You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
49 lines
2.0 KiB
Python
49 lines
2.0 KiB
Python
# backend/tests/test_auth.py — 로그인/로그아웃/세션/토큰 (AUTH_ENABLED=true)
|
|
def _login(c, email="jiwoo@lumi.co", pw="demo-1234"):
|
|
return c.post("/api/auth/login", json={"email": email, "password": pw})
|
|
|
|
|
|
def test_login_sets_cookie_and_returns_me(client_auth):
|
|
r = _login(client_auth)
|
|
assert r.status_code == 200, r.text
|
|
body = r.json()
|
|
assert body["id"] == "jiwoo" and body["initial"] == "지" and body["role"] == "admin"
|
|
assert "ari_session" in r.cookies
|
|
|
|
|
|
def test_protected_route_401_without_session(client_auth):
|
|
assert client_auth.get("/api/tasks").status_code == 401
|
|
assert client_auth.get("/api/me").status_code == 401
|
|
|
|
|
|
def test_wrong_password_same_message(client_auth):
|
|
r = _login(client_auth, pw="nope")
|
|
assert r.status_code == 401
|
|
assert r.json()["detail"] == "이메일 또는 비밀번호가 올바르지 않아요"
|
|
# 존재하지 않는 계정도 동일 메시지(계정 열거 방어)
|
|
r2 = _login(client_auth, email="ghost@x.co")
|
|
assert r2.status_code == 401 and r2.json()["detail"] == "이메일 또는 비밀번호가 올바르지 않아요"
|
|
|
|
|
|
def test_login_then_protected_ok(client_auth):
|
|
_login(client_auth)
|
|
assert client_auth.get("/api/me").status_code == 200
|
|
assert client_auth.get("/api/tasks").status_code == 200
|
|
|
|
|
|
def test_logout_revokes_session(client_auth):
|
|
_login(client_auth)
|
|
assert client_auth.get("/api/me").status_code == 200
|
|
client_auth.post("/api/auth/logout")
|
|
assert client_auth.get("/api/me").status_code == 401
|
|
|
|
|
|
def test_api_token_bearer_auth(client_auth):
|
|
_login(client_auth)
|
|
tok = client_auth.post("/api/me/tokens", params={"name": "스크립트"}).json()
|
|
assert tok["token"] and tok["token"].startswith("ari_")
|
|
client_auth.post("/api/auth/logout")
|
|
# 쿠키 없이 베어러 토큰으로 접근
|
|
r = client_auth.get("/api/me", headers={"Authorization": f"Bearer {tok['token']}"})
|
|
assert r.status_code == 200 and r.json()["id"] == "jiwoo"
|