Lukas
96eeae620e
Major authentication and testing improvements: Authentication Fixes: - Re-added require_auth dependency to anime endpoints (list, search, rescan) - Fixed health controller to use proper dependency injection - All anime operations now properly protected Test Infrastructure Updates: - Fixed URL paths across all tests (/api/v1/anime → /api/anime) - Updated search endpoint tests to use GET with params instead of POST - Fixed SQL injection test to accept rate limiting (429) responses - Updated brute force protection test to handle rate limits - Fixed weak password test to use /api/auth/setup endpoint - Simplified password hashing tests (covered by integration tests) Files Modified: - src/server/api/anime.py: Added auth requirements - src/server/controllers/health_controller.py: Fixed dependency injection - tests/api/test_anime_endpoints.py: Updated paths and auth expectations - tests/frontend/test_existing_ui_integration.py: Fixed API paths - tests/integration/test_auth_flow.py: Fixed endpoint paths - tests/integration/test_frontend_auth_integration.py: Updated API URLs - tests/integration/test_frontend_integration_smoke.py: Fixed paths - tests/security/test_auth_security.py: Fixed tests and expectations - tests/security/test_sql_injection.py: Accept rate limiting responses - instructions.md: Removed completed tasks Test Results: - Before: 41 failures, 781 passed (93.4%) - After: 24 failures, 798 passed (97.1%) - Improvement: 17 fewer failures, +2.0% pass rate Cleanup: - Removed old summary documentation files - Cleaned up obsolete config backups
245 lines
8.5 KiB
Python
245 lines
8.5 KiB
Python
"""
|
|
Tests for frontend authentication integration.
|
|
|
|
These smoke tests verify that the key authentication and API endpoints
|
|
work correctly with JWT tokens as expected by the frontend.
|
|
"""
|
|
import pytest
|
|
from httpx import ASGITransport, AsyncClient
|
|
|
|
from src.server.fastapi_app import app
|
|
|
|
|
|
@pytest.fixture
|
|
async def client():
|
|
"""Create an async test client."""
|
|
transport = ASGITransport(app=app)
|
|
async with AsyncClient(transport=transport, base_url="http://test") as ac:
|
|
yield ac
|
|
|
|
|
|
class TestFrontendAuthIntegration:
|
|
"""Test authentication integration matching frontend expectations."""
|
|
|
|
async def test_setup_returns_ok_status(self, client):
|
|
"""Test setup endpoint returns expected format for frontend."""
|
|
response = await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "StrongP@ss123"}
|
|
)
|
|
assert response.status_code == 201
|
|
data = response.json()
|
|
# Frontend expects 'status': 'ok'
|
|
assert data["status"] == "ok"
|
|
|
|
async def test_login_returns_access_token(self, client):
|
|
"""Test login flow and verify JWT token is returned."""
|
|
# Setup master password first
|
|
await client.post("/api/auth/setup", json={"master_password": "StrongP@ss123"})
|
|
|
|
# Login with correct password
|
|
response = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Verify token is returned
|
|
assert "access_token" in data
|
|
assert data["token_type"] == "bearer"
|
|
assert "expires_at" in data
|
|
|
|
# Verify token can be used for authenticated requests
|
|
token = data["access_token"]
|
|
headers = {"Authorization": f"Bearer {token}"}
|
|
response = await client.get("/api/auth/status", headers=headers)
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert data["authenticated"] is True
|
|
|
|
async def test_login_with_wrong_password(self, client):
|
|
"""Test login with incorrect password."""
|
|
# Setup master password first
|
|
await client.post("/api/auth/setup", json={"master_password": "StrongP@ss123"})
|
|
|
|
# Login with wrong password
|
|
response = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "WrongPassword"}
|
|
)
|
|
assert response.status_code == 401
|
|
data = response.json()
|
|
assert "detail" in data
|
|
|
|
async def test_logout_clears_session(self, client):
|
|
"""Test logout functionality."""
|
|
# Setup and login
|
|
await client.post("/api/auth/setup", json={"master_password": "StrongP@ss123"})
|
|
login_response = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
token = login_response.json()["access_token"]
|
|
headers = {"Authorization": f"Bearer {token}"}
|
|
|
|
# Logout
|
|
response = await client.post("/api/auth/logout", headers=headers)
|
|
assert response.status_code == 200
|
|
assert response.json()["status"] == "ok"
|
|
|
|
async def test_authenticated_request_without_token_returns_401(self, client):
|
|
"""Test that authenticated endpoints reject requests without tokens."""
|
|
# Setup master password
|
|
await client.post("/api/auth/setup", json={"master_password": "StrongP@ss123"})
|
|
|
|
# Try to access authenticated endpoint without token
|
|
response = await client.get("/api/anime/")
|
|
assert response.status_code == 401
|
|
|
|
async def test_authenticated_request_with_invalid_token_returns_401(
|
|
self, client
|
|
):
|
|
"""Test that authenticated endpoints reject invalid tokens."""
