108 lines
3.7 KiB
Python
108 lines
3.7 KiB
Python
|
"""Tests for app/auth.py — Keycloak JWT authentication (#43).
|
||
|
|
|
||
|
|
These tests cover the auth module WITHOUT a running Keycloak server:
|
||
|
|
- Token extraction from headers/cookies
|
||
|
|
- Auth-disabled detection (Dev-Modus)
|
||
|
|
- _pick_best_title helper (in main.py, tested here for convenience)
|
||
|
|
"""
|
||
|
|
import sys
|
||
|
|
import types
|
||
|
|
|
||
|
|
# Stub jose if not installed locally
|
||
|
|
if "jose" not in sys.modules:
|
||
|
|
jose_stub = types.ModuleType("jose")
|
||
|
|
jose_jwt = types.ModuleType("jose.jwt")
|
||
|
|
jose_stub.jwt = jose_jwt
|
||
|
|
jose_stub.JWTError = Exception
|
||
|
|
jose_stub.ExpiredSignatureError = Exception
|
||
|
|
jose_jwt.get_unverified_header = lambda t: {"kid": "test"}
|
||
|
|
jose_jwt.decode = lambda *a, **kw: {"sub": "test", "email": "t@t.de"}
|
||
|
|
sys.modules["jose"] = jose_stub
|
||
|
|
sys.modules["jose.jwt"] = jose_jwt
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
from unittest.mock import MagicMock
|
||
|
|
from app.auth import _extract_token, _is_auth_enabled
|
||
|
|
|
||
|
|
|
||
|
|
class TestExtractToken:
|
||
|
|
def test_bearer_header(self):
|
||
|
|
req = MagicMock()
|
||
|
|
req.headers = {"authorization": "Bearer abc123"}
|
||
|
|
req.cookies = {}
|
||
|
|
assert _extract_token(req) == "abc123"
|
||
|
|
|
||
|
|
def test_cookie_fallback(self):
|
||
|
|
req = MagicMock()
|
||
|
|
req.headers = {}
|
||
|
|
req.cookies = {"access_token": "cookie_token"}
|
||
|
|
assert _extract_token(req) == "cookie_token"
|
||
|
|
|
||
|
|
def test_no_token(self):
|
||
|
|
req = MagicMock()
|
||
|
|
req.headers = {}
|
||
|
|
req.cookies = {}
|
||
|
|
assert _extract_token(req) is None
|
||
|
|
|
||
|
|
def test_non_bearer_header_ignored(self):
|
||
|
|
req = MagicMock()
|
||
|
|
req.headers = {"authorization": "Basic dXNlcjpwYXNz"}
|
||
|
|
req.cookies = {}
|
||
|
|
assert _extract_token(req) is None
|
||
|
|
|
||
|
|
|
||
|
|
class TestIsAuthEnabled:
|
||
|
|
def test_disabled_when_url_empty(self, monkeypatch):
|
||
|
|
from app import config
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_url", "")
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_realm", "test")
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_client_id", "test")
|
||
|
|
assert _is_auth_enabled() is False
|
||
|
|
|
||
|
|
def test_disabled_when_realm_empty(self, monkeypatch):
|
||
|
|
from app import config
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_url", "https://sso.test")
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_realm", "")
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_client_id", "test")
|
||
|
|
assert _is_auth_enabled() is False
|
||
|
|
|
||
|
|
def test_enabled_when_all_set(self, monkeypatch):
|
||
|
|
from app import config
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_url", "https://sso.test")
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_realm", "realm")
|
||
|
|
monkeypatch.setattr(config.settings, "keycloak_client_id", "client")
|
||
|
|
assert _is_auth_enabled() is True
|
||
|
|
|
||
|
|
|
||
|
|
try:
|
||
|
|
from app.main import _pick_best_title
|
||
|
|
_HAS_MAIN = True
|
||
|
|
except ImportError:
|
||
|
|
_HAS_MAIN = False
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.skipif(not _HAS_MAIN, reason="app.main not importable (missing slowapi/etc)")
|
||
|
|
class TestPickBestTitle:
|
||
|
|
"""Test _pick_best_title from main.py."""
|
||
|
|
|
||
|
|
def test_prefer_real_doc_title(self):
|
||
|
|
assert _pick_best_title(
|
||
|
|
"LLM-Titel", "Echte Antrag-Bezeichnung aus OPAL", "18/123"
|
||
|
|
) == "Echte Antrag-Bezeichnung aus OPAL"
|
||
|
|
|
||
|
|
def test_reject_generic_doc_title(self):
|
||
|
|
from app.main import _pick_best_title
|
||
|
|
result = _pick_best_title(
|
||
|
|
"Lehrkräfte stärken", "Drucksache 18/18085", "18/18085"
|
||
|
|
)
|
||
|
|
assert result == "Lehrkräfte stärken"
|
||
|
|
|
||
|
|
def test_fallback_to_llm_title(self):
|
||
|
|
assert _pick_best_title("LLM-Titel", None, "18/123") == "LLM-Titel"
|
||
|
|
|
||
|
|
def test_fallback_to_generic(self):
|
||
|
|
assert _pick_best_title("", None, "18/123") == "Drucksache 18/123"
|
||
|
|
|
||
|
|
def test_empty_doc_title_uses_llm(self):
|
||
|
|
assert _pick_best_title("Guter LLM-Titel", "", "18/123") == "Guter LLM-Titel"
|