391 lines
16 KiB
Python
Executable File
391 lines
16 KiB
Python
Executable File
"""JWT 服务单元测试 — wave130."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import time
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
import jwt as pyjwt
|
|
import pytest
|
|
from jwt.exceptions import ExpiredSignatureError, InvalidTokenError
|
|
|
|
from packages.application.auth.jwt_service import (
|
|
JWTConfig,
|
|
JWTService,
|
|
TokenType,
|
|
)
|
|
|
|
# ── 测试常量 ────────────────────────────────────────────────────────────────
|
|
|
|
|
|
TEST_SECRET = "test-secret-key-for-unit-testing-only-1234567890"
|
|
TEST_ALGORITHM = "HS256"
|
|
|
|
|
|
# ── JWTConfig 配置 ──────────────────────────────────────────────────────────
|
|
|
|
|
|
class TestJWTConfig:
|
|
def test_normal_config(self):
|
|
config = JWTConfig(secret_key=TEST_SECRET)
|
|
assert config.SECRET_KEY == TEST_SECRET
|
|
assert config.ALGORITHM == "HS256"
|
|
assert config.ACCESS_TOKEN_EXPIRE_MINUTES == 15
|
|
assert config.REFRESH_TOKEN_EXPIRE_DAYS == 7
|
|
|
|
def test_custom_config(self):
|
|
config = JWTConfig(
|
|
secret_key=TEST_SECRET,
|
|
algorithm="HS384",
|
|
access_token_expire_minutes=60,
|
|
refresh_token_expire_days=30,
|
|
)
|
|
assert config.ALGORITHM == "HS384"
|
|
assert config.ACCESS_TOKEN_EXPIRE_MINUTES == 60
|
|
assert config.REFRESH_TOKEN_EXPIRE_DAYS == 30
|
|
|
|
def test_empty_secret_raises(self):
|
|
with pytest.raises(ValueError, match="secret_key must be provided"):
|
|
JWTConfig(secret_key="")
|
|
|
|
def test_whitespace_secret_raises(self):
|
|
with pytest.raises(ValueError):
|
|
JWTConfig(secret_key=" ")
|
|
|
|
def test_none_secret_raises(self):
|
|
with pytest.raises(ValueError):
|
|
JWTConfig(secret_key=None) # type: ignore
|
|
|
|
@pytest.mark.parametrize(
|
|
"bad_secret",
|
|
[
|
|
"your-secret-key-change-in-production",
|
|
"your-secret-key",
|
|
"secret",
|
|
"changeme",
|
|
"password",
|
|
"SECRET",
|
|
"Your-Secret-Key",
|
|
],
|
|
)
|
|
def test_insecure_defaults_rejected(self, bad_secret):
|
|
with pytest.raises(ValueError, match="insecure"):
|
|
JWTConfig(secret_key=bad_secret)
|
|
|
|
|
|
# ── JWTService 初始化 ──────────────────────────────────────────────────────
|
|
|
|
|
|
class TestJWTServiceInit:
|
|
def test_with_config_works(self):
|
|
config = JWTConfig(secret_key=TEST_SECRET)
|
|
service = JWTService(config)
|
|
assert service.config is config
|
|
|
|
def test_none_config_raises(self):
|
|
with pytest.raises(ValueError, match="JWTService requires"):
|
|
JWTService(None)
|
|
|
|
|
|
# ── create_access_token ────────────────────────────────────────────────────
|
|
|
|
|
|
class TestCreateAccessToken:
|
|
def setup_method(self):
|
|
self.service = JWTService(JWTConfig(secret_key=TEST_SECRET))
|
|
|
|
def test_creates_valid_jwt(self):
|
|
token = self.service.create_access_token(user_id="user123")
|
|
assert isinstance(token, str)
|
|
assert len(token) > 0
|
|
# JWT 格式：xxx.yyy.zzz
|
|
assert token.count(".") == 2
|
|
|
|
def test_payload_contains_user_id(self):
|
|
token = self.service.create_access_token(user_id="user_001")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["sub"] == "user_001"
|
|
|
|
def test_payload_contains_role(self):
|
|
token = self.service.create_access_token(user_id="u1", role="admin")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["role"] == "admin"
|
|
|
|
def test_default_role_empty(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["role"] == ""
|
|
|
|
def test_token_type_is_access(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["type"] == TokenType.ACCESS
|
|
|
|
def test_has_iat_and_exp(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert "iat" in payload
|
|
assert "exp" in payload
|
|
assert payload["exp"] > payload["iat"]
|
|
|
|
def test_expiration_correct(self):
|
|
"""过期时间大约等于当前时间 + 配置的分钟数."""
