593 lines
19 KiB
Python
593 lines
19 KiB
Python
from types import SimpleNamespace
|
|
from unittest.mock import MagicMock, call
|
|
|
|
import flask
|
|
import pytest
|
|
|
|
from api import main as apiMain
|
|
from api import security
|
|
|
|
|
|
def _bearer(token="token"):
|
|
return {"Authorization": f"Bearer {token}"}
|
|
|
|
|
|
def _userPrincipal(userUUID="user-1", authentication="jwt"):
|
|
return {
|
|
"type": "user",
|
|
"authentication": authentication,
|
|
"user_uuid": userUUID,
|
|
"scopes": [],
|
|
}
|
|
|
|
|
|
def _servicePrincipal(*scopes):
|
|
return {
|
|
"type": "service",
|
|
"authentication": "api_key",
|
|
"service_name": "test-service",
|
|
"scopes": list(scopes),
|
|
}
|
|
|
|
|
|
@pytest.fixture
|
|
def securityClient():
|
|
app = flask.Flask("security-test")
|
|
app.config["TESTING"] = True
|
|
|
|
@app.route("/json", methods=["POST"])
|
|
def parseJson():
|
|
return flask.jsonify({"parsed": security.jsonObject()})
|
|
|
|
@app.route("/user")
|
|
@security.requireUser()
|
|
def userRoute():
|
|
return flask.jsonify(
|
|
{
|
|
"user_uuid": flask.g.user_uuid,
|
|
"principal_type": flask.g.principal["type"],
|
|
}
|
|
)
|
|
|
|
@app.route("/login-user")
|
|
@security.requireUser(requireLogin=True)
|
|
def loginUserRoute():
|
|
return flask.jsonify({"ok": True})
|
|
|
|
@app.route("/service")
|
|
@security.requireService("jobs:claim")
|
|
def serviceRoute():
|
|
return flask.jsonify({"service": flask.g.principal["service_name"]})
|
|
|
|
return app.test_client()
|
|
|
|
|
|
@pytest.fixture
|
|
def apiClient(monkeypatch):
|
|
registry = SimpleNamespace(route_registrars=[])
|
|
monkeypatch.setattr(apiMain, "discover_modules", MagicMock(return_value=registry))
|
|
app = apiMain.createApp()
|
|
app.config.update(TESTING=True, SERVICE_KEY_READY=True)
|
|
return app.test_client()
|
|
|
|
|
|
def test_json_object_accepts_only_json_objects(securityClient):
|
|
assert securityClient.post("/json", json={"value": 1}).get_json() == {
|
|
"parsed": {"value": 1}
|
|
}
|
|
assert securityClient.post("/json", json=[1, 2]).get_json() == {"parsed": None}
|
|
assert securityClient.post(
|
|
"/json",
|
|
data="not-json",
|
|
content_type="application/json",
|
|
).get_json() == {"parsed": None}
|
|
|
|
|
|
def test_require_user_sets_context_and_forwards_login_requirement(
|
|
monkeypatch, securityClient
|
|
):
|
|
principal = _userPrincipal()
|
|
authenticate = MagicMock(return_value=principal)
|
|
isUser = MagicMock(return_value=True)
|
|
monkeypatch.setattr(security.auth, "authenticateBearerToken", authenticate)
|
|
monkeypatch.setattr(security.auth, "isUserPrincipal", isUser)
|
|
|
|
response = securityClient.get("/user", headers=_bearer("user-token"))
|
|
loginResponse = securityClient.get(
|
|
"/login-user",
|
|
headers=_bearer("user-token"),
|
|
)
|
|
|
|
assert response.status_code == 200
|
|
assert response.get_json() == {
|
|
"user_uuid": "user-1",
|
|
"principal_type": "user",
|
|
}
|
|
assert loginResponse.status_code == 200
|
|
assert authenticate.call_args_list == [
|
|
call("Bearer user-token", allowService=False),
|
|
