cf62e65c55
Community edition generated from private repo via sync pipeline. Includes 9 plugins (WordPress, WooCommerce, WP Advanced, Gitea, n8n, Supabase, OpenPanel, Appwrite, Directus) with ~587 tools. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
79 lines
2.4 KiB
Python
79 lines
2.4 KiB
Python
import os
|
|
import tempfile
|
|
|
|
import jwt
|
|
import pytest
|
|
|
|
from core.oauth.token_manager import SecurityError, TokenManager
|
|
|
|
|
|
@pytest.fixture
|
|
def token_manager():
|
|
os.environ["OAUTH_JWT_SECRET_KEY"] = "test_secret_key"
|
|
# Use temporary directory for storage
|
|
with tempfile.TemporaryDirectory() as tmpdir:
|
|
os.environ["OAUTH_STORAGE_PATH"] = tmpdir
|
|
yield TokenManager()
|
|
|
|
|
|
def test_generate_access_token(token_manager):
|
|
"""Test access token generation"""
|
|
token = token_manager.generate_access_token(
|
|
client_id="test_client", scope="read write", user_id="user_123"
|
|
)
|
|
|
|
# Should be valid JWT
|
|
assert len(token.split(".")) == 3
|
|
|
|
# Validate
|
|
payload = token_manager.validate_access_token(token)
|
|
assert payload["client_id"] == "test_client"
|
|
assert payload["scope"] == "read write"
|
|
assert payload["sub"] == "user_123"
|
|
|
|
|
|
def test_access_token_expiry(token_manager):
|
|
"""Test expired token"""
|
|
# Generate with short TTL
|
|
token_manager.access_token_ttl = 1
|
|
token = token_manager.generate_access_token("client", "read")
|
|
|
|
import time
|
|
|
|
time.sleep(2)
|
|
|
|
# Should raise
|
|
with pytest.raises(jwt.ExpiredSignatureError):
|
|
token_manager.validate_access_token(token)
|
|
|
|
|
|
def test_refresh_token_rotation(token_manager):
|
|
"""Test refresh token rotation"""
|
|
# Generate initial tokens
|
|
access_token = token_manager.generate_access_token("client", "read")
|
|
refresh_token = token_manager.generate_refresh_token("client", access_token)
|
|
|
|
# Rotate
|
|
new_tokens = token_manager.rotate_refresh_token(refresh_token, "client")
|
|
|
|
assert "access_token" in new_tokens
|
|
assert "refresh_token" in new_tokens
|
|
assert new_tokens["refresh_token"] != refresh_token
|
|
|
|
# Old token should be revoked - reuse triggers SecurityError
|
|
with pytest.raises(SecurityError, match="reuse detected"):
|
|
token_manager.rotate_refresh_token(refresh_token, "client")
|
|
|
|
|
|
def test_refresh_token_reuse_detection(token_manager):
|
|
"""Test reuse detection"""
|
|
access_token = token_manager.generate_access_token("client", "read")
|
|
refresh_token = token_manager.generate_refresh_token("client", access_token)
|
|
|
|
# First rotation
|
|
token_manager.rotate_refresh_token(refresh_token, "client")
|
|
|
|
# Attempt reuse
|
|
with pytest.raises(SecurityError, match="reuse detected"):
|
|
token_manager.rotate_refresh_token(refresh_token, "client")
|