Pouzor
aa17edf1d0
- Replace passlib.CryptContext with bcrypt 4.2.1 directly (passlib is unmaintained and only emitted warnings when paired with bcrypt 4+). hash_password / verify_password now call bcrypt.checkpw / .hashpw, and verify_password is hardened against empty inputs without raising. scripts/hash_password.py + tests/conftest.py updated to match. - status_checker.check_node() now rejects targets starting with '-' before any subprocess invocation, defending ping/tcp paths against arg-injection if an admin sets a check_target like '-O'. Tests added: - test_auth: expired JWT, malformed JWT, wrong-secret JWT, empty password vs empty server hash, verify_password edge cases. - test_scan: _background_scan failure path marks ScanRun failed, leaves non-running terminal status alone, success path invokes run_scan. - test_status_checker: ping/tcp invocations are bypassed when target or ip starts with '-'. Backend coverage 89% → 90%.
139 lines
4.9 KiB
Python
139 lines
4.9 KiB
Python
import pytest
|
|
from httpx import AsyncClient
|
|
|
|
|
|
async def test_login_success(client: AsyncClient):
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
|
|
assert res.status_code == 200
|
|
data = res.json()
|
|
assert "access_token" in data
|
|
assert data["token_type"] == "bearer"
|
|
|
|
|
|
async def test_login_wrong_password(client: AsyncClient):
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "wrong"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_login_wrong_username(client: AsyncClient):
|
|
res = await client.post("/api/v1/auth/login", json={"username": "notadmin", "password": "admin"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_protected_route_requires_auth(client: AsyncClient):
|
|
res = await client.get("/api/v1/nodes")
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_health_is_public(client: AsyncClient):
|
|
res = await client.get("/api/v1/health")
|
|
assert res.status_code == 200
|
|
assert res.json() == {"status": "ok"}
|
|
|
|
|
|
# --- MCP service key auth ---
|
|
|
|
@pytest.fixture
|
|
def with_service_key():
|
|
from app.core.config import settings
|
|
settings.mcp_service_key = "test-service-key"
|
|
yield "test-service-key"
|
|
settings.mcp_service_key = ""
|
|
|
|
|
|
async def test_service_key_grants_access(client: AsyncClient, with_service_key):
|
|
res = await client.get("/api/v1/nodes", headers={"X-MCP-Service-Key": with_service_key})
|
|
assert res.status_code == 200
|
|
|
|
|
|
async def test_service_key_wrong_value(client: AsyncClient, with_service_key):
|
|
res = await client.get("/api/v1/nodes", headers={"X-MCP-Service-Key": "wrong-key"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_service_key_disabled_when_not_configured(client: AsyncClient):
|
|
from app.core.config import settings
|
|
settings.mcp_service_key = ""
|
|
res = await client.get("/api/v1/nodes", headers={"X-MCP-Service-Key": "any-key"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_login_with_malformed_hash_returns_401_not_500(client: AsyncClient):
|
|
"""Malformed hash (e.g. $ stripped by shell) must not crash with 500."""
|
|
from app.core.config import settings
|
|
original = settings.auth_password_hash
|
|
settings.auth_password_hash = "2b12RtMbyw17l4N5UGzeXMNAWu" # $ signs stripped
|
|
try:
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
|
|
assert res.status_code == 401
|
|
finally:
|
|
settings.auth_password_hash = original
|
|
|
|
|
|
# --- JWT-level cases ---
|
|
|
|
async def test_expired_token_rejected(client: AsyncClient):
|
|
"""A JWT whose `exp` is in the past must be refused."""
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from jose import jwt
|
|
|
|
from app.core.config import settings
|
|
payload = {
|
|
"sub": "admin",
|
|
"exp": datetime.now(timezone.utc) - timedelta(minutes=1),
|
|
}
|
|
token = jwt.encode(payload, settings.secret_key, algorithm=settings.algorithm)
|
|
res = await client.get("/api/v1/nodes", headers={"Authorization": f"Bearer {token}"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_malformed_token_rejected(client: AsyncClient):
|
|
res = await client.get("/api/v1/nodes", headers={"Authorization": "Bearer not-a-jwt"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_token_signed_with_wrong_secret_rejected(client: AsyncClient):
|
|
"""A token signed with a different key must not be accepted."""
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from jose import jwt
|
|
|
|
from app.core.config import settings
|
|
payload = {
|
|
"sub": "admin",
|
|
"exp": datetime.now(timezone.utc) + timedelta(minutes=5),
|
|
}
|
|
forged = jwt.encode(payload, "different-secret", algorithm=settings.algorithm)
|
|
res = await client.get("/api/v1/nodes", headers={"Authorization": f"Bearer {forged}"})
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_missing_authorization_header_rejected(client: AsyncClient):
|
|
res = await client.get("/api/v1/nodes")
|
|
assert res.status_code == 401
|
|
|
|
|
|
async def test_empty_password_does_not_pass_when_hash_empty(client: AsyncClient):
|
|
"""No credentials configured server-side must not authenticate an empty password."""
|
|
from app.core.config import settings
|
|
original_hash = settings.auth_password_hash
|
|
settings.auth_password_hash = ""
|
|
try:
|
|
res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": ""})
|
|
assert res.status_code == 401
|
|
finally:
|
|
settings.auth_password_hash = original_hash
|
|
|
|
|
|
# --- Password helper ---
|
|
|
|
def test_verify_password_handles_empty_inputs():
|
|
"""verify_password must be safe against empty plain / empty hash without raising."""
|
|
from app.core.security import hash_password, verify_password
|
|
h = hash_password("hunter2")
|
|
assert verify_password("hunter2", h) is True
|
|
assert verify_password("", h) is False
|
|
assert verify_password("hunter2", "") is False
|
|
assert verify_password("", "") is False
|