call("Bearer user-token", allowService=False),
|
|
]
|
|
assert isUser.call_args_list == [
|
|
call(principal, requireLogin=False),
|
|
call(principal, requireLogin=True),
|
|
]
|
|
|
|
|
|
def test_require_user_rejects_invalid_principal(monkeypatch, securityClient):
|
|
monkeypatch.setattr(
|
|
security.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=None),
|
|
)
|
|
monkeypatch.setattr(
|
|
security.auth,
|
|
"isUserPrincipal",
|
|
MagicMock(return_value=False),
|
|
)
|
|
|
|
response = securityClient.get("/user")
|
|
|
|
assert response.status_code == 401
|
|
assert response.get_json() == {"error": "unauthorized"}
|
|
|
|
|
|
def test_require_service_enforces_scope_and_sets_principal(
|
|
monkeypatch, securityClient
|
|
):
|
|
principal = _servicePrincipal("jobs:claim")
|
|
authenticate = MagicMock(side_effect=[principal, None])
|
|
hasScope = MagicMock(side_effect=[True, False])
|
|
monkeypatch.setattr(security.auth, "authenticateBearerToken", authenticate)
|
|
monkeypatch.setattr(security.auth, "hasServiceScope", hasScope)
|
|
|
|
accepted = securityClient.get("/service", headers=_bearer("service-key"))
|
|
rejected = securityClient.get("/service", headers=_bearer("wrong-key"))
|
|
|
|
assert accepted.status_code == 200
|
|
assert accepted.get_json() == {"service": "test-service"}
|
|
assert rejected.status_code == 401
|
|
assert rejected.get_json() == {"error": "unauthorized"}
|
|
assert authenticate.call_args_list == [
|
|
call(
|
|
"Bearer service-key",
|
|
requiredScopes=["jobs:claim"],
|
|
allowUser=False,
|
|
),
|
|
call(
|
|
"Bearer wrong-key",
|
|
requiredScopes=["jobs:claim"],
|
|
allowUser=False,
|
|
),
|
|
]
|
|
assert hasScope.call_args_list == [
|
|
call(principal, "jobs:claim"),
|
|
call(None, "jobs:claim"),
|
|
]
|
|
|
|
|
|
def test_registration_and_login_success_and_errors(monkeypatch, apiClient):
|
|
registerUser = MagicMock(
|
|
side_effect=[True, False, ValueError("invalid registration")]
|
|
)
|
|
getToken = MagicMock(side_effect=["login-token", False])
|
|
monkeypatch.setattr(apiMain.users, "registerUser", registerUser)
|
|
monkeypatch.setattr(apiMain.auth, "getLoginToken", getToken)
|
|
|
|
registered = apiClient.post(
|
|
"/api/register",
|
|
json={"username": "alice", "password": "password123", "timezone": "UTC"},
|
|
)
|
|
duplicate = apiClient.post(
|
|
"/api/register",
|
|
json={"username": "alice", "password": "password123"},
|
|
)
|
|
invalid = apiClient.post(
|
|
"/api/register",
|
|
json={"username": "", "password": "password123"},
|
|
)
|
|
invalidJson = apiClient.post("/api/register", json=["not", "an", "object"])
|
|
loggedIn = apiClient.post(
|
|
"/api/login",
|
|
json={"username": "alice", "password": "password123"},
|
|
)
|
|
denied = apiClient.post(
|
|
"/api/login",
|
|
json={"username": "alice", "password": "wrong-password"},
|
|
)
|
|
|
|
assert registered.status_code == 201
|
|
assert registered.get_json() == {"success": True}
|
|
assert duplicate.status_code == 409
|
|
assert duplicate.get_json() == {"error": "username taken"}
|
|
assert invalid.status_code == 400
|
|
