Pouzor
9c92d39629
- verify_password catches ValueError from passlib so a mangled hash ($ signs stripped by shell/Docker) returns False instead of crashing - Settings.check_password_hash logs a clear startup error with fix instructions when AUTH_PASSWORD_HASH doesn't start with '$2'
71 lines
2.4 KiB
Python
71 lines
2.4 KiB
Python
import pytest
|
|
from httpx import AsyncClient
|
|
|
|
|
|
async def test_login_success(client: AsyncClient):
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
|
|
assert res.status_code == 200
|
|
data = res.json()
|
|
assert "access_token" in data
|
|
assert data["token_type"] == "bearer"
|
|
|
|
|
|
async def test_login_wrong_password(client: AsyncClient):
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "wrong"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_login_wrong_username(client: AsyncClient):
|
|
res = await client.post("/api/v1/auth/login", json={"username": "notadmin", "password": "admin"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_protected_route_requires_auth(client: AsyncClient):
|
|
res = await client.get("/api/v1/nodes")
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_health_is_public(client: AsyncClient):
|
|
res = await client.get("/api/v1/health")
|
|
assert res.status_code == 200
|
|
assert res.json() == {"status": "ok"}
|
|
|
|
|
|
# --- MCP service key auth ---
|
|
|
|
@pytest.fixture
|
|
def with_service_key():
|
|
from app.core.config import settings
|
|
settings.mcp_service_key = "test-service-key"
|
|
yield "test-service-key"
|
|
settings.mcp_service_key = ""
|
|
|
|
|
|
async def test_service_key_grants_access(client: AsyncClient, with_service_key):
|
|
res = await client.get("/api/v1/nodes", headers={"X-MCP-Service-Key": with_service_key})
|
|
assert res.status_code == 200
|
|
|
|
|
|
async def test_service_key_wrong_value(client: AsyncClient, with_service_key):
|
|
res = await client.get("/api/v1/nodes", headers={"X-MCP-Service-Key": "wrong-key"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_service_key_disabled_when_not_configured(client: AsyncClient):
|
|
from app.core.config import settings
|
|
settings.mcp_service_key = ""
|
|
res = await client.get("/api/v1/nodes", headers={"X-MCP-Service-Key": "any-key"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_login_with_malformed_hash_returns_401_not_500(client: AsyncClient):
|
|
"""Malformed hash (e.g. $ stripped by shell) must not crash with 500."""
|
|
from app.core.config import settings
|
|
original = settings.auth_password_hash
|
|
settings.auth_password_hash = "2b12RtMbyw17l4N5UGzeXMNAWu" # $ signs stripped
|
|
try:
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
|
|
assert res.status_code == 401
|
|
finally:
|
|
settings.auth_password_hash = original
|