Spaces:
Paused
Paused
| """Pure unit tests for security primitives (no DB needed).""" | |
| from __future__ import annotations | |
| import hashlib | |
| from datetime import datetime, timedelta, timezone | |
| import jwt | |
| import pytest | |
| from app.core.crypto import decrypt, encrypt | |
| from app.core.security import ( | |
| create_access_token, | |
| create_refresh_token, | |
| decode_token, | |
| device_fingerprint, | |
| hash_csrf, | |
| hash_password, | |
| new_csrf_token, | |
| verify_password, | |
| ) | |
| # ---- Password Hashing ---- | |
| class TestPasswordHash: | |
| def test_bcrypt_starts_with_2b(self): | |
| h = hash_password("hello-world") | |
| assert h.startswith("$2b$") | |
| def test_salts_are_unique(self): | |
| h1 = hash_password("same") | |
| h2 = hash_password("same") | |
| assert h1 != h2 | |
| assert verify_password("same", h1) | |
| assert verify_password("same", h2) | |
| def test_wrong_password_rejected(self): | |
| h = hash_password("correct") | |
| assert not verify_password("wrong", h) | |
| def test_verify_graceful_on_bad_hash(self): | |
| assert not verify_password("x", "not-a-valid-hash") | |
| # ---- JWT ---- | |
| class TestJWT: | |
| def test_access_token_structure(self): | |
| token = create_access_token(sub="abc123", role="user") | |
| payload = decode_token(token) | |
| assert payload["sub"] == "abc123" | |
| assert payload["role"] == "user" | |
| assert payload["type"] == "access" | |
| assert "jti" in payload | |
| assert "iat" in payload | |
| assert "exp" in payload | |
| def test_access_ttl(self): | |
| token = create_access_token(sub="x", role="admin") | |
| payload = decode_token(token) | |
| exp = datetime.fromtimestamp(payload["exp"], tz=timezone.utc) | |
| expected = datetime.now(tz=timezone.utc) + timedelta(minutes=30) | |
| assert abs((exp - expected).total_seconds()) < 10 | |
| def test_session_id_in_access(self): | |
| token = create_access_token(sub="x", role="user", session_id="sess1") | |
| payload = decode_token(token) | |
| assert payload["sid"] == "sess1" | |
| def test_refresh_token_has_sid_and_type(self): | |
| token, exp = create_refresh_token(sub="x", session_id="sess1") | |
| payload = decode_token(token) | |
| assert payload["type"] == "refresh" | |
| assert payload["sid"] == "sess1" | |
| assert payload["sub"] == "x" | |
| def test_refresh_ttl_14_days(self): | |
| token, exp = create_refresh_token(sub="x", session_id="s") | |
| now = datetime.now(tz=timezone.utc) | |
| expected = now + timedelta(days=14) | |
| assert abs((exp - expected).total_seconds()) < 10 | |
| def test_jti_uniqueness(self): | |
| jtis = {decode_token(create_access_token(sub="x", role="user"))["jti"] for _ in range(10)} | |
| assert len(jtis) == 10 | |
| def test_expired_token_raises(self): | |
| expired = jwt.encode( | |
| {"sub": "x", "exp": 0, "iat": 0, "type": "access", "jti": "dead"}, | |
| "test-jwt-secret-for-testing-only", | |
| algorithm="HS256", | |
| ) | |
| with pytest.raises(jwt.ExpiredSignatureError): | |
| decode_token(expired) | |
| def test_invalid_signature_rejected(self): | |
| tampered = jwt.encode( | |
| {"sub": "x", "exp": 9999999999, "iat": 0, "type": "access", "jti": "bad"}, | |
| "different-secret", | |
| algorithm="HS256", | |
| ) | |
| with pytest.raises(jwt.InvalidTokenError): | |
| decode_token(tampered) | |
| # ---- CSRF ---- | |
| class TestCSRF: | |
| def test_new_token_length(self): | |
| t = new_csrf_token() | |
| assert len(t) == 43 | |
| def test_hash_consistency(self): | |
| t = "test-token" | |
| assert hash_csrf(t) == hash_csrf(t) | |
| assert len(hash_csrf(t)) == 64 | |
| def test_different_inputs_different_outputs(self): | |
| assert hash_csrf("a") != hash_csrf("b") | |
| # ---- Device Fingerprint ---- | |
| class TestDeviceFingerprint: | |
| def test_length_and_hex(self): | |
| fp = device_fingerprint("UA", "1.2.3.4") | |
| assert len(fp) == 32 | |
| int(fp, 16) | |
| def test_deterministic(self): | |
| assert device_fingerprint("A", "B") == device_fingerprint("A", "B") | |
| def test_different_ua_different_fp(self): | |
| assert device_fingerprint("A", "1") != device_fingerprint("B", "1") | |
| def test_different_ip_different_fp(self): | |
| assert device_fingerprint("A", "1") != device_fingerprint("A", "2") | |
| # ---- Fernet Encryption ---- | |
| class TestEncryption: | |
| def test_roundtrip(self): | |
| original = "sk-proj-test-key-12345" | |
| encrypted = encrypt(original) | |
| assert encrypted != original | |
| assert encrypted.startswith("gAAAAA") | |
| assert decrypt(encrypted) == original | |
| def test_empty_returns_empty(self): | |
| assert encrypt("") == "" | |
| assert decrypt("") == "" | |
| def test_bad_ciphertext_returns_empty(self): | |
| assert decrypt("invalid-data") == "" | |
| def test_different_keys_different_ciphertexts(self): | |
| """Same plaintext should produce different ciphertexts (Fernet includes IV).""" | |
| pt = "same-value" | |
| c1 = encrypt(pt) | |
| c2 = encrypt(pt) | |
| assert c1 != c2 | |
| assert decrypt(c1) == pt | |
| assert decrypt(c2) == pt | |