You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

49 lines
2.0 KiB
Python

# backend/tests/test_auth.py — 로그인/로그아웃/세션/토큰 (AUTH_ENABLED=true)
def _login(c, email="jiwoo@lumi.co", pw="demo-1234"):
return c.post("/api/auth/login", json={"email": email, "password": pw})
def test_login_sets_cookie_and_returns_me(client_auth):
r = _login(client_auth)
assert r.status_code == 200, r.text
body = r.json()
assert body["id"] == "jiwoo" and body["initial"] == "" and body["role"] == "admin"
assert "ari_session" in r.cookies
def test_protected_route_401_without_session(client_auth):
assert client_auth.get("/api/tasks").status_code == 401
assert client_auth.get("/api/me").status_code == 401
def test_wrong_password_same_message(client_auth):
r = _login(client_auth, pw="nope")
assert r.status_code == 401
assert r.json()["detail"] == "이메일 또는 비밀번호가 올바르지 않아요"
# 존재하지 않는 계정도 동일 메시지(계정 열거 방어)
r2 = _login(client_auth, email="ghost@x.co")
assert r2.status_code == 401 and r2.json()["detail"] == "이메일 또는 비밀번호가 올바르지 않아요"
def test_login_then_protected_ok(client_auth):
_login(client_auth)
assert client_auth.get("/api/me").status_code == 200
assert client_auth.get("/api/tasks").status_code == 200
def test_logout_revokes_session(client_auth):
_login(client_auth)
assert client_auth.get("/api/me").status_code == 200
client_auth.post("/api/auth/logout")
assert client_auth.get("/api/me").status_code == 401
def test_api_token_bearer_auth(client_auth):
_login(client_auth)
tok = client_auth.post("/api/me/tokens", params={"name": "스크립트"}).json()
assert tok["token"] and tok["token"].startswith("ari_")
client_auth.post("/api/auth/logout")
# 쿠키 없이 베어러 토큰으로 접근
r = client_auth.get("/api/me", headers={"Authorization": f"Bearer {tok['token']}"})
assert r.status_code == 200 and r.json()["id"] == "jiwoo"