assert invalid.get_json() == {"error": "invalid registration"}
|
|
assert invalidJson.status_code == 400
|
|
assert loggedIn.get_json() == {"token": "login-token"}
|
|
assert denied.status_code == 401
|
|
assert denied.get_json() == {"error": "invalid credentials"}
|
|
|
|
|
|
def test_discord_session_success_and_enrollment_errors(monkeypatch, apiClient):
|
|
principal = _servicePrincipal("discord:session")
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=principal),
|
|
)
|
|
getOrCreate = MagicMock(
|
|
side_effect=[ValueError("invalid Discord ID"), None, {"id": "user-1"}]
|
|
)
|
|
monkeypatch.setattr(apiMain.identity, "getOrCreateDiscordUser", getOrCreate)
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"createLoginToken",
|
|
MagicMock(return_value="discord-token"),
|
|
)
|
|
|
|
missing = apiClient.post(
|
|
"/api/auth/discord/session",
|
|
headers=_bearer("service-key"),
|
|
json={},
|
|
)
|
|
invalid = apiClient.post(
|
|
"/api/auth/discord/session",
|
|
headers=_bearer("service-key"),
|
|
json={"discord_id": "bad"},
|
|
)
|
|
denied = apiClient.post(
|
|
"/api/auth/discord/session",
|
|
headers=_bearer("service-key"),
|
|
json={"discord_id": "456"},
|
|
)
|
|
accepted = apiClient.post(
|
|
"/api/auth/discord/session",
|
|
headers=_bearer("service-key"),
|
|
json={"discord_id": "123", "display_name": "Alice"},
|
|
)
|
|
|
|
assert missing.status_code == 400
|
|
assert invalid.get_json() == {"error": "invalid Discord ID"}
|
|
assert denied.status_code == 403
|
|
assert accepted.status_code == 200
|
|
assert accepted.get_json() == {
|
|
"token": "discord-token",
|
|
"user_uuid": "user-1",
|
|
"timezone": "UTC",
|
|
}
|
|
apiMain.auth.createLoginToken.assert_called_once_with(
|
|
"user-1",
|
|
name="Alice",
|
|
extraClaims={"provider": "discord"},
|
|
)
|
|
|
|
|
|
def test_api_key_routes_use_authenticated_owner(monkeypatch, apiClient):
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=_userPrincipal()),
|
|
)
|
|
listKeys = MagicMock(return_value=[{"id": "key-1", "name": "CLI"}])
|
|
createKey = MagicMock(
|
|
side_effect=[
|
|
{"id": "key-2", "name": "new", "key": "secret"},
|
|
ValueError("invalid expiry"),
|
|
]
|
|
)
|
|
revokeKey = MagicMock(side_effect=[False, True])
|
|
monkeypatch.setattr(apiMain.apiKeys, "listUserApiKeys", listKeys)
|
|
monkeypatch.setattr(apiMain.apiKeys, "createUserApiKey", createKey)
|
|
monkeypatch.setattr(apiMain.apiKeys, "revokeUserApiKey", revokeKey)
|
|
|
|
listed = apiClient.get("/api/keys", headers=_bearer())
|
|
created = apiClient.post(
|
|
"/api/keys",
|
|
headers=_bearer(),
|
|
json={"name": "new", "expires_at": "2099-01-01T00:00:00Z"},
|
|
)
|
|
invalid = apiClient.post(
|
|
"/api/keys",
|
|
headers=_bearer(),
|
|
json={"name": "bad"},
|
|
)
|
|
missing = apiClient.delete("/api/keys/missing", headers=_bearer())
|
|
revoked = apiClient.delete("/api/keys/key-1", headers=_bearer())
|
|
|
|
assert listed.get_json() == {"keys": [{"id": "key-1", "name": "CLI"}]}
|
|
assert created.status_code == 201
|
|
assert created.get_json()["key"] == "secret"
|
|
assert invalid.status_code == 400
|
|
