93 lines
3.0 KiB
Python
93 lines
3.0 KiB
Python
"""
|
|
Copyright 2024-2026 ReplyPier
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
"""
|
|
|
|
import pytest
|
|
from uuid import uuid4
|
|
|
|
from app.core.security import create_access_token, verify_token
|
|
from app.models.auth_session import AuthSession
|
|
from app.models.user import User
|
|
from app.services.auth_sessions import (
|
|
ACCESS,
|
|
REFRESH,
|
|
issue_tokens,
|
|
live_payload,
|
|
revoke_user_sessions,
|
|
)
|
|
|
|
|
|
def _user(db, org, email):
|
|
user = User(
|
|
id=uuid4(),
|
|
email=email,
|
|
hashed_password="x",
|
|
is_active=True,
|
|
organization_id=org.id,
|
|
)
|
|
db.add(user)
|
|
db.commit()
|
|
return user
|
|
|
|
|
|
@pytest.fixture
|
|
def user(db, test_organization):
|
|
return _user(db, test_organization, "one@test.com")
|
|
|
|
|
|
def test_live_payload_checks_the_token_type(db, user):
|
|
access, refresh = issue_tokens(db, user.id, user.organization_id)
|
|
db.commit()
|
|
|
|
assert live_payload(db, access, ACCESS)["sub"] == str(user.id)
|
|
assert live_payload(db, refresh, REFRESH)["sub"] == str(user.id)
|
|
assert live_payload(db, access, REFRESH) is None
|
|
assert live_payload(db, refresh, ACCESS) is None
|
|
|
|
|
|
def test_live_payload_rejects_a_session_of_another_user(db, user, test_organization):
|
|
"""A sid is only good for the user it was opened for"""
|
|
other = _user(db, test_organization, "two@test.com")
|
|
access, _ = issue_tokens(db, other.id, other.organization_id)
|
|
db.commit()
|
|
sid = verify_token(access)["sid"]
|
|
|
|
forged = create_access_token({"sub": str(user.id), "org": str(user.organization_id), "sid": sid})
|
|
|
|
assert live_payload(db, forged, ACCESS) is None
|
|
|
|
|
|
@pytest.mark.parametrize("sid", [str(uuid4()), "not-a-uuid"])
|
|
def test_live_payload_rejects_an_unknown_session(db, user, sid):
|
|
token = create_access_token({"sub": str(user.id), "org": str(user.organization_id), "sid": sid})
|
|
|
|
assert live_payload(db, token, ACCESS) is None
|
|
|
|
|
|
def test_revoke_user_sessions_can_keep_one(db, user, test_organization):
|
|
other = _user(db, test_organization, "two@test.com")
|
|
keep, _ = issue_tokens(db, user.id, user.organization_id)
|
|
drop, _ = issue_tokens(db, user.id, user.organization_id)
|
|
bystander, _ = issue_tokens(db, other.id, other.organization_id)
|
|
db.commit()
|
|
|
|
revoke_user_sessions(db, user.id, keep_sid=verify_token(keep)["sid"])
|
|
db.commit()
|
|
|
|
assert live_payload(db, keep, ACCESS) is not None
|
|
assert live_payload(db, drop, ACCESS) is None
|
|
assert live_payload(db, bystander, ACCESS) is not None
|
|
assert db.query(AuthSession).filter(AuthSession.revoked_at.isnot(None)).count() == 1
|