--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
tests/backend/test_http_auth_security.py 0f5034642f21e3ad4f4a71dfe0cee8e5b0f0ee5c (0f503464) Text, 5.65 KB
T8b949e# SPDX-License-Identifier: 0BSD
Tff7b72import T7ee787asyncio
Tff7b72import T7ee787secrets
Tff7b72import T7ee787bcrypt
Tff7b72import T7ee787pytest
Tff7b72from T7ee787aiohttp Tff7b72import Te6edf3web
Tff7b72from T7ee787aiohttpT7ee787.T7ee787test_utils Tff7b72import Te6edf3TestClientTb4b4b4, Te6edf3TestServer
Tff7b72from T7ee787aiohttp_session Tff7b72import Te6edf3setup Tff7b72as Te6edf3setup_session
Tff7b72from T7ee787hypothesis Tff7b72import Te6edf3HealthCheckTb4b4b4, Te6edf3givenTb4b4b4, Te6edf3settings
Tff7b72from T7ee787hypothesis Tff7b72import Te6edf3strategies Tff7b72as Te6edf3st
Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787config_manager Tff7b72import Te6edf3ConfigManager
Tff7b72def Td2a8ff_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTb4b4b4: Tffa657boolTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffsession_secret_key Tff7b72= Te6edf3secretsTff7b72.Td2a8fftoken_urlsafeTb4b4b4(T79c0ff32Tb4b4b4)
Te6edf3routes Tff7b72= Te6edf3webTff7b72.Td2a8ffRouteTableDefTb4b4b4(Tb4b4b4)
Te6edf3auth_mwTb4b4b4, Te6edf3mime_mwTb4b4b4, Te6edf3sec_mw Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_define_routesTb4b4b4(Te6edf3routesTb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3webTff7b72.Td2a8ffApplicationTb4b4b4(Tb4b4b4)
Te6edf3setup_sessionTb4b4b4(Te6edf3aio_appTb4b4b4, Te6edf3mock_appTff7b72.Td2a8ff_encrypted_cookie_storageTb4b4b4(Te6edf3use_httpsTb4b4b4)Tb4b4b4)
Te6edf3aio_appTff7b72.Td2a8ffmiddlewaresTff7b72.Td2a8ffextendTb4b4b4(Tb4b4b4[Te6edf3auth_mwTb4b4b4, Te6edf3mime_mwTb4b4b4, Te6edf3sec_mwTb4b4b4]Tb4b4b4)
Te6edf3aio_appTff7b72.Td2a8ffadd_routesTb4b4b4(Te6edf3routesTb4b4b4)
Tff7b72return Te6edf3aio_app
Tff7b72def Td2a8fftest_config_password_hash_roundtripTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(Ta5d6ff"Ta5d6ffroundtrip-test-hashTa5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffgetTb4b4b4(Tb4b4b4) Tff7b72== Ta5d6ff"Ta5d6ffroundtrip-test-hashTa5d6ff"
Tff7b72def Td2a8fftest_config_bcrypt_hash_roundtripTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3h Tff7b72= Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6ffpwTa5d6ff"Tb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(Te6edf3hTb4b4b4)
Tff7b72assert Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffgetTb4b4b4(Tb4b4b4) Tff7b72== Te6edf3h
Tff7b72def Td2a8fftest_encrypted_cookie_storage_https_flagsTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffsession_secret_key Tff7b72= Te6edf3secretsTff7b72.Td2a8fftoken_urlsafeTb4b4b4(T79c0ff32Tb4b4b4)
Te6edf3storage Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_encrypted_cookie_storageTb4b4b4(Tff7b72TrueTb4b4b4)
Tff7b72assert Te6edf3storageTff7b72.Td2a8ffcookie_paramsTb4b4b4[Ta5d6ff"Ta5d6ffsecureTa5d6ff"Tb4b4b4] Tff7b72is Tff7b72True
Tff7b72assert Te6edf3storageTff7b72.Td2a8ffcookie_paramsTb4b4b4[Ta5d6ff"Ta5d6ffhttponlyTa5d6ff"Tb4b4b4] Tff7b72is Tff7b72True
Tff7b72assert Te6edf3storageTff7b72.Td2a8ffcookie_paramsTb4b4b4[Ta5d6ff"Ta5d6ffsamesiteTa5d6ff"Tb4b4b4] Tff7b72== Ta5d6ff"Ta5d6ffLaxTa5d6ff"
Tff7b72def Td2a8fftest_encrypted_cookie_storage_http_flagsTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffsession_secret_key Tff7b72= Te6edf3secretsTff7b72.Td2a8fftoken_urlsafeTb4b4b4(T79c0ff32Tb4b4b4)
Te6edf3storage Tff7b72= Te6edf3mock_appTff7b72.Td2a8ff_encrypted_cookie_storageTb4b4b4(Tff7b72FalseTb4b4b4)
Tff7b72assert Te6edf3storageTff7b72.Td2a8ffcookie_paramsTb4b4b4[Ta5d6ff"Ta5d6ffsecureTa5d6ff"Tb4b4b4] Tff7b72is Tff7b72False
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_login_sets_cookie_and_allows_protected_apiTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3pw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6ffintegration-test-password-okTa5d6ff"
Te6edf3stored_hash Tff7b72= Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Te6edf3pwTb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(Te6edf3stored_hashTb4b4b4)
Tff7b72assert Tffa657isinstanceTb4b4b4(Te6edf3mock_appTff7b72.Td2a8ffcurrent_contextTff7b72.Td2a8ffconfigTb4b4b4, Te6edf3ConfigManagerTb4b4b4)
Tff7b72assert Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffgetTb4b4b4(Tb4b4b4) Tff7b72== Te6edf3stored_hash
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3login Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Te6edf3pwTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3loginTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200
Te6edf3set_cookie Tff7b72= Te6edf3loginTff7b72.Td2a8ffheadersTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffSet-CookieTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff"Tb4b4b4)
