replypier/backend/tests/services/test_shopify_session.py

"""
Copyright 2024-2026 ReplyPier

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
"""

import pytest
import jwt
import time
import uuid
from unittest.mock import MagicMock, patch, AsyncMock
from fastapi import HTTPException, Request
from sqlalchemy.orm import Session

from app.services.shopify_session import (
    ShopifySessionService,
    require_shopify_session,
    require_shopify_or_jwt_auth
)


class TestShopifySessionService:
    """Test cases for ShopifySessionService"""

    def test_get_session_token_from_request_authorization_header(self):
        """Test extracting session token from Authorization header"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {"authorization": "Bearer test_token_123"}
        mock_request.query_params = {}
        
        # Act
        token = ShopifySessionService.get_session_token_from_request(mock_request)
        
        # Assert
        assert token == "test_token_123"

    def test_get_session_token_from_request_query_param(self):
        """Test extracting session token from URL query parameter"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {}
        mock_request.query_params = {"id_token": "query_token_456"}
        
        # Act
        token = ShopifySessionService.get_session_token_from_request(mock_request)
        
        # Assert
        assert token == "query_token_456"

    def test_get_session_token_from_request_authorization_header_priority(self):
        """Test that Authorization header takes priority over query param"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {"authorization": "Bearer header_token"}
        mock_request.query_params = {"id_token": "query_token"}
        
        # Act
        token = ShopifySessionService.get_session_token_from_request(mock_request)
        
        # Assert
        assert token == "header_token"

    def test_get_session_token_from_request_no_token(self):
        """Test when no token is present"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {}
        mock_request.query_params = {}
        
        # Act
        token = ShopifySessionService.get_session_token_from_request(mock_request)
        
        # Assert
        assert token is None

    def test_get_session_token_from_request_empty_bearer(self):
        """Test when Authorization header has empty Bearer token"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {"authorization": "Bearer "}
        mock_request.query_params = {"id_token": "fallback_token"}
        
        # Act
        token = ShopifySessionService.get_session_token_from_request(mock_request)
        
        # Assert
        assert token == "fallback_token"

    def test_get_session_token_from_request_malformed_auth_header(self):
        """Test when Authorization header is malformed"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {"authorization": "Basic some_token"}
        mock_request.query_params = {"id_token": "fallback_token"}
        
        # Act
        token = ShopifySessionService.get_session_token_from_request(mock_request)
        
        # Assert
        assert token == "fallback_token"

    @patch('app.services.shopify_session.settings')
    def test_validate_session_token_success(self, mock_settings):
        """Test successful session token validation"""
        # Arrange
        mock_settings.SHOPIFY_API_SECRET = "test_secret"
        mock_settings.SHOPIFY_API_KEY = "test_key"
        
        # Create a valid JWT token
        payload = {
            'dest': 'https://test-shop.myshopify.com',
            'aud': 'test_key',
            'exp': int(time.time()) + 3600,  # 1 hour from now
            'nbf': int(time.time()) - 60,    # 1 minute ago
            'iat': int(time.time()),
            'sub': 'test_user'
        }
        token = jwt.encode(payload, "test_secret", algorithm="HS256")
        
        # Act
        decoded = ShopifySessionService.validate_session_token(token)
        
        # Assert
        assert decoded['dest'] == 'https://test-shop.myshopify.com'
        assert decoded['aud'] == 'test_key'
        assert 'exp' in decoded
        assert 'nbf' in decoded

    @patch('app.services.shopify_session.settings')
    def test_validate_session_token_expired(self, mock_settings):
        """Test validation of expired session token"""
        # Arrange
        mock_settings.SHOPIFY_API_SECRET = "test_secret"
        mock_settings.SHOPIFY_API_KEY = "test_key"
        
        # Create an expired JWT token
        payload = {
            'dest': 'https://test-shop.myshopify.com',
            'aud': 'test_key',
            'exp': int(time.time()) - 3600,  # 1 hour ago (expired)
            'nbf': int(time.time()) - 7200,  # 2 hours ago
            'iat': int(time.time()) - 7200
        }
        token = jwt.encode(payload, "test_secret", algorithm="HS256")
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            ShopifySessionService.validate_session_token(token)
        
        assert exc_info.value.status_code == 401
        assert "expired" in str(exc_info.value.detail).lower()
        assert exc_info.value.headers.get("X-Shopify-Retry-Invalid-Session-Request") == "1"

