File size: 2,315 Bytes
95f8c4b | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 | from fastapi import Depends, FastAPI
from fastapi.testclient import TestClient
from aistudio_api.api.dependencies import require_api_key
from aistudio_api.config import settings
def _build_client() -> TestClient:
app = FastAPI()
@app.get("/protected", dependencies=[Depends(require_api_key)])
async def protected():
return {"ok": True}
return TestClient(app)
def test_auth_is_disabled_when_no_api_key_is_configured(monkeypatch):
monkeypatch.setattr(settings, "api_keys", frozenset())
client = _build_client()
response = client.get("/protected")
assert response.status_code == 200
assert response.json() == {"ok": True}
def test_bearer_token_is_accepted(monkeypatch):
monkeypatch.setattr(settings, "api_keys", frozenset({"secret-token"}))
client = _build_client()
response = client.get("/protected", headers={"Authorization": "Bearer secret-token"})
assert response.status_code == 200
assert response.json() == {"ok": True}
def test_x_api_key_is_accepted(monkeypatch):
monkeypatch.setattr(settings, "api_keys", frozenset({"secret-token"}))
client = _build_client()
response = client.get("/protected", headers={"X-API-Key": "secret-token"})
assert response.status_code == 200
assert response.json() == {"ok": True}
def test_x_goog_api_key_is_accepted(monkeypatch):
monkeypatch.setattr(settings, "api_keys", frozenset({"secret-token"}))
client = _build_client()
response = client.get("/protected", headers={"x-goog-api-key": "secret-token"})
assert response.status_code == 200
assert response.json() == {"ok": True}
def test_query_param_key_is_accepted(monkeypatch):
monkeypatch.setattr(settings, "api_keys", frozenset({"secret-token"}))
client = _build_client()
response = client.get("/protected?key=secret-token")
assert response.status_code == 200
assert response.json() == {"ok": True}
def test_missing_or_invalid_api_key_returns_401(monkeypatch):
monkeypatch.setattr(settings, "api_keys", frozenset({"secret-token"}))
client = _build_client()
response = client.get("/protected")
assert response.status_code == 401
assert response.headers["www-authenticate"] == "Bearer"
assert response.json()["detail"]["type"] == "authentication_error"
|