|
|
config = JWTConfig(secret_key=TEST_SECRET, access_token_expire_minutes=30)
|
|
service = JWTService(config)
|
|
before = datetime.now(timezone.utc)
|
|
token = service.create_access_token(user_id="u1")
|
|
after = datetime.now(timezone.utc)
|
|
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
exp = datetime.fromtimestamp(payload["exp"], tz=timezone.utc)
|
|
|
|
min_expected = before + timedelta(minutes=30) - timedelta(seconds=1)
|
|
max_expected = after + timedelta(minutes=30) + timedelta(seconds=1)
|
|
assert min_expected <= exp <= max_expected
|
|
|
|
def test_additional_claims_included(self):
|
|
extra = {"email": "test@example.com", "org_id": "org_001", "level": 5}
|
|
token = self.service.create_access_token(user_id="u1", additional_claims=extra)
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["email"] == "test@example.com"
|
|
assert payload["org_id"] == "org_001"
|
|
assert payload["level"] == 5
|
|
|
|
def test_additional_claims_none(self):
|
|
token = self.service.create_access_token(user_id="u1", additional_claims=None)
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert "email" not in payload
|
|
|
|
def test_signed_with_correct_key(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
# 用正确的密钥可以解码
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["sub"] == "u1"
|
|
# 用错误的密钥无法解码
|
|
with pytest.raises(InvalidTokenError):
|
|
pyjwt.decode(token, "wrong-secret", algorithms=["HS256"])
|
|
|
|
|
|
# ── create_refresh_token ───────────────────────────────────────────────────
|
|
|
|
|
|
class TestCreateRefreshToken:
|
|
def setup_method(self):
|
|
self.service = JWTService(JWTConfig(secret_key=TEST_SECRET))
|
|
|
|
def test_creates_valid_token(self):
|
|
token = self.service.create_refresh_token(user_id="u1", session_id="sess_001")
|
|
assert isinstance(token, str)
|
|
assert token.count(".") == 2
|
|
|
|
def test_payload_contains_session_id(self):
|
|
token = self.service.create_refresh_token(user_id="u1", session_id="sess_abc")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["session_id"] == "sess_abc"
|
|
assert payload["sub"] == "u1"
|
|
|
|
def test_token_type_is_refresh(self):
|
|
token = self.service.create_refresh_token(user_id="u1", session_id="s1")
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
assert payload["type"] == TokenType.REFRESH
|
|
|
|
def test_refresh_expiration_days(self):
|
|
config = JWTConfig(secret_key=TEST_SECRET, refresh_token_expire_days=7)
|
|
service = JWTService(config)
|
|
before = datetime.now(timezone.utc)
|
|
token = service.create_refresh_token(user_id="u1", session_id="s1")
|
|
after = datetime.now(timezone.utc)
|
|
|
|
payload = pyjwt.decode(token, TEST_SECRET, algorithms=["HS256"])
|
|
exp = datetime.fromtimestamp(payload["exp"], tz=timezone.utc)
|
|
|
|
min_exp = before + timedelta(days=7) - timedelta(seconds=1)
|
|
max_exp = after + timedelta(days=7, seconds=1)
|
|
assert min_exp <= exp <= max_exp
|
|
|
|
|
|
# ── verify_token ───────────────────────────────────────────────────────────
|
|
|
|
|
|
class TestVerifyToken:
|
|
def setup_method(self):
|
|
self.service = JWTService(JWTConfig(secret_key=TEST_SECRET))
|
|
|
|
