File size: 1,600 Bytes
a7da499 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 | """Tests for auth middleware — get_current_user dependency."""
import time
import hashlib
import pytest
from httpx import AsyncClient, ASGITransport
from app.main import create_app
def _make_token(email: str) -> str:
"""Mirror the backend token generation for test fixtures."""
secret = "aperture-mvp-secret-change-in-production"
hour = int(time.time() // 3600)
payload = f"{email}:{hour}:{secret}"
return hashlib.sha256(payload.encode()).hexdigest()[:32]
@pytest.fixture
async def client(tmp_path):
app = create_app(db_path=str(tmp_path / "test.db"), run_worker=False)
transport = ASGITransport(app=app)
async with AsyncClient(transport=transport, base_url="http://test") as c:
yield c
@pytest.mark.asyncio
async def test_auth_header_valid(client):
email = "user@example.com"
token = _make_token(email)
resp = await client.get(
"/api/jobs",
headers={"Authorization": f"Bearer {email}:{token}"},
)
assert resp.status_code == 200
@pytest.mark.asyncio
async def test_auth_header_missing(client):
resp = await client.get("/api/jobs")
assert resp.status_code == 401
@pytest.mark.asyncio
async def test_auth_header_bad_token(client):
resp = await client.get(
"/api/jobs",
headers={"Authorization": "Bearer user@example.com:badtoken"},
)
assert resp.status_code == 401
@pytest.mark.asyncio
async def test_auth_header_malformed(client):
resp = await client.get(
"/api/jobs",
headers={"Authorization": "Bearer garbage"},
)
assert resp.status_code == 401
|