    @patch('app.services.shopify_session.settings')
    def test_validate_session_token_not_yet_valid(self, mock_settings):
        """Test validation of session token that's not yet valid (nbf in future)"""
        # Arrange
        mock_settings.SHOPIFY_API_SECRET = "test_secret"
        mock_settings.SHOPIFY_API_KEY = "test_key"
        
        # Create a JWT token that's not yet valid
        payload = {
            'dest': 'https://test-shop.myshopify.com',
            'aud': 'test_key',
            'exp': int(time.time()) + 7200,  # 2 hours from now
            'nbf': int(time.time()) + 3600,  # 1 hour from now (not yet valid)
            'iat': int(time.time())
        }
        token = jwt.encode(payload, "test_secret", algorithm="HS256")
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            ShopifySessionService.validate_session_token(token)
        
        assert exc_info.value.status_code == 401
        assert "Invalid session token" in str(exc_info.value.detail)

    @patch('app.services.shopify_session.settings')
    def test_validate_session_token_invalid_signature(self, mock_settings):
        """Test validation of token with invalid signature"""
        # Arrange
        mock_settings.SHOPIFY_API_SECRET = "test_secret"
        mock_settings.SHOPIFY_API_KEY = "test_key"
        
        # Create a JWT token with wrong secret
        payload = {
            'dest': 'https://test-shop.myshopify.com',
            'aud': 'test_key',
            'exp': int(time.time()) + 3600,
            'nbf': int(time.time()) - 60,
            'iat': int(time.time())
        }
        token = jwt.encode(payload, "wrong_secret", algorithm="HS256")
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            ShopifySessionService.validate_session_token(token)
        
        assert exc_info.value.status_code == 401
        assert "Invalid session token" in str(exc_info.value.detail)
        assert exc_info.value.headers.get("X-Shopify-Retry-Invalid-Session-Request") == "1"

    def test_validate_session_token_malformed_token(self):
        """Test validation of malformed token"""
        # Arrange
        malformed_token = "not.a.valid.jwt.token"
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            ShopifySessionService.validate_session_token(malformed_token)
        
        assert exc_info.value.status_code == 401
        assert "Invalid session token" in str(exc_info.value.detail)

    def test_is_document_request_no_auth_header(self):
        """Test document request detection when no Authorization header"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {}
        
        # Act
        is_document = ShopifySessionService.is_document_request(mock_request)
        
        # Assert
        assert is_document is True

    def test_is_document_request_with_auth_header(self):
        """Test document request detection when Authorization header present"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_request.headers = {"authorization": "Bearer token"}
        
        # Act
        is_document = ShopifySessionService.is_document_request(mock_request)
        
        # Assert
        assert is_document is False


class TestRequireShopifySession:
    """Test cases for require_shopify_session dependency"""

    @pytest.mark.asyncio
    @patch('app.repositories.shopify_shop_repository.ShopifyShopRepository')
    @patch('app.services.shopify_session.ShopifySessionService.validate_session_token')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_session_success(
        self, mock_get_token, mock_validate_token, mock_shop_repo
    ):
        """Test successful session validation with shop lookup"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        shop_id = str(uuid.uuid4())
        org_id = str(uuid.uuid4())
        
        mock_get_token.return_value = "valid_token"
        mock_validate_token.return_value = {
            'dest': 'https://test-shop.myshopify.com',
            'aud': 'test_key',
            'exp': int(time.time()) + 3600
        }
        
        # Mock shop repository
        mock_shop_repo_instance = MagicMock()
        mock_shop_repo.return_value = mock_shop_repo_instance
        
        mock_shop = MagicMock()
        mock_shop.id = shop_id
        mock_shop.organization_id = org_id
        mock_shop.is_installed = True
        mock_shop_repo_instance.get_shop_by_domain.return_value = mock_shop
        