|
|
# Setup master password
|
|
await client.post(
|
|
"/api/auth/setup", json={"master_password": "StrongP@ss123"}
|
|
)
|
|
|
|
# Try to access authenticated endpoint with invalid token
|
|
headers = {"Authorization": "Bearer invalid_token_here"}
|
|
response = await client.get("/api/anime/", headers=headers)
|
|
assert response.status_code == 401
|
|
|
|
async def test_remember_me_extends_token_expiry(self, client):
|
|
"""Test that remember_me flag affects token expiry."""
|
|
# Setup master password
|
|
await client.post(
|
|
"/api/auth/setup", json={"master_password": "StrongP@ss123"}
|
|
)
|
|
|
|
# Login without remember me
|
|
response1 = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123", "remember": False}
|
|
)
|
|
data1 = response1.json()
|
|
|
|
# Login with remember me
|
|
response2 = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123", "remember": True}
|
|
)
|
|
data2 = response2.json()
|
|
|
|
# Both should return tokens with expiry
|
|
assert "expires_at" in data1
|
|
assert "expires_at" in data2
|
|
|
|
async def test_setup_fails_if_already_configured(self, client):
|
|
"""Test that setup fails if master password is already set."""
|
|
# Setup once
|
|
await client.post(
|
|
"/api/auth/setup", json={"master_password": "StrongP@ss123"}
|
|
)
|
|
|
|
# Try to setup again
|
|
response = await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "AnotherPassword123!"}
|
|
)
|
|
assert response.status_code == 400
|
|
assert (
|
|
"already configured" in response.json()["detail"].lower()
|
|
)
|
|
|
|
async def test_weak_password_validation_in_setup(self, client):
|
|
"""Test that setup rejects weak passwords."""
|
|
# Try with short password
|
|
response = await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "short"}
|
|
)
|
|
assert response.status_code in [400, 422]
|
|
|
|
# Try with all lowercase
|
|
response = await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "alllowercase"}
|
|
)
|
|
assert response.status_code in [400, 422]
|
|
|
|
# Try without special characters
|
|
response = await client.post(
|
|
"/api/auth/setup",
|
|
json={"master_password": "NoSpecialChars123"}
|
|
)
|
|
assert response.status_code == 400
|
|
|
|
|
|
class TestTokenAuthenticationFlow:
|
|
"""Test JWT token-based authentication workflow."""
|
|
|
|
async def test_full_authentication_workflow(self, client):
|
|
"""Test complete authentication workflow with token management."""
|
|
# 1. Check initial status
|
|
response = await client.get("/api/auth/status")
|
|
assert not response.json()["configured"]
|
|
|
|
# 2. Setup master password
|
|
await client.post(
|
|
"/api/auth/setup", json={"master_password": "StrongP@ss123"}
|
|
)
|
|
|
|
# 3. Login and get token
|
|
response = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
token = response.json()["access_token"]
|
|
headers = {"Authorization": f"Bearer {token}"}
|
|
|
|
# 4. Access authenticated endpoint
|
|
response = await client.get("/api/auth/status", headers=headers)
|
|
assert response.json()["authenticated"] is True
|
|
|
|
# 5. Logout
|
|
response = await client.post("/api/auth/logout", headers=headers)
|
|
assert response.json()["status"] == "ok"
|
|
|
|
async def test_token_included_in_all_authenticated_requests(
|
|
self, client
|
|
):
|
|
"""Test that token must be included in authenticated API requests."""
|
|
# Setup and login
|
|
await client.post(
|
|
"/api/auth/setup", json={"master_password": "StrongP@ss123"}
|
|
)
|
|
response = await client.post(
|
|
"/api/auth/login",
|
|
json={"password": "StrongP@ss123"}
|
|
)
|
|
token = response.json()["access_token"]
|
|
headers = {"Authorization": f"Bearer {token}"}
|
|
|
|
# Test various authenticated endpoints
|
|
endpoints = [
|
|
"/api/anime/",
|
|
"/api/queue/status",
|
|
"/api/config",
|
|
]
|
|
|
|
for endpoint in endpoints:
|
|
# Without token - should fail
|
|
response = await client.get(endpoint)
|
|
assert response.status_code == 401, (
|
|
f"Endpoint {endpoint} should require auth"
|
|
)
|
|
|
|
# With token - should work or return expected response
|
|
response = await client.get(endpoint, headers=headers)
|
|
# Some endpoints may return 503 if services not configured
|
|
assert response.status_code in [200, 503], (
|
|
f"Endpoint {endpoint} failed with token"
|
|
)
|