Ryan Kegel
ebaef16daf
All checks were successful
Chore App Build, Test, and Push Docker Images / build-and-push (push) Successful in 3m23s
- Introduced a dual-token system for user authentication: a short-lived access token and a long-lived rotating refresh token. - Created a new RefreshToken model to manage refresh tokens securely. - Updated auth_api.py to handle login, refresh, and logout processes with the new token system. - Enhanced security measures including token rotation and theft detection. - Updated frontend to handle token refresh on 401 errors and adjusted SSE authentication. - Removed CORS middleware as it's unnecessary behind the nginx proxy. - Added tests to ensure functionality and security of the new token system.
136 lines
4.6 KiB
Python
136 lines
4.6 KiB
Python
import pytest
|
|
from tests.conftest import TEST_SECRET_KEY, TEST_REFRESH_TOKEN_EXPIRY_DAYS
|
|
import os
|
|
from werkzeug.security import generate_password_hash
|
|
|
|
from flask import Flask
|
|
from api.chore_api import chore_api
|
|
from api.auth_api import auth_api
|
|
from db.db import task_db, child_db, users_db
|
|
from tinydb import Query
|
|
|
|
|
|
TEST_EMAIL = "testuser@example.com"
|
|
TEST_PASSWORD = "testpass"
|
|
|
|
def add_test_user():
|
|
users_db.remove(Query().email == TEST_EMAIL)
|
|
users_db.insert({
|
|
"id": "testuserid",
|
|
"first_name": "Test",
|
|
"last_name": "User",
|
|
"email": TEST_EMAIL,
|
|
"password": generate_password_hash(TEST_PASSWORD),
|
|
"verified": True,
|
|
"image_id": "boy01"
|
|
})
|
|
|
|
def login_and_set_cookie(client):
|
|
resp = client.post('/auth/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
|
|
assert resp.status_code == 200
|
|
|
|
@pytest.fixture
|
|
def client():
|
|
app = Flask(__name__)
|
|
app.register_blueprint(chore_api)
|
|
app.register_blueprint(auth_api, url_prefix='/auth')
|
|
app.config['TESTING'] = True
|
|
app.config['SECRET_KEY'] = TEST_SECRET_KEY
|
|
app.config['REFRESH_TOKEN_EXPIRY_DAYS'] = TEST_REFRESH_TOKEN_EXPIRY_DAYS
|
|
with app.test_client() as client:
|
|
add_test_user()
|
|
login_and_set_cookie(client)
|
|
yield client
|
|
|
|
|
|
def test_add_chore(client):
|
|
task_db.truncate()
|
|
response = client.put('/chore/add', json={'name': 'Wash Dishes', 'points': 10})
|
|
assert response.status_code == 201
|
|
tasks = task_db.all()
|
|
assert any(t.get('name') == 'Wash Dishes' and t.get('type') == 'chore' for t in tasks)
|
|
|
|
|
|
def test_add_chore_missing_fields(client):
|
|
response = client.put('/chore/add', json={'name': 'No Points'})
|
|
assert response.status_code == 400
|
|
|
|
|
|
def test_list_chores(client):
|
|
task_db.truncate()
|
|
task_db.insert({'id': 'c1', 'name': 'Chore A', 'points': 5, 'type': 'chore', 'user_id': 'testuserid'})
|
|
task_db.insert({'id': 'k1', 'name': 'Kind Act', 'points': 3, 'type': 'kindness', 'user_id': 'testuserid'})
|
|
task_db.insert({'id': 'p1', 'name': 'Penalty X', 'points': 2, 'type': 'penalty', 'user_id': 'testuserid'})
|
|
response = client.get('/chore/list')
|
|
assert response.status_code == 200
|
|
data = response.get_json()
|
|
assert len(data['tasks']) == 1
|
|
assert data['tasks'][0]['id'] == 'c1'
|
|
|
|
|
|
def test_get_chore(client):
|
|
task_db.truncate()
|
|
task_db.insert({'id': 'c_get', 'name': 'Sweep', 'points': 5, 'type': 'chore', 'user_id': 'testuserid'})
|
|
response = client.get('/chore/c_get')
|
|
assert response.status_code == 200
|
|
data = response.get_json()
|
|
assert data['name'] == 'Sweep'
|
|
|
|
|
|
def test_get_chore_not_found(client):
|
|
response = client.get('/chore/nonexistent')
|
|
assert response.status_code == 404
|
|
|
|
|
|
def test_edit_chore(client):
|
|
task_db.truncate()
|
|
task_db.insert({'id': 'c_edit', 'name': 'Old Name', 'points': 5, 'type': 'chore', 'user_id': 'testuserid'})
|
|
response = client.put('/chore/c_edit/edit', json={'name': 'New Name', 'points': 15})
|
|
assert response.status_code == 200
|
|
data = response.get_json()
|
|
assert data['name'] == 'New Name'
|
|
assert data['points'] == 15
|
|
|
|
|
|
def test_edit_system_chore_clones_to_user(client):
|
|
task_db.truncate()
|
|
task_db.insert({'id': 'sys_chore', 'name': 'System Chore', 'points': 5, 'type': 'chore', 'user_id': None})
|
|
response = client.put('/chore/sys_chore/edit', json={'name': 'My Chore'})
|
|
assert response.status_code == 200
|
|
data = response.get_json()
|
|
assert data['name'] == 'My Chore'
|
|
assert data['user_id'] == 'testuserid'
|
|
assert data['id'] != 'sys_chore' # New ID since cloned
|
|
|
|
|
|
def test_delete_chore(client):
|
|
task_db.truncate()
|
|
task_db.insert({'id': 'c_del', 'name': 'Delete Me', 'points': 5, 'type': 'chore', 'user_id': 'testuserid'})
|
|
response = client.delete('/chore/c_del')
|
|
assert response.status_code == 200
|
|
assert task_db.get(Query().id == 'c_del') is None
|
|
|
|
|
|
def test_delete_chore_not_found(client):
|
|
response = client.delete('/chore/nonexistent')
|
|
assert response.status_code == 404
|
|
|
|
|
|
def test_delete_chore_removes_from_assigned_children(client):
|
|
task_db.truncate()
|
|
child_db.truncate()
|
|
task_db.insert({'id': 'c_cascade', 'name': 'Cascade', 'points': 5, 'type': 'chore', 'user_id': 'testuserid'})
|
|
child_db.insert({
|
|
'id': 'child_cascade',
|
|
'name': 'Alice',
|
|
'age': 8,
|
|
'points': 0,
|
|
'tasks': ['c_cascade'],
|
|
'rewards': [],
|
|
'user_id': 'testuserid'
|
|
})
|
|
response = client.delete('/chore/c_cascade')
|
|
assert response.status_code == 200
|
|
child = child_db.get(Query().id == 'child_cascade')
|
|
assert 'c_cascade' not in child.get('tasks', [])
|