        # Act
        result = await require_shopify_session(mock_request, mock_db)
        
        # Assert
        assert result['shop_id'] == shop_id
        assert result['organization_id'] == org_id
        assert result['db_shop'] == mock_shop
        assert result['dest'] == 'https://test-shop.myshopify.com'
        mock_shop_repo_instance.get_shop_by_domain.assert_called_once_with('test-shop.myshopify.com')

    @pytest.mark.asyncio
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_session_no_token(self, mock_get_token):
        """Test when no session token is provided"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        mock_get_token.return_value = None
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            await require_shopify_session(mock_request, mock_db)
        
        assert exc_info.value.status_code == 401
        assert "Session token required" in str(exc_info.value.detail)
        assert exc_info.value.headers.get("X-Shopify-Retry-Invalid-Session-Request") == "1"

    @pytest.mark.asyncio
    @patch('app.repositories.shopify_shop_repository.ShopifyShopRepository')
    @patch('app.services.shopify_session.ShopifySessionService.validate_session_token')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_session_shop_not_found(
        self, mock_get_token, mock_validate_token, mock_shop_repo
    ):
        """Test when shop is not found in database"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        mock_get_token.return_value = "valid_token"
        mock_validate_token.return_value = {
            'dest': 'https://nonexistent-shop.myshopify.com'
        }
        
        mock_shop_repo_instance = MagicMock()
        mock_shop_repo.return_value = mock_shop_repo_instance
        mock_shop_repo_instance.get_shop_by_domain.return_value = None
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            await require_shopify_session(mock_request, mock_db)
        
        assert exc_info.value.status_code == 403
        assert "Shop not installed or not found" in str(exc_info.value.detail)

    @pytest.mark.asyncio
    @patch('app.repositories.shopify_shop_repository.ShopifyShopRepository')
    @patch('app.services.shopify_session.ShopifySessionService.validate_session_token')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_session_shop_not_installed(
        self, mock_get_token, mock_validate_token, mock_shop_repo
    ):
        """Test when shop exists but is not installed"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        mock_get_token.return_value = "valid_token"
        mock_validate_token.return_value = {
            'dest': 'https://test-shop.myshopify.com'
        }
        
        mock_shop_repo_instance = MagicMock()
        mock_shop_repo.return_value = mock_shop_repo_instance
        
        mock_shop = MagicMock()
        mock_shop.is_installed = False  # Not installed
        mock_shop_repo_instance.get_shop_by_domain.return_value = mock_shop
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            await require_shopify_session(mock_request, mock_db)
        
        assert exc_info.value.status_code == 403
        assert "Shop not installed or not found" in str(exc_info.value.detail)


class TestRequireShopifyOrJwtAuth:
    """Test cases for require_shopify_or_jwt_auth hybrid dependency"""

    @pytest.mark.asyncio
    @patch('app.repositories.shopify_shop_repository.ShopifyShopRepository')
    @patch('app.services.shopify_session.ShopifySessionService.validate_session_token')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_or_jwt_auth_shopify_success(
        self, mock_get_token, mock_validate_token, mock_shop_repo
    ):
        """Test successful Shopify session token authentication"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        shop_id = str(uuid.uuid4())
        org_id = str(uuid.uuid4())
        
        mock_get_token.return_value = "valid_token"
        mock_validate_token.return_value = {
            'dest': 'https://test-shop.myshopify.com',
            'aud': 'test_key'
        }
        
        # Mock shop repository
        mock_shop_repo_instance = MagicMock()
        mock_shop_repo.return_value = mock_shop_repo_instance
        
        mock_shop = MagicMock()
        mock_shop.id = shop_id
        mock_shop.organization_id = org_id
        mock_shop.is_installed = True
        mock_shop_repo_instance.get_shop_by_domain.return_value = mock_shop
        
        # Act
        result = await require_shopify_or_jwt_auth(mock_request, mock_db)
        
        # Assert
        assert result['auth_type'] == 'shopify_session'
        assert result['shop_id'] == shop_id
        assert result['organization_id'] == org_id
        assert result['user_id'] is None
        assert result['db_shop'] == mock_shop

