mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-04-25 19:28:23 +00:00
03c3b18565
Port RFC-001 authentication core from PR #1728: - JWT token handling (create_access_token, decode_token, TokenPayload) - Password hashing (bcrypt) with verify_password - SQLite UserRepository with base interface - Provider Factory pattern (LocalAuthProvider) - CLI reset_admin tool - Auth-specific errors (AuthErrorCode, TokenError, AuthErrorResponse) Deps: - bcrypt>=4.0.0 - pyjwt>=2.9.0 - email-validator>=2.0.0 - backend/uv.toml pins public PyPI index Tests: 12 pure unit tests (test_auth_config.py, test_auth_errors.py). Scope note: authz.py, test_auth.py, and test_auth_type_system.py are deferred to commit 2 because they depend on middleware and deps wiring that is not yet in place. Commit 1 stays "pure new files only" as the spec mandates.
76 lines
2.5 KiB
Python
76 lines
2.5 KiB
Python
"""Tests for auth error types and typed decode_token."""
|
|
|
|
from datetime import UTC, datetime, timedelta
|
|
|
|
import jwt as pyjwt
|
|
|
|
from app.gateway.auth.config import AuthConfig, set_auth_config
|
|
from app.gateway.auth.errors import AuthErrorCode, AuthErrorResponse, TokenError
|
|
from app.gateway.auth.jwt import create_access_token, decode_token
|
|
|
|
|
|
def test_auth_error_code_values():
|
|
assert AuthErrorCode.INVALID_CREDENTIALS == "invalid_credentials"
|
|
assert AuthErrorCode.TOKEN_EXPIRED == "token_expired"
|
|
assert AuthErrorCode.NOT_AUTHENTICATED == "not_authenticated"
|
|
|
|
|
|
def test_token_error_values():
|
|
assert TokenError.EXPIRED == "expired"
|
|
assert TokenError.INVALID_SIGNATURE == "invalid_signature"
|
|
assert TokenError.MALFORMED == "malformed"
|
|
|
|
|
|
def test_auth_error_response_serialization():
|
|
err = AuthErrorResponse(
|
|
code=AuthErrorCode.TOKEN_EXPIRED,
|
|
message="Token has expired",
|
|
)
|
|
d = err.model_dump()
|
|
assert d == {"code": "token_expired", "message": "Token has expired"}
|
|
|
|
|
|
def test_auth_error_response_from_dict():
|
|
d = {"code": "invalid_credentials", "message": "Wrong password"}
|
|
err = AuthErrorResponse(**d)
|
|
assert err.code == AuthErrorCode.INVALID_CREDENTIALS
|
|
|
|
|
|
# ── decode_token typed failure tests ──────────────────────────────
|
|
|
|
_TEST_SECRET = "test-secret-for-jwt-decode-token-tests"
|
|
|
|
|
|
def _setup_config():
|
|
set_auth_config(AuthConfig(jwt_secret=_TEST_SECRET))
|
|
|
|
|
|
def test_decode_token_returns_token_error_on_expired():
|
|
_setup_config()
|
|
expired_payload = {"sub": "user-1", "exp": datetime.now(UTC) - timedelta(hours=1), "iat": datetime.now(UTC)}
|
|
token = pyjwt.encode(expired_payload, _TEST_SECRET, algorithm="HS256")
|
|
result = decode_token(token)
|
|
assert result == TokenError.EXPIRED
|
|
|
|
|
|
def test_decode_token_returns_token_error_on_bad_signature():
|
|
_setup_config()
|
|
payload = {"sub": "user-1", "exp": datetime.now(UTC) + timedelta(hours=1), "iat": datetime.now(UTC)}
|
|
token = pyjwt.encode(payload, "wrong-secret", algorithm="HS256")
|
|
result = decode_token(token)
|
|
assert result == TokenError.INVALID_SIGNATURE
|
|
|
|
|
|
def test_decode_token_returns_token_error_on_malformed():
|
|
_setup_config()
|
|
result = decode_token("not-a-jwt")
|
|
assert result == TokenError.MALFORMED
|
|
|
|
|
|
def test_decode_token_returns_payload_on_valid():
|
|
_setup_config()
|
|
token = create_access_token("user-123")
|
|
result = decode_token(token)
|
|
assert not isinstance(result, TokenError)
|
|
assert result.sub == "user-123"
|