backup

tests/robot/api/auth.robot

@@ -0,0 +1,118 @@
+*** Settings ***
+Documentation       Authentication API tests for Aniworld.
+...                 Covers setup, login, logout, status, rate limiting, and JWT validation.
+
+Resource            ${CURDIR}/../resources/common.resource
+Resource            ${CURDIR}/../resources/api_keywords.resource
+
+Test Setup          Create Anonymous Session
+Test Teardown       Delete All Sessions
+
+*** Test Cases ***
+# ---------------------------------------------------------------------------
+# Setup
+# ---------------------------------------------------------------------------
+Setup Master Password
+    [Documentation]    Configure the master password for the first time.
+    ${resp}=    POST Auth Setup    ${SETUP_PASSWORD}    201
+    Response Should Have Status    ${resp}    201
+    ${configured}=    Is Auth Configured
+    Should Be True    ${configured}
+
+Setup Rejects Weak Password
+    [Documentation]    Verify that weak passwords are rejected during setup.
+    ${resp}=    POST Auth Setup    weak    400
+    Response Should Have Status    ${resp}    400
+
+Setup Rejects Duplicate
+    [Documentation]    Verify that setup cannot be performed twice.
+    Setup Master Password
+    ${resp}=    POST Auth Setup    AnotherPass123!    400
+    Response Should Have Status    ${resp}    400
+
+# ---------------------------------------------------------------------------
+# Login
+# ---------------------------------------------------------------------------
+Login With Valid Password
+    [Documentation]    Log in with the correct master password and receive a JWT token.
+    Setup Master Password
+    ${resp}=    POST Auth Login    ${SETUP_PASSWORD}    200
+    Response Should Have Status    ${resp}    200
+    ${token}=    Get JSON Value    ${resp}    $.access_token
+    Should Not Be Empty    ${token}
+
+Login With Invalid Password
+    [Documentation]    Log in with an incorrect password and receive 401.
+    Setup Master Password
+    ${resp}=    POST Auth Login    WrongPass123!    401
+    Response Should Have Status    ${resp}    401
+
+Login Rate Limiting
+    [Documentation]    Verify that repeated failed login attempts trigger rate limiting.
+    Setup Master Password
+    FOR    ${i}    IN RANGE    6
+        ${resp}=    POST Auth Login    WrongPass123!    expected_status=ANY
+    END
+    ${resp}=    POST Auth Login    WrongPass123!    expected_status=ANY
+    Should Be True    ${resp.status_code} >= 429 or ${resp.status_code} == 401
+
+# ---------------------------------------------------------------------------
+# Auth Status
+# ---------------------------------------------------------------------------
+Auth Status Unconfigured
+    [Documentation]    Check auth status before any setup has occurred.
+    ${resp}=    GET Auth Status    200
+    Response Should Have Status    ${resp}    200
+    ${configured}=    Get JSON Value    ${resp}    $.configured
+    Should Be Equal As Strings    ${configured}    False
+
+Auth Status Configured Unauthenticated
+    [Documentation]    Check auth status after setup but without a token.
+    Setup Master Password
+    ${resp}=    GET Auth Status    200
+    Response Should Have Status    ${resp}    200
+    ${configured}=    Get JSON Value    ${resp}    $.configured
+    Should Be Equal As Strings    ${configured}    True
+    ${authenticated}=    Get JSON Value    ${resp}    $.authenticated
+    Should Be Equal As Strings    ${authenticated}    False
+
+Auth Status Authenticated
+    [Documentation]    Check auth status with a valid Bearer token.
+    Setup Master Password
+    ${token}=    Login And Get Token
+    ${headers}=    Create Dictionary    Authorization=Bearer ${token}
+    Create Session    authed    ${BASE_URL}    headers=${headers}
+    ${resp}=    GET On Session    authed    /api/auth/status    expected_status=200
+    Response Should Have Status    ${resp}    200
+    ${authenticated}=    Get JSON Value    ${resp}    $.authenticated
+    Should Be Equal As Strings    ${authenticated}    True
+
+# ---------------------------------------------------------------------------
+# Logout
+# ---------------------------------------------------------------------------
+Logout
+    [Documentation]    Log out and verify the token is invalidated.
+    Setup Master Password
+    ${token}=    Login And Get Token
+    ${headers}=    Create Dictionary    Authorization=Bearer ${token}
+    Create Session    authed    ${BASE_URL}    headers=${headers}
+    ${resp}=    POST On Session    authed    /api/auth/logout    expected_status=200
+    Response Should Have Status    ${resp}    200
+
+# ---------------------------------------------------------------------------
+# Protected Endpoints
+# ---------------------------------------------------------------------------
+Protected Endpoint Without Auth
+    [Documentation]    Verify that protected endpoints reject unauthenticated requests.
+    Setup Master Password
+    ${resp}=    GET On Session    anon    /api/anime/    expected_status=401
+    Response Should Have Status    ${resp}    401
+
+Protected Endpoint With Auth
+    [Documentation]    Verify that protected endpoints accept authenticated requests.
+    Setup Master Password
+    ${token}=    Login And Get Token
+    ${headers}=    Create Dictionary    Authorization=Bearer ${token}
+    Create Session    authed    ${BASE_URL}    headers=${headers}
+    ${resp}=    GET On Session    authed    /api/anime/    expected_status=200
+    Response Should Have Status    ${resp}    200