    @pytest.mark.asyncio
    @patch('app.core.auth.get_current_user')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_or_jwt_auth_jwt_fallback(
        self, mock_get_token, mock_get_current_user
    ):
        """Test fallback to JWT authentication when no Shopify token"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        user_id = str(uuid.uuid4())
        org_id = str(uuid.uuid4())
        
        mock_get_token.return_value = None  # No Shopify token
        
        # Mock JWT user
        mock_user = MagicMock()
        mock_user.id = user_id
        mock_user.organization_id = org_id
        mock_get_current_user.return_value = mock_user
        
        # Act
        result = await require_shopify_or_jwt_auth(mock_request, mock_db)
        
        # Assert
        assert result['auth_type'] == 'jwt'
        assert result['user_id'] == user_id
        assert result['organization_id'] == org_id
        assert result['current_user'] == mock_user

    @pytest.mark.asyncio
    @patch('app.core.auth.get_current_user')
    @patch('app.services.shopify_session.ShopifySessionService.validate_session_token')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_or_jwt_auth_shopify_fails_jwt_success(
        self, mock_get_token, mock_validate_token, mock_get_current_user
    ):
        """Test fallback to JWT when Shopify token validation fails"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        user_id = str(uuid.uuid4())
        org_id = str(uuid.uuid4())
        
        mock_get_token.return_value = "invalid_token"
        mock_validate_token.side_effect = HTTPException(status_code=401, detail="Invalid token")
        
        # Mock JWT user
        mock_user = MagicMock()
        mock_user.id = user_id
        mock_user.organization_id = org_id
        mock_get_current_user.return_value = mock_user
        
        # Act
        result = await require_shopify_or_jwt_auth(mock_request, mock_db)
        
        # Assert
        assert result['auth_type'] == 'jwt'
        assert result['user_id'] == user_id
        assert result['organization_id'] == org_id

    @pytest.mark.asyncio
    @patch('app.core.auth.get_current_user')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_or_jwt_auth_both_fail(
        self, mock_get_token, mock_get_current_user
    ):
        """Test when both Shopify and JWT authentication fail"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        mock_get_token.return_value = None  # No Shopify token
        mock_get_current_user.side_effect = HTTPException(status_code=401, detail="Not authenticated")
        
        # Act & Assert
        with pytest.raises(HTTPException) as exc_info:
            await require_shopify_or_jwt_auth(mock_request, mock_db)
        
        assert exc_info.value.status_code == 401
        assert "Authentication required" in str(exc_info.value.detail)

    @pytest.mark.asyncio
    @patch('app.repositories.shopify_shop_repository.ShopifyShopRepository')
    @patch('app.core.auth.get_current_user')
    @patch('app.services.shopify_session.ShopifySessionService.validate_session_token')
    @patch('app.services.shopify_session.ShopifySessionService.get_session_token_from_request')
    async def test_require_shopify_or_jwt_auth_shopify_shop_not_linked(
        self, mock_get_token, mock_validate_token, mock_get_current_user, mock_shop_repo
    ):
        """Test fallback to JWT when Shopify shop is not linked to organization"""
        # Arrange
        mock_request = MagicMock(spec=Request)
        mock_db = MagicMock(spec=Session)
        
        user_id = str(uuid.uuid4())
        org_id = str(uuid.uuid4())
        
        mock_get_token.return_value = "valid_token"
        mock_validate_token.return_value = {
            'dest': 'https://test-shop.myshopify.com'
        }
        
        # Mock shop repository - shop exists but no organization_id
        mock_shop_repo_instance = MagicMock()
        mock_shop_repo.return_value = mock_shop_repo_instance
        
        mock_shop = MagicMock()
        mock_shop.is_installed = True
        mock_shop.organization_id = None  # Not linked to organization
        mock_shop_repo_instance.get_shop_by_domain.return_value = mock_shop
        
        # Mock JWT user
        mock_user = MagicMock()
        mock_user.id = user_id
        mock_user.organization_id = org_id
        mock_get_current_user.return_value = mock_user
        
        # Act
        result = await require_shopify_or_jwt_auth(mock_request, mock_db)
        
        # Assert
        assert result['auth_type'] == 'jwt'
        assert result['user_id'] == user_id
        assert result['organization_id'] == org_id