def test_valid_token_returns_payload(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
payload = self.service.verify_token(token)
|
|
assert payload["sub"] == "u1"
|
|
|
|
def test_expired_token_raises(self):
|
|
# 创建一个 1 秒过期的 token
|
|
config = JWTConfig(secret_key=TEST_SECRET, access_token_expire_minutes=1)
|
|
service = JWTService(config)
|
|
token = service.create_access_token(user_id="u1")
|
|
|
|
# 等待过期（用 pyjwt 直接构造过期 token 更可靠）
|
|
expired_payload = {
|
|
"sub": "u1",
|
|
"type": "access",
|
|
"exp": datetime.now(timezone.utc) - timedelta(seconds=10),
|
|
}
|
|
expired_token = pyjwt.encode(expired_payload, TEST_SECRET, algorithm="HS256")
|
|
|
|
with pytest.raises(ExpiredSignatureError, match="expired"):
|
|
self.service.verify_token(expired_token)
|
|
|
|
def test_invalid_token_raises(self):
|
|
with pytest.raises(InvalidTokenError, match="Invalid token"):
|
|
self.service.verify_token("not-a-valid-jwt-token")
|
|
|
|
def test_wrong_signature_raises(self):
|
|
token = pyjwt.encode({"sub": "u1"}, "different-secret", algorithm="HS256")
|
|
with pytest.raises(InvalidTokenError):
|
|
self.service.verify_token(token)
|
|
|
|
def test_tampered_payload_raises(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
# 尝试篡改：JWT 有签名保护，篡改会导致验证失败
|
|
parts = token.split(".")
|
|
assert len(parts) == 3
|
|
# 把 payload 部分替换（不会成功，因为签名不对）
|
|
import base64
|
|
|
|
fake_payload = base64.urlsafe_b64encode(b'{"sub":"admin","role":"admin"}').rstrip(b"=").decode()
|
|
tampered = f"{parts[0]}.{fake_payload}.{parts[2]}"
|
|
with pytest.raises(InvalidTokenError):
|
|
self.service.verify_token(tampered)
|
|
|
|
|
|
# ── verify_access_token ─────────────────────────────────────────────────────
|
|
|
|
|
|
class TestVerifyAccessToken:
|
|
def setup_method(self):
|
|
self.service = JWTService(JWTConfig(secret_key=TEST_SECRET))
|
|
|
|
def test_access_token_passes(self):
|
|
token = self.service.create_access_token(user_id="u1", role="user")
|
|
payload = self.service.verify_access_token(token)
|
|
assert payload["sub"] == "u1"
|
|
assert payload["type"] == "access"
|
|
|
|
def test_refresh_token_rejected(self):
|
|
token = self.service.create_refresh_token(user_id="u1", session_id="s1")
|
|
with pytest.raises(ValueError, match="Token type must be 'access'"):
|
|
self.service.verify_access_token(token)
|
|
|
|
def test_expired_token_raises(self):
|
|
expired_payload = {
|
|
"sub": "u1",
|
|
"type": "access",
|
|
"exp": datetime.now(timezone.utc) - timedelta(seconds=10),
|
|
}
|
|
token = pyjwt.encode(expired_payload, TEST_SECRET, algorithm="HS256")
|
|
with pytest.raises(ExpiredSignatureError):
|
|
self.service.verify_access_token(token)
|
|
|
|
|
|
# ── verify_refresh_token ────────────────────────────────────────────────────
|
|
|
|
|
|
class TestVerifyRefreshToken:
|
|
def setup_method(self):
|
|
self.service = JWTService(JWTConfig(secret_key=TEST_SECRET))
|
|
|
|
def test_refresh_token_passes(self):
|
|
token = self.service.create_refresh_token(user_id="u1", session_id="sess_001")
|
|
payload = self.service.verify_refresh_token(token)
|
|
assert payload["sub"] == "u1"
|
|
assert payload["session_id"] == "sess_001"
|
|
|
|
def test_access_token_rejected(self):
|
|
