81 lines
2.4 KiB
Python
81 lines
2.4 KiB
Python
|
"""Auth endpoint and session tests."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from auth import AUTH_HEADER, get_session
|
||
|
|
from tests.factories import provision_user_in_tenant
|
||
|
|
|
||
|
|
|
||
|
|
def test_login_logout_and_session(client):
|
||
|
|
user = provision_user_in_tenant()
|
||
|
|
|
||
|
|
login = client.post(
|
||
|
|
"/api/auth/login",
|
||
|
|
json={"email": user["email"], "password": user["password"]},
|
||
|
|
)
|
||
|
|
assert login.status_code == 200
|
||
|
|
payload = login.json()
|
||
|
|
assert "token" in payload
|
||
|
|
assert payload["user"]["email"] == user["email"]
|
||
|
|
token = payload["token"]
|
||
|
|
|
||
|
|
me = client.get("/api/me", headers={AUTH_HEADER: token})
|
||
|
|
assert me.status_code == 200
|
||
|
|
assert me.json()["email"] == user["email"]
|
||
|
|
assert me.json()["active_tenant_id"] == user["tenant_id"]
|
||
|
|
|
||
|
|
logout = client.post("/api/auth/logout", headers={AUTH_HEADER: token})
|
||
|
|
assert logout.status_code == 200
|
||
|
|
assert get_session(token) is None
|
||
|
|
|
||
|
|
me_after = client.get("/api/me", headers={AUTH_HEADER: token})
|
||
|
|
assert me_after.status_code == 401
|
||
|
|
|
||
|
|
|
||
|
|
def test_login_invalid_password(client):
|
||
|
|
user = provision_user_in_tenant()
|
||
|
|
response = client.post(
|
||
|
|
"/api/auth/login",
|
||
|
|
json={"email": user["email"], "password": "wrong-password"},
|
||
|
|
)
|
||
|
|
assert response.status_code == 401
|
||
|
|
|
||
|
|
|
||
|
|
def test_me_requires_auth(client):
|
||
|
|
assert client.get("/api/me").status_code == 401
|
||
|
|
|
||
|
|
|
||
|
|
def test_me_context_returns_tenant_and_actor(client):
|
||
|
|
user = provision_user_in_tenant(tenant_role="admin")
|
||
|
|
login = client.post(
|
||
|
|
"/api/auth/login",
|
||
|
|
json={"email": user["email"], "password": user["password"]},
|
||
|
|
)
|
||
|
|
token = login.json()["token"]
|
||
|
|
|
||
|
|
ctx = client.get("/api/me/context", headers={AUTH_HEADER: token})
|
||
|
|
assert ctx.status_code == 200
|
||
|
|
body = ctx.json()
|
||
|
|
assert body["tenant"]["id"] == user["tenant_id"]
|
||
|
|
assert body["tenant"]["role"] == "admin"
|
||
|
|
assert body["actor"]["id"] == user["actor_id"]
|
||
|
|
assert body["actor"]["type"] == "human"
|
||
|
|
|
||
|
|
|
||
|
|
def test_tenant_switch_rejects_invalid_membership(client):
|
||
|
|
user = provision_user_in_tenant()
|
||
|
|
other = provision_user_in_tenant()
|
||
|
|
|
||
|
|
login = client.post(
|
||
|
|
"/api/auth/login",
|
||
|
|
json={"email": user["email"], "password": user["password"]},
|
||
|
|
)
|
||
|
|
token = login.json()["token"]
|
||
|
|
|
||
|
|
switch = client.post(
|
||
|
|
"/api/me/tenant",
|
||
|
|
headers={AUTH_HEADER: token},
|
||
|
|
json={"tenant_id": other["tenant_id"]},
|
||
|
|
)
|
||
|
|
assert switch.status_code == 403
|