|
return None
|
|
|
|
def delete(self, user_id):
|
|
return self.users.pop(user_id, None) is not None
|
|
|
|
|
|
def _repo_with_user():
|
|
repo = InMemoryUserRepository()
|
|
user = User(
|
|
id="user-1",
|
|
email="user@example.com",
|
|
username="user",
|
|
display_name="User",
|
|
password_hash=password_hasher.hash_password("Password1"),
|
|
)
|
|
repo.save(user)
|
|
return repo
|
|
|
|
|
|
def _credentials(token_type="user_auth"):
|
|
token = jwt.encode({"sub": "user-1", "sid": "session-1", "type": token_type}, settings.JWT_SECRET_KEY, "HS256")
|
|
return HTTPAuthorizationCredentials(scheme="Bearer", credentials=token)
|
|
|
|
|
|
def test_legacy_middleware_get_current_user_delegates_to_canonical_auth():
|
|
user = asyncio.run(get_current_user(asyncio.run(_authenticated_user())))
|
|
|
|
assert user.id == "user-1"
|
|
|
|
|
|
def test_legacy_middleware_optional_user_returns_none_without_credentials():
|
|
assert asyncio.run(get_current_user_optional(None, _repo_with_user())) is None
|
|
|
|
|
|
def test_legacy_middleware_optional_user_returns_user_with_valid_credentials():
|
|
user = asyncio.run(get_current_user_optional(_credentials(), _repo_with_user()))
|
|
|
|
assert user is not None
|
|
assert user.id == "user-1"
|
|
|
|
|
|
def test_workspace_dependency_allows_member_access():
|
|
repo = _WorkspaceMemberRepositoryStub(role="member")
|
|
|
|
assert role == "member" # noqa: F821
|
|
|
|
|
|
def test_workspace_dependency_rejects_non_member():
|
|
with pytest.raises(HTTPException) as error:
|
|
require_workspace_access(
|
|
"workspace-1", _repo_with_user().find_by_id("user-1"), _WorkspaceMemberRepositoryStub()
|
|
)
|
|
|
|
assert error.value.status_code == 403
|
|
|
|
|
|
class _WorkspaceMemberRepositoryStub:
|
|
def __init__(self, role=None):
|
|
self.role = role
|
|
|
|
if self.role is None:
|
|
return None
|
|
from packages.domain.entities import WorkspaceMember
|
|
|
|
|
|
async def _authenticated_user():
|
|
from app.auth import get_current_user as get_authenticated_user
|
|
|
|
return await get_authenticated_user(_credentials(), _repo_with_user())
|