services/api/tests/test_auth.py - master - Mihaham/Table-Time

services/api/tests/test_auth.py
145 строк4 KB
MihahamYT
fix: ruff lint for CI and GitVerse Pages deploy workflow
14 июн 2026, 10:47
14 июн 2026, 10:47b35fc39
import uuid
from datetime import UTC, datetime, timedelta

from jose import jwt

from app.config import get_settings
from tests.conftest import auth_header, guest_auth


def test_health(client):
    r = client.get("/health")
    assert r.status_code == 200
    assert r.json()["status"] == "ok"


def test_guest_token(client):
    r = client.post("/api/v1/auth/guest", json={"display_name": "TestGuest"})
    assert r.status_code == 200
    data = r.json()
    assert "guest_token" in data or "access_token" in data
    assert data.get("guest_id")


def test_unauthorized_without_token(client):
    r = client.post("/api/v1/sessions", json={"display_name": "X", "max_players": 4})
    assert r.status_code == 401


def test_register_and_login(client):
    email = f"user_{uuid.uuid4().hex[:8]}@test.com"
    r = client.post(
        "/api/v1/auth/register",
        json={"email": email, "password": "secret123", "display_name": "User"},
    )
    assert r.status_code == 201
    tokens = r.json()
    assert tokens["access_token"]

    r2 = client.post("/api/v1/auth/login", json={"email": email, "password": "secret123"})
    assert r2.status_code == 200

    r3 = client.post("/api/v1/auth/login", json={"email": email, "password": "wrong"})
    assert r3.status_code == 401


def test_register_duplicate_email(client):
    email = f"dup_{uuid.uuid4().hex[:8]}@test.com"
    client.post(
        "/api/v1/auth/register",
        json={"email": email, "password": "secret123"},
    )
    r = client.post(
        "/api/v1/auth/register",
        json={"email": email, "password": "secret123"},
    )
    assert r.status_code == 409


def test_refresh_token(client):
    email = f"refresh_{uuid.uuid4().hex[:8]}@test.com"
    r = client.post(
        "/api/v1/auth/register",
        json={"email": email, "password": "secret123"},
    )
    refresh = r.json()["refresh_token"]
    r2 = client.post("/api/v1/auth/refresh", json={"refresh_token": refresh})
    assert r2.status_code == 200
    assert r2.json()["access_token"]

    r3 = client.post("/api/v1/auth/refresh", json={"refresh_token": "invalid"})
    assert r3.status_code == 401


def test_get_me_guest(client):
    token, _ = guest_auth(client, "MeGuest")
    r = client.get("/api/v1/auth/me", headers=auth_header(token))
    assert r.status_code == 200
    assert r.json()["is_guest"] is True


def test_get_me_user(client):
    email = f"me_{uuid.uuid4().hex[:8]}@test.com"
    r = client.post(
        "/api/v1/auth/register",
        json={"email": email, "password": "secret123", "display_name": "Me"},
    )
    token = r.json()["access_token"]
    r2 = client.get("/api/v1/auth/me", headers=auth_header(token, guest=False))
    assert r2.status_code == 200
    assert r2.json()["email"] == email


def test_expired_token_rejected(client):
    settings = get_settings()
    expired = jwt.encode(
        {"sub": "guest_abc", "type": "guest", "display_name": "X", "exp": datetime.now(UTC) - timedelta(hours=1)},
        settings.jwt_secret,
        algorithm="HS256",
    )
    r = client.post(
        "/api/v1/sessions",
        json={"display_name": "X", "max_players": 4},
        headers={"Authorization": f"Guest {expired}"},
    )
    assert r.status_code == 401


def test_get_me_user_with_history(client):
    email = f"hist_{uuid.uuid4().hex[:8]}@test.com"
    r = client.post(
        "/api/v1/auth/register",
        json={"email": email, "password": "secret123", "display_name": "Hist"},
    )
    token = r.json()["access_token"]
    r2 = client.get("/api/v1/auth/me", headers=auth_header(token, guest=False))
    assert r2.status_code == 200
    assert "match_history" in r2.json()


def test_create_session_invite_collision_handling(client, monkeypatch):

    async def boom(*args, **kwargs):
        raise RuntimeError("collision")

    monkeypatch.setattr("app.modules.session.service.SessionService.create_session", boom)
    token, _ = guest_auth(client)
    r = client.post(
        "/api/v1/sessions",
        json={"display_name": "X", "max_players": 4},
        headers=auth_header(token),
    )
    assert r.status_code == 503


def test_telegram_login_invalid_hash(client):
    r = client.post(
        "/api/v1/auth/telegram",
        json={
            "id": 123,
            "first_name": "Test",
            "auth_date": 1700000000,
            "hash": "bad",
        },
    )
    assert r.status_code == 401