Extract dashboard auth boundary; docs

finbot/dashboard.py

@@ -257,6 +257,22 @@ again for a fresh one.
 """
 
 
+def authenticate(services: Optional[Any], token: str) -> Optional[int]:
+    """Resolve a dashboard token to a user id, or None.
+
+    The security boundary for the whole web view: everything the page renders
+    hangs off the id this returns, so it is deliberately a plain function that
+    can be tested directly rather than logic buried in a UI callback.
+    """
+    if services is None or not token:
+        return None
+    try:
+        return verify(token, services.settings.telegram_webhook_secret).user_id
+    except TokenError as exc:
+        log.info("Rejected dashboard token: %s", exc)
+        return None
+
+
 def build_ui(
     get_services: Callable[[], Optional[Any]],
     gpu_probe: Optional[Callable[..., str]] = None,
@@ -268,17 +284,8 @@ def build_ui(
     """
 
     def _authenticate(request: gr.Request) -> Optional[int]:
-        services = get_services()
-        if services is None:
-            return None
         token = (request.query_params or {}).get("t", "")
-        if not token:
-            return None
-        try:
-            return verify(token, services.settings.telegram_webhook_secret).user_id
-        except TokenError as exc:
-            log.info("Rejected dashboard token: %s", exc)
-            return None
+        return authenticate(get_services(), token)
 
     def on_load(request: gr.Request):
         user_id = _authenticate(request)

tests/test_dashboard.py

@@ -6,6 +6,7 @@ import pytest
 from finbot.analytics import today_in
 from finbot.config import Settings
 from finbot.dashboard import (
+    authenticate,
     category_frame,
     coach_reply,
     load_dashboard,
@@ -223,6 +224,50 @@ class TestRendering:
         assert "Netflix" in render_recurring(load_dashboard(services, 1))
 
 
+class TestAuthenticate:
+    """The gate on the whole web view. Everything else trusts its answer."""
+
+    def test_valid_token(self, services):
+        from finbot.auth import issue
+
+        token = issue(1, services.settings.telegram_webhook_secret)
+        assert authenticate(services, token) == 1
+
+    def test_no_token(self, services):
+        assert authenticate(services, "") is None
+
+    def test_garbage_token(self, services):
+        assert authenticate(services, "not-a-token") is None
+
+    def test_token_signed_with_another_secret(self, services):
+        from finbot.auth import issue
+
+        assert authenticate(services, issue(1, "someone-elses-secret")) is None
+
+    def test_expired_token(self, services):
+        import time
+
+        from finbot.auth import issue
+
+        stale = issue(
+            1,
+            services.settings.telegram_webhook_secret,
+            ttl_seconds=1,
+            now=int(time.time()) - 60,
+        )
+        assert authenticate(services, stale) is None
+
+    def test_no_services_yet(self):
+        # Before the runtime exists the page must not authenticate anyone.
+        assert authenticate(None, "anything") is None
+
+    def test_token_identifies_the_right_user(self, services):
+        from finbot.auth import issue
+
+        token = issue(4242, services.settings.telegram_webhook_secret)
+        assert authenticate(services, token) == 4242
+
+
 class TestCoach:
     def test_passes_the_question_through(self, services):
         add(services.store, 25000)