token = self.service.create_access_token(user_id="u1")
|
|
with pytest.raises(ValueError, match="Token type must be 'refresh'"):
|
|
self.service.verify_refresh_token(token)
|
|
|
|
def test_has_session_id(self):
|
|
token = self.service.create_refresh_token(user_id="u1", session_id="custom_sess")
|
|
payload = self.service.verify_refresh_token(token)
|
|
assert payload["session_id"] == "custom_sess"
|
|
|
|
|
|
# ── TokenType 常量 ──────────────────────────────────────────────────────────
|
|
|
|
|
|
class TestTokenType:
|
|
def test_access_value(self):
|
|
assert TokenType.ACCESS == "access"
|
|
|
|
def test_refresh_value(self):
|
|
assert TokenType.REFRESH == "refresh"
|
|
|
|
def test_different_types(self):
|
|
assert TokenType.ACCESS != TokenType.REFRESH
|
|
|
|
|
|
# ── 多算法支持 ──────────────────────────────────────────────────────────────
|
|
|
|
|
|
class TestDifferentAlgorithms:
|
|
def test_hs384_works(self):
|
|
config = JWTConfig(secret_key=TEST_SECRET * 2, algorithm="HS384")
|
|
service = JWTService(config)
|
|
token = service.create_access_token(user_id="u1")
|
|
payload = service.verify_token(token)
|
|
assert payload["sub"] == "u1"
|
|
|
|
def test_hs512_works(self):
|
|
config = JWTConfig(secret_key=TEST_SECRET * 3, algorithm="HS512")
|
|
service = JWTService(config)
|
|
token = service.create_access_token(user_id="u1")
|
|
payload = service.verify_token(token)
|
|
assert payload["sub"] == "u1"
|
|
|
|
def test_algorithm_mismatch_fails(self):
|
|
config_hs256 = JWTConfig(secret_key=TEST_SECRET, algorithm="HS256")
|
|
config_hs384 = JWTConfig(secret_key=TEST_SECRET, algorithm="HS384")
|
|
service_256 = JWTService(config_hs256)
|
|
service_384 = JWTService(config_hs384)
|
|
|
|
token = service_256.create_access_token(user_id="u1")
|
|
with pytest.raises(InvalidTokenError):
|
|
service_384.verify_token(token)
|
|
|
|
|
|
# ── 边界：空用户ID等 ────────────────────────────────────────────────────────
|
|
|
|
|
|
class TestEdgeCases:
|
|
def setup_method(self):
|
|
self.service = JWTService(JWTConfig(secret_key=TEST_SECRET))
|
|
|
|
def test_empty_user_id(self):
|
|
token = self.service.create_access_token(user_id="")
|
|
payload = self.service.verify_access_token(token)
|
|
assert payload["sub"] == ""
|
|
|
|
def test_long_user_id(self):
|
|
long_id = "x" * 1000
|
|
token = self.service.create_access_token(user_id=long_id)
|
|
payload = self.service.verify_access_token(token)
|
|
assert payload["sub"] == long_id
|
|
|
|
def test_special_chars_in_user_id(self):
|
|
uid = "user@#$%^&*()_+-=[]{}|;:',.<>?/`~"
|
|
token = self.service.create_access_token(user_id=uid)
|
|
payload = self.service.verify_access_token(token)
|
|
assert payload["sub"] == uid
|
|
|
|
def test_unicode_user_id(self):
|
|
uid = "用户_测试_123_🎉"
|
|
token = self.service.create_access_token(user_id=uid)
|
|
payload = self.service.verify_access_token(token)
|
|
assert payload["sub"] == uid
|
|
|
|
def test_many_additional_claims(self):
|
|
claims = {f"key_{i}": f"value_{i}" for i in range(50)}
|
|
token = self.service.create_access_token(user_id="u1", additional_claims=claims)
|
|
payload = self.service.verify_access_token(token)
|
|
for i in range(50):
|
|
assert payload[f"key_{i}"] == f"value_{i}"
|