Dilshod Rasulov
bfd92102cf
Some checks failed
Backend Tests / pytest (Python 3.12) (push) Failing after 2m27s
112 lines
4.3 KiB
Python
112 lines
4.3 KiB
Python
import pytest
|
|
from app.models import User, ActiveSession
|
|
from app.auth import verify_password
|
|
|
|
@pytest.mark.integration
|
|
class TestAPIAuthentication:
|
|
def test_login_success(self, client, seed_users):
|
|
response = client.post(
|
|
"/api/auth/login",
|
|
json={"username": "testuser", "password": "UserPass123!"}
|
|
)
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert "access_token" in data
|
|
assert data["token_type"] == "bearer"
|
|
|
|
def test_login_wrong_password(self, client, seed_users):
|
|
response = client.post(
|
|
"/api/auth/login",
|
|
json={"username": "testuser", "password": "wrongpassword"}
|
|
)
|
|
assert response.status_code == 401
|
|
assert "Incorrect username or password" in response.json()["detail"]
|
|
|
|
def test_login_user_not_found(self, client, seed_users):
|
|
response = client.post(
|
|
"/api/auth/login",
|
|
json={"username": "nonexistent", "password": "somepassword"}
|
|
)
|
|
assert response.status_code == 401
|
|
|
|
def test_get_me(self, client, user_headers):
|
|
response = client.get("/api/auth/me", headers=user_headers)
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert data["username"] == "testuser"
|
|
assert data["email"] == "testuser@example.com"
|
|
assert data["is_admin"] is False
|
|
assert "permissions" in data
|
|
|
|
def test_logout(self, client, user_headers, db_session):
|
|
# Verify authenticated endpoint works before logout
|
|
me_resp = client.get("/api/auth/me", headers=user_headers)
|
|
assert me_resp.status_code == 200
|
|
|
|
# Logout
|
|
logout_resp = client.post("/api/auth/logout", headers=user_headers)
|
|
assert logout_resp.status_code == 200
|
|
assert logout_resp.json()["message"] == "Successfully logged out"
|
|
|
|
# Verify request is rejected after logout because session is terminated
|
|
me_resp2 = client.get("/api/auth/me", headers=user_headers)
|
|
assert me_resp2.status_code == 401
|
|
|
|
def test_change_password(self, client, user_headers, db_session, seed_users):
|
|
response = client.post(
|
|
"/api/auth/change-password",
|
|
headers=user_headers,
|
|
data={"old_password": "UserPass123!", "new_password": "NewSecurePass123!"}
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["message"] == "Password changed successfully"
|
|
|
|
db_session.refresh(seed_users["user"])
|
|
assert verify_password("NewSecurePass123!", seed_users["user"].hashed_password)
|
|
|
|
def test_register_user_by_admin(self, client, admin_headers, db_session):
|
|
response = client.post(
|
|
"/api/auth/register",
|
|
headers=admin_headers,
|
|
json={
|
|
"username": "newuser",
|
|
"email": "newuser@example.com",
|
|
"full_name": "New User",
|
|
"password": "NewUserPassword123!"
|
|
}
|
|
)
|
|
assert response.status_code == 201
|
|
data = response.json()
|
|
assert data["username"] == "newuser"
|
|
assert data["email"] == "newuser@example.com"
|
|
|
|
user = db_session.query(User).filter(User.username == "newuser").first()
|
|
assert user is not None
|
|
|
|
def test_register_user_denied_for_standard_user(self, client, user_headers):
|
|
response = client.post(
|
|
"/api/auth/register",
|
|
headers=user_headers,
|
|
json={
|
|
"username": "anotheruser",
|
|
"email": "another@example.com",
|
|
"full_name": "Another User",
|
|
"password": "AnotherPassword123!"
|
|
}
|
|
)
|
|
assert response.status_code == 403
|
|
|
|
def test_list_users_by_admin(self, client, admin_headers):
|
|
response = client.get("/api/users", headers=admin_headers)
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert len(data) >= 2
|
|
|
|
def test_delete_user_by_admin(self, client, admin_headers, db_session, seed_users):
|
|
target_user = seed_users["user"]
|
|
response = client.delete(f"/api/users/{target_user.id}", headers=admin_headers)
|
|
assert response.status_code == 204
|
|
|
|
deleted_user = db_session.query(User).filter(User.id == target_user.id).first()
|
|
assert deleted_user is None
|