assert invalid.get_json() == {"error": "invalid expiry"}
|
|
assert missing.status_code == 404
|
|
assert revoked.get_json() == {"success": True}
|
|
listKeys.assert_called_once_with("user-1")
|
|
createKey.assert_has_calls(
|
|
[
|
|
call("user-1", "new", expiresAt="2099-01-01T00:00:00Z"),
|
|
call("user-1", "bad", expiresAt=None),
|
|
]
|
|
)
|
|
|
|
|
|
def test_user_profile_and_username_routes_enforce_ownership(monkeypatch, apiClient):
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=_userPrincipal()),
|
|
)
|
|
getUser = MagicMock(
|
|
side_effect=[
|
|
{
|
|
"id": "user-1",
|
|
"username": "alice",
|
|
"password_hashed": b"secret-hash",
|
|
},
|
|
None,
|
|
]
|
|
)
|
|
getUserUUID = MagicMock(side_effect=["user-1", "user-2", False])
|
|
monkeypatch.setattr(apiMain.users, "getUser", getUser)
|
|
monkeypatch.setattr(apiMain.users, "getUserUUID", getUserUUID)
|
|
|
|
foreign = apiClient.get("/api/user/user-2", headers=_bearer())
|
|
own = apiClient.get("/api/user/user-1", headers=_bearer())
|
|
missing = apiClient.get("/api/user/user-1", headers=_bearer())
|
|
username = apiClient.get("/api/getUserUUID/alice", headers=_bearer())
|
|
foreignUsername = apiClient.get("/api/getUserUUID/bob", headers=_bearer())
|
|
missingUsername = apiClient.get("/api/getUserUUID/missing", headers=_bearer())
|
|
|
|
assert foreign.status_code == 403
|
|
assert getUser.call_count == 2
|
|
assert own.status_code == 200
|
|
assert own.get_json() == {"id": "user-1", "username": "alice"}
|
|
assert missing.status_code == 404
|
|
assert username.get_json() == "user-1"
|
|
assert foreignUsername.status_code == 403
|
|
assert missingUsername.status_code == 404
|
|
|
|
|
|
def test_user_update_and_delete_success_and_errors(monkeypatch, apiClient):
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=_userPrincipal()),
|
|
)
|
|
updateUser = MagicMock(side_effect=[ValueError("bad timezone"), False, True])
|
|
unregisterUser = MagicMock(side_effect=[False, True])
|
|
monkeypatch.setattr(apiMain.users, "updateUser", updateUser)
|
|
monkeypatch.setattr(apiMain.auth, "unregisterUser", unregisterUser)
|
|
|
|
assert apiClient.put(
|
|
"/api/user/user-2", headers=_bearer(), json={"timezone": "UTC"}
|
|
).status_code == 403
|
|
assert apiClient.put(
|
|
"/api/user/user-1", headers=_bearer(), json=[]
|
|
).status_code == 400
|
|
invalid = apiClient.put(
|
|
"/api/user/user-1", headers=_bearer(), json={"timezone": "Invalid"}
|
|
)
|
|
empty = apiClient.put(
|
|
"/api/user/user-1", headers=_bearer(), json={"username": "ignored"}
|
|
)
|
|
updated = apiClient.put(
|
|
"/api/user/user-1", headers=_bearer(), json={"timezone": "UTC"}
|
|
)
|
|
missingPassword = apiClient.delete(
|
|
"/api/user/user-1", headers=_bearer(), json={}
|
|
)
|
|
wrongPassword = apiClient.delete(
|
|
"/api/user/user-1", headers=_bearer(), json={"password": "wrong"}
|
|
)
|
|
deleted = apiClient.delete(
|
|
"/api/user/user-1", headers=_bearer(), json={"password": "correct"}
|
|
)
|
|
|
|
assert invalid.get_json() == {"error": "bad timezone"}
|
|
assert empty.get_json() == {"error": "no valid fields to update"}
|
|