Tff7b72assert Ta5d6ff"Ta5d6ffHttpOnlyTa5d6ff" Tff7b72in Te6edf3set_cookie
Tff7b72assert Ta5d6ff"Ta5d6ffSameSite=LaxTa5d6ff" Tff7b72in Te6edf3set_cookie
Tff7b72assert Ta5d6ff"Ta5d6ffSecureTa5d6ff" Tff7b72not Tff7b72in Te6edf3set_cookie
Te6edf3backups Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/database/backupsTa5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3backupsTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200
Te6edf3body Tff7b72= Tff7b72await Te6edf3backupsTff7b72.Td2a8ffjsonTb4b4b4(Tb4b4b4)
Tff7b72assert Ta5d6ff"Ta5d6ffbackupsTa5d6ff" Tff7b72in Te6edf3body
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_ws_returns_401_without_session_when_auth_enabledTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6ffxTa5d6ff"Tb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/wsTa5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff401
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_logout_clears_session_for_protected_apiTb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3pw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6fflogout-test-password-okTa5d6ff"
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Te6edf3pwTb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4, Te6edf3jsonTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffpasswordTa5d6ff"Tb4b4b4: Te6edf3pwTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4}Tb4b4b4)
Tff7b72assert Tb4b4b4(Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/database/backupsTa5d6ff"Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffstatus Tff7b72== T79c0ff200
Te6edf3out Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/auth/logoutTa5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3outTff7b72.Td2a8ffstatus Tff7b72== T79c0ff200
Tff7b72assert Tb4b4b4(Tff7b72await Te6edf3clientTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ff/api/v1/database/backupsTa5d6ff"Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffstatus Tff7b72== T79c0ff401
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffasyncio
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72async Tff7b72def Td2a8fftest_auth_login_invalid_json_returns_400Tb4b4b4(Te6edf3mock_appTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6ffxTa5d6ff"Tb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3dataTff7b72=Ta5d6ff"Ta5d6ff{Ta5d6ffnot-jsonTa5d6ff"Tb4b4b4,
Te6edf3headersTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffContent-TypeTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffapplication/jsonTa5d6ff"Tb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72== T79c0ff400
Te6edf3body Tff7b72= Tff7b72await Te6edf3rTff7b72.Td2a8ffjsonTb4b4b4(Tb4b4b4)
Tff7b72assert Ta5d6ff"Ta5d6fferrorTa5d6ff" Tff7b72in Te6edf3body
Tf0883e@settingsTb4b4b4(
Te6edf3max_examplesTff7b72=T79c0ff40Tb4b4b4,
Te6edf3suppress_health_checkTff7b72=Tb4b4b4[Te6edf3HealthCheckTff7b72.Td2a8fffunction_scoped_fixtureTb4b4b4]Tb4b4b4,
Te6edf3deadlineTff7b72=Tff7b72NoneTb4b4b4,
Tb4b4b4)
Tf0883e@givenTb4b4b4(Te6edf3bodyTff7b72=Te6edf3stTff7b72.Td2a8ffbinaryTb4b4b4(Te6edf3min_sizeTff7b72=T79c0ff0Tb4b4b4, Te6edf3max_sizeTff7b72=T79c0ff12000Tb4b4b4)Tb4b4b4)
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffusefixturesTb4b4b4(Ta5d6ff"Ta5d6ffrequire_loopback_tcpTa5d6ff"Tb4b4b4)
Tff7b72def Td2a8fftest_auth_login_fuzz_never_500Tb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3bodyTb4b4b4)Tb4b4b4:
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_enabledTff7b72.Td2a8ffsetTb4b4b4(Tff7b72TrueTb4b4b4)
Te6edf3mock_appTff7b72.Td2a8ffconfigTff7b72.Td2a8ffauth_password_hashTff7b72.Td2a8ffsetTb4b4b4(
Te6edf3bcryptTff7b72.Td2a8ffhashpwTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6fffixedTa5d6ff"Tb4b4b4, Te6edf3bcryptTff7b72.Td2a8ffgensaltTb4b4b4(Tb4b4b4)Tb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)
Te6edf3aio_app Tff7b72= Te6edf3_make_aio_appTb4b4b4(Te6edf3mock_appTb4b4b4, Te6edf3use_httpsTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72async Tff7b72def Td2a8ffrunTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72async Tff7b72with Te6edf3TestClientTb4b4b4(Te6edf3TestServerTb4b4b4(Te6edf3aio_appTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3clientTb4b4b4:
Te6edf3r Tff7b72= Tff7b72await Te6edf3clientTff7b72.Td2a8ffpostTb4b4b4(
Ta5d6ff"Ta5d6ff/api/v1/auth/loginTa5d6ff"Tb4b4b4,
Te6edf3dataTff7b72=Te6edf3bodyTb4b4b4,
Te6edf3headersTff7b72=Tb4b4b4{Ta5d6ff"Ta5d6ffContent-TypeTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffapplication/jsonTa5d6ff"Tb4b4b4}Tb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3rTff7b72.Td2a8ffstatus Tff7b72!= T79c0ff500
Te6edf3asyncioTff7b72.Td2a8ffrunTb4b4b4(Te6edf3runTb4b4b4(Tb4b4b4)Tb4b4b4)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────