119 lines
5.3 KiB
Plaintext
119 lines
5.3 KiB
Plaintext
*** Settings ***
|
|
Documentation Authentication API tests for Aniworld.
|
|
... Covers setup, login, logout, status, rate limiting, and JWT validation.
|
|
|
|
Resource ${CURDIR}/../resources/common.resource
|
|
Resource ${CURDIR}/../resources/api_keywords.resource
|
|
|
|
Test Setup Create Anonymous Session
|
|
Test Teardown Delete All Sessions
|
|
|
|
*** Test Cases ***
|
|
# ---------------------------------------------------------------------------
|
|
# Setup
|
|
# ---------------------------------------------------------------------------
|
|
Setup Master Password
|
|
[Documentation] Configure the master password for the first time.
|
|
${resp}= POST Auth Setup ${SETUP_PASSWORD} 201
|
|
Response Should Have Status ${resp} 201
|
|
${configured}= Is Auth Configured
|
|
Should Be True ${configured}
|
|
|
|
Setup Rejects Weak Password
|
|
[Documentation] Verify that weak passwords are rejected during setup.
|
|
${resp}= POST Auth Setup weak 400
|
|
Response Should Have Status ${resp} 400
|
|
|
|
Setup Rejects Duplicate
|
|
[Documentation] Verify that setup cannot be performed twice.
|
|
Setup Master Password
|
|
${resp}= POST Auth Setup AnotherPass123! 400
|
|
Response Should Have Status ${resp} 400
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Login
|
|
# ---------------------------------------------------------------------------
|
|
Login With Valid Password
|
|
[Documentation] Log in with the correct master password and receive a JWT token.
|
|
Setup Master Password
|
|
${resp}= POST Auth Login ${SETUP_PASSWORD} 200
|
|
Response Should Have Status ${resp} 200
|
|
${token}= Get JSON Value ${resp} $.access_token
|
|
Should Not Be Empty ${token}
|
|
|
|
Login With Invalid Password
|
|
[Documentation] Log in with an incorrect password and receive 401.
|
|
Setup Master Password
|
|
${resp}= POST Auth Login WrongPass123! 401
|
|
Response Should Have Status ${resp} 401
|
|
|
|
Login Rate Limiting
|
|
[Documentation] Verify that repeated failed login attempts trigger rate limiting.
|
|
Setup Master Password
|
|
FOR ${i} IN RANGE 6
|
|
${resp}= POST Auth Login WrongPass123! expected_status=ANY
|
|
END
|
|
${resp}= POST Auth Login WrongPass123! expected_status=ANY
|
|
Should Be True ${resp.status_code} >= 429 or ${resp.status_code} == 401
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Auth Status
|
|
# ---------------------------------------------------------------------------
|
|
Auth Status Unconfigured
|
|
[Documentation] Check auth status before any setup has occurred.
|
|
${resp}= GET Auth Status 200
|
|
Response Should Have Status ${resp} 200
|
|
${configured}= Get JSON Value ${resp} $.configured
|
|
Should Be Equal As Strings ${configured} False
|
|
|
|
Auth Status Configured Unauthenticated
|
|
[Documentation] Check auth status after setup but without a token.
|
|
Setup Master Password
|
|
${resp}= GET Auth Status 200
|
|
Response Should Have Status ${resp} 200
|
|
${configured}= Get JSON Value ${resp} $.configured
|
|
Should Be Equal As Strings ${configured} True
|
|
${authenticated}= Get JSON Value ${resp} $.authenticated
|
|
Should Be Equal As Strings ${authenticated} False
|
|
|
|
Auth Status Authenticated
|
|
[Documentation] Check auth status with a valid Bearer token.
|
|
Setup Master Password
|
|
${token}= Login And Get Token
|
|
${headers}= Create Dictionary Authorization=Bearer ${token}
|
|
Create Session authed ${BASE_URL} headers=${headers}
|
|
${resp}= GET On Session authed /api/auth/status expected_status=200
|
|
Response Should Have Status ${resp} 200
|
|
${authenticated}= Get JSON Value ${resp} $.authenticated
|
|
Should Be Equal As Strings ${authenticated} True
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Logout
|
|
# ---------------------------------------------------------------------------
|
|
Logout
|
|
[Documentation] Log out and verify the token is invalidated.
|
|
Setup Master Password
|
|
${token}= Login And Get Token
|
|
${headers}= Create Dictionary Authorization=Bearer ${token}
|
|
Create Session authed ${BASE_URL} headers=${headers}
|
|
${resp}= POST On Session authed /api/auth/logout expected_status=200
|
|
Response Should Have Status ${resp} 200
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Protected Endpoints
|
|
# ---------------------------------------------------------------------------
|
|
Protected Endpoint Without Auth
|
|
[Documentation] Verify that protected endpoints reject unauthenticated requests.
|
|
Setup Master Password
|
|
${resp}= GET On Session anon /api/anime/ expected_status=401
|
|
Response Should Have Status ${resp} 401
|
|
|
|
Protected Endpoint With Auth
|
|
[Documentation] Verify that protected endpoints accept authenticated requests.
|
|
Setup Master Password
|
|
${token}= Login And Get Token
|
|
${headers}= Create Dictionary Authorization=Bearer ${token}
|
|
Create Session authed ${BASE_URL} headers=${headers}
|
|
${resp}= GET On Session authed /api/anime/ expected_status=200
|
|
Response Should Have Status ${resp} 200
|