assert updated.get_json() == {"success": True}
|
|
assert missingPassword.status_code == 400
|
|
assert wrongPassword.status_code == 401
|
|
assert deleted.get_json() == {"success": True}
|
|
|
|
|
|
def test_timezone_routes_read_validate_and_update(monkeypatch, apiClient):
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=_userPrincipal()),
|
|
)
|
|
normalize = MagicMock(
|
|
side_effect=["America/Chicago", ValueError("invalid timezone")]
|
|
)
|
|
updateUser = MagicMock(return_value=True)
|
|
monkeypatch.setattr(
|
|
apiMain.users,
|
|
"getUserTimezone",
|
|
MagicMock(return_value="UTC"),
|
|
)
|
|
monkeypatch.setattr(apiMain.users, "normalizeTimezone", normalize)
|
|
monkeypatch.setattr(apiMain.users, "updateUser", updateUser)
|
|
|
|
current = apiClient.get("/api/user/me/timezone", headers=_bearer())
|
|
updated = apiClient.put(
|
|
"/api/user/me/timezone",
|
|
headers=_bearer(),
|
|
json={"timezone": "America/Chicago"},
|
|
)
|
|
invalid = apiClient.put(
|
|
"/api/user/me/timezone",
|
|
headers=_bearer(),
|
|
json={"timezone": "Invalid"},
|
|
)
|
|
|
|
assert current.get_json() == {"timezone": "UTC"}
|
|
assert updated.get_json() == {"timezone": "America/Chicago"}
|
|
assert invalid.status_code == 400
|
|
assert invalid.get_json() == {"error": "invalid timezone"}
|
|
updateUser.assert_called_once_with(
|
|
"user-1",
|
|
{"timezone": "America/Chicago"},
|
|
)
|
|
|
|
|
|
def test_outbox_claim_filters_missing_discord_identities(monkeypatch, apiClient):
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=_servicePrincipal("outbox:claim")),
|
|
)
|
|
claimMessages = MagicMock(
|
|
side_effect=[
|
|
ValueError("invalid limit"),
|
|
[
|
|
{
|
|
"id": "message-1",
|
|
"user_uuid": "user-1",
|
|
"payload": {"content": "hello"},
|
|
"attempts": 1,
|
|
},
|
|
{
|
|
"id": "message-2",
|
|
"user_uuid": "user-2",
|
|
"payload": {},
|
|
"attempts": 2,
|
|
},
|
|
],
|
|
]
|
|
)
|
|
identities = MagicMock(
|
|
side_effect=[
|
|
[{"provider": "discord", "provider_user_id": "discord-1"}],
|
|
[],
|
|
]
|
|
)
|
|
retryMessage = MagicMock()
|
|
monkeypatch.setattr(apiMain.outbox, "claim_messages", claimMessages)
|
|
monkeypatch.setattr(apiMain.identity, "listUserIdentities", identities)
|
|
monkeypatch.setattr(apiMain.outbox, "retry_message", retryMessage)
|
|
|
|
missingWorker = apiClient.post(
|
|
"/api/internal/outbox/claim",
|
|
headers=_bearer(),
|
|
json={},
|
|
)
|
|
invalid = apiClient.post(
|
|
"/api/internal/outbox/claim",
|
|
headers=_bearer(),
|
|
json={"worker_id": "worker-1", "limit": 0},
|
|
)
|
|
claimed = apiClient.post(
|
|
"/api/internal/outbox/claim",
|
|
headers=_bearer(),
|
|
json={"worker_id": "worker-1", "channel": "discord_dm", "limit": 2},
|
|
)
|
|
|
|
assert missingWorker.status_code == 400
|
|
assert invalid.get_json() == {"error": "invalid limit"}
|
|
assert claimed.get_json() == {
|
|
"messages": [
|
|
{
|
|
"id": "message-1",
|
|
"provider_user_id": "discord-1",
|
|
"content": "hello",
|
|
"attempts": 1,
|
|
"worker_id": "worker-1",
|
|
}
|
|
]
|
|
}
|
|
retryMessage.assert_called_once_with(
|
|
"message-2",
|
|
"worker-1",
|
