1445043649
138 lines
4.8 KiB
Python
138 lines
4.8 KiB
Python
"""Tests for the API key auth backend (Stage 1 PR2)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import dataclasses
|
|
|
|
import pytest
|
|
|
|
from app.gateway.auth.api_key_backend import ServicePrincipal, parse_scopes
|
|
from deerflow.auth.tokens import generate_api_key
|
|
|
|
pytestmark = pytest.mark.anyio
|
|
|
|
|
|
def test_parse_scopes_splits_and_strips():
|
|
assert parse_scopes("threads:read, threads:write") == ["threads:read", "threads:write"]
|
|
|
|
|
|
def test_parse_scopes_empty_string_is_empty_list():
|
|
assert parse_scopes("") == []
|
|
assert parse_scopes(" ") == []
|
|
|
|
|
|
def test_parse_scopes_drops_empty_segments():
|
|
assert parse_scopes("threads:read,,runs:create,") == ["threads:read", "runs:create"]
|
|
|
|
|
|
def test_service_principal_is_service_account_true_by_default():
|
|
p = ServicePrincipal(id="sa-1")
|
|
assert p.id == "sa-1"
|
|
assert p.is_service_account is True
|
|
|
|
|
|
def test_service_principal_is_frozen():
|
|
p = ServicePrincipal(id="sa-1")
|
|
with pytest.raises(dataclasses.FrozenInstanceError):
|
|
p.id = "other" # type: ignore[misc]
|
|
|
|
|
|
@pytest.fixture
|
|
def anyio_backend() -> str:
|
|
return "asyncio"
|
|
|
|
|
|
async def _setup_backend(tmp_path, *, sa_status="active", ws_status="active", scopes="threads:read", expires_at=None, revoke=False):
|
|
from app.gateway.auth.api_key_backend import APIKeyAuthBackend
|
|
from deerflow.persistence.api_key import ApiKeyRepository
|
|
from deerflow.persistence.engine import get_session_factory, init_engine
|
|
from deerflow.persistence.service_account import ServiceAccountRepository
|
|
from deerflow.persistence.service_account.model import ServiceAccountRow
|
|
from deerflow.persistence.user.model import UserRow
|
|
from deerflow.persistence.workspace import WorkspaceRepository
|
|
from deerflow.persistence.workspace.model import WorkspaceRow
|
|
|
|
url = f"sqlite+aiosqlite:///{tmp_path / 'test.db'}"
|
|
await init_engine("sqlite", url=url, sqlite_dir=str(tmp_path))
|
|
sf = get_session_factory()
|
|
async with sf() as session:
|
|
session.add(UserRow(id="u-alice", email="alice@example.com"))
|
|
await session.commit()
|
|
async with sf() as session:
|
|
session.add(WorkspaceRow(id="w-1", name="WS", slug="ws", owner_id="u-alice", status=ws_status))
|
|
await session.commit()
|
|
async with sf() as session:
|
|
session.add(ServiceAccountRow(id="sa-1", workspace_id="w-1", name="bot", role="member", identity_mode="collapsed", status=sa_status, created_by="u-alice"))
|
|
await session.commit()
|
|
|
|
api_key_repo = ApiKeyRepository(sf)
|
|
gen = generate_api_key("live")
|
|
created = await api_key_repo.create(service_account_id="sa-1", key_prefix=gen.prefix, key_hash=gen.key_hash, name="k", scopes=scopes, expires_at=expires_at)
|
|
if revoke:
|
|
await api_key_repo.revoke(created["id"])
|
|
|
|
backend = APIKeyAuthBackend(api_key_repo=api_key_repo, service_account_repo=ServiceAccountRepository(sf), workspace_repo=WorkspaceRepository(sf))
|
|
return backend, gen
|
|
|
|
|
|
async def _cleanup():
|
|
from deerflow.persistence.engine import close_engine
|
|
|
|
await close_engine()
|
|
|
|
|
|
async def test_authenticate_valid_key(tmp_path):
|
|
backend, gen = await _setup_backend(tmp_path, scopes="threads:read,threads:write")
|
|
try:
|
|
result = await backend.authenticate(gen.plaintext)
|
|
assert result is not None
|
|
assert result.principal.id == "sa-1"
|
|
assert result.principal.is_service_account is True
|
|
assert result.workspace_id == "w-1"
|
|
assert result.role == "member"
|
|
assert result.permissions == ["threads:read", "threads:write"]
|
|
finally:
|
|
await _cleanup()
|
|
|
|
|
|
async def test_authenticate_unknown_token_returns_none(tmp_path):
|
|
backend, _ = await _setup_backend(tmp_path)
|
|
try:
|
|
assert await backend.authenticate("dfk_live_doesnotexist000000000000") is None
|
|
finally:
|
|
await _cleanup()
|
|
|
|
|
|
async def test_authenticate_revoked_key_returns_none(tmp_path):
|
|
backend, gen = await _setup_backend(tmp_path, revoke=True)
|
|
try:
|
|
assert await backend.authenticate(gen.plaintext) is None
|
|
finally:
|
|
await _cleanup()
|
|
|
|
|
|
async def test_authenticate_suspended_sa_returns_none(tmp_path):
|
|
backend, gen = await _setup_backend(tmp_path, sa_status="suspended")
|
|
try:
|
|
assert await backend.authenticate(gen.plaintext) is None
|
|
finally:
|
|
await _cleanup()
|
|
|
|
|
|
async def test_authenticate_suspended_workspace_returns_none(tmp_path):
|
|
backend, gen = await _setup_backend(tmp_path, ws_status="suspended")
|
|
try:
|
|
assert await backend.authenticate(gen.plaintext) is None
|
|
finally:
|
|
await _cleanup()
|
|
|
|
|
|
async def test_authenticate_expired_key_returns_none(tmp_path):
|
|
from datetime import UTC, datetime
|
|
|
|
backend, gen = await _setup_backend(tmp_path, expires_at=datetime(2000, 1, 1, tzinfo=UTC))
|
|
try:
|
|
assert await backend.authenticate(gen.plaintext) is None
|
|
finally:
|
|
await _cleanup()
|