74 lines
2.1 KiB
Python
74 lines
2.1 KiB
Python
import pytest
|
|
from fastapi import HTTPException
|
|
|
|
from app.auth import keycloak_dependencies
|
|
from app.auth.keycloak_dependencies import (
|
|
_decode_keycloak_token,
|
|
get_current_keycloak_username,
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def anyio_backend():
|
|
return "asyncio"
|
|
|
|
|
|
@pytest.mark.anyio
|
|
async def test_current_username_uses_preferred_username_only():
|
|
username = await get_current_keycloak_username(
|
|
{
|
|
"preferred_username": "tjwater",
|
|
"username": "legacy-name",
|
|
}
|
|
)
|
|
|
|
assert username == "tjwater"
|
|
|
|
|
|
@pytest.mark.anyio
|
|
async def test_current_username_rejects_username_fallback():
|
|
with pytest.raises(HTTPException) as exc:
|
|
await get_current_keycloak_username({"username": "legacy-name"})
|
|
|
|
assert exc.value.status_code == 401
|
|
assert exc.value.detail == "Missing preferred_username claim"
|
|
|
|
|
|
def test_decode_keycloak_token_rejects_a_token_older_than_the_configured_limit(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
):
|
|
monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_PUBLIC_KEY", "public-key")
|
|
monkeypatch.setattr(
|
|
keycloak_dependencies.settings,
|
|
"KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS",
|
|
900,
|
|
)
|
|
monkeypatch.setattr(keycloak_dependencies.time, "time", lambda: 2_000)
|
|
monkeypatch.setattr(
|
|
keycloak_dependencies.jwt,
|
|
"decode",
|
|
lambda *args, **kwargs: {"iat": 1_000},
|
|
)
|
|
|
|
with pytest.raises(keycloak_dependencies.JWTError):
|
|
_decode_keycloak_token("expired-by-policy")
|
|
|
|
|
|
def test_decode_keycloak_token_accepts_a_recent_token(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
):
|
|
monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_PUBLIC_KEY", "public-key")
|
|
monkeypatch.setattr(
|
|
keycloak_dependencies.settings,
|
|
"KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS",
|
|
900,
|
|
)
|
|
monkeypatch.setattr(keycloak_dependencies.time, "time", lambda: 1_500)
|
|
monkeypatch.setattr(
|
|
keycloak_dependencies.jwt,
|
|
"decode",
|
|
lambda *args, **kwargs: {"iat": 1_000, "sub": "subject"},
|
|
)
|
|
|
|
assert _decode_keycloak_token("recent") == {"iat": 1_000, "sub": "subject"}
|