|
"user has no Discord identity",
|
|
)
|
|
|
|
|
|
def test_outbox_result_enforces_lease_owner_and_records_results(
|
|
monkeypatch, apiClient
|
|
):
|
|
monkeypatch.setattr(
|
|
apiMain.auth,
|
|
"authenticateBearerToken",
|
|
MagicMock(return_value=_servicePrincipal("outbox:deliver")),
|
|
)
|
|
leased = {"id": "message-1", "status": "delivering", "leased_by": "worker-1"}
|
|
getMessage = MagicMock(side_effect=[None, leased, leased, leased])
|
|
deliveredRecord = {"id": "message-1", "status": "delivered"}
|
|
retryRecord = {"id": "message-1", "status": "pending"}
|
|
markDelivered = MagicMock(return_value=deliveredRecord)
|
|
retryMessage = MagicMock(return_value=retryRecord)
|
|
monkeypatch.setattr(apiMain.outbox, "get_message", getMessage)
|
|
monkeypatch.setattr(apiMain.outbox, "mark_delivered", markDelivered)
|
|
monkeypatch.setattr(apiMain.outbox, "retry_message", retryMessage)
|
|
|
|
invalid = apiClient.post(
|
|
"/api/internal/outbox/message-1/result",
|
|
headers=_bearer(),
|
|
json={"status": "unknown"},
|
|
)
|
|
missing = apiClient.post(
|
|
"/api/internal/outbox/message-1/result",
|
|
headers=_bearer(),
|
|
json={"status": "sent", "worker_id": "worker-1"},
|
|
)
|
|
wrongWorker = apiClient.post(
|
|
"/api/internal/outbox/message-1/result",
|
|
headers=_bearer(),
|
|
json={"status": "sent", "worker_id": "worker-2"},
|
|
)
|
|
delivered = apiClient.post(
|
|
"/api/internal/outbox/message-1/result",
|
|
headers=_bearer(),
|
|
json={
|
|
"status": "sent",
|
|
"worker_id": "worker-1",
|
|
"external_message_id": "x" * 300,
|
|
},
|
|
)
|
|
retried = apiClient.post(
|
|
"/api/internal/outbox/message-1/result",
|
|
headers=_bearer(),
|
|
json={
|
|
"status": "retry",
|
|
"worker_id": "worker-1",
|
|
"error": "temporary failure",
|
|
},
|
|
)
|
|
|
|
assert invalid.status_code == 400
|
|
assert missing.status_code == 404
|
|
assert wrongWorker.status_code == 409
|
|
assert delivered.get_json()["message"] == deliveredRecord
|
|
assert retried.get_json()["message"] == retryRecord
|
|
markDelivered.assert_called_once_with(
|
|
"message-1",
|
|
"worker-1",
|
|
external_message_id="x" * 255,
|
|
)
|
|
retryMessage.assert_called_once_with(
|
|
"message-1",
|
|
"worker-1",
|
|
"temporary failure",
|
|
)
|
|
|
|
|
|
def test_health_and_standard_error_responses(monkeypatch, apiClient):
|
|
execute = MagicMock(side_effect=[[{"ready": 1}], RuntimeError("offline")])
|
|
monkeypatch.setattr(apiMain.postgres, "execute", execute)
|
|
|
|
live = apiClient.get("/health/live")
|
|
ready = apiClient.get("/health/ready")
|
|
unavailable = apiClient.get("/health")
|
|
missing = apiClient.get("/missing")
|
|
wrongMethod = apiClient.get("/api/register")
|
|
|
|
assert live.get_json() == {"status": "ok"}
|
|
assert ready.get_json() == {"status": "ready"}
|
|
assert unavailable.status_code == 503
|
|
assert unavailable.get_json() == {"status": "not ready"}
|
|
assert missing.status_code == 404
|
|
assert missing.get_json() == {"error": "not found"}
|
|
assert wrongMethod.status_code == 405
|
|
assert wrongMethod.get_json() == {"error": "method not allowed"}
|