tests/api/lk/test_auth.py - master - tsps/core

tests/api/lk/test_auth.py
154 строки5 KB
Василий Петров
Аутентификация в ЛК с разделением с админкой
14 мар 2026, 14:37
14 мар 2026, 14:373d80156
import uuid
from app.models.judge import Judge
from app.models.judge_account import JudgeAccount
from app.core.security import _SESSIONS


def test_login_success(client, db_session):
    email = f"judge_{uuid.uuid4().hex}@example.com"

    # Создаём судью
    judge = Judge(
        last_name="Иванов",
        first_name="Иван",
        middle_name="Иванович"
    )
    db_session.add(judge)
    db_session.commit()
    db_session.refresh(judge)

    # Создаём аккаунт
    account = JudgeAccount(
        judge_id=judge.id,
        email=email,
        is_active=True
    )
    account.set_password("password123")
    db_session.add(account)
    db_session.commit()

    # Запрос
    response = client.post("/api/lk/login", data={
        "email": email,
        "password": "password123"
    })

    assert response.status_code == 200
    data = response.json()
    assert "access_token" in data
    assert "account" in data
    assert "judge" in data

    # Проверка данных аккаунта
    account_info = data["account"]
    assert account_info["email"] == email
    assert account_info["id"] == account.id

    # Проверка данных судьи
    judge_info = data["judge"]
    assert judge_info["id"] == judge.id
    assert judge_info["last_name"] == "Иванов"
    assert judge_info["first_name"] == "Иван"
    assert judge_info["middle_name"] == "Иванович"


def test_login_inactive_account(client, db_session):
    """Проверка блокировки неактивного аккаунта."""
    email = f"judge_{uuid.uuid4().hex}@example.com"

    judge = Judge(last_name="Петров", first_name="Петр")
    db_session.add(judge)
    db_session.commit()
    db_session.refresh(judge)

    account = JudgeAccount(
        judge_id=judge.id,
        email=email,
        is_active=False  # Аккаунт заблокирован
    )
    account.set_password("password123")
    db_session.add(account)
    db_session.commit()

    response = client.post("/api/lk/login", data={
        "email": email,
        "password": "password123"
    })

    assert response.status_code == 403
    assert response.json() == {"detail": "Аккаунт заблокирован"}


def test_login_wrong_password(client, db_session):
    email = f"judge_{uuid.uuid4().hex}@example.com"
    password = "correct_password"

    judge = Judge(last_name="Сидоров", first_name="Сидор")
    db_session.add(judge)
    db_session.commit()
    db_session.refresh(judge)

    account = JudgeAccount(judge_id=judge.id, email=email, is_active=True)
    account.set_password(password)
    db_session.add(account)
    db_session.commit()

    response = client.post("/api/lk/login", data={
        "email": email,
        "password": "wrong_password"
    })
    assert response.status_code == 401
    assert response.json() == {"detail": "Неверный логин или пароль"}


def test_login_nonexistent_email(client, db_session):
    email = f"nonexistent_{uuid.uuid4().hex}@example.com"
    response = client.post("/api/lk/login", data={
        "email": email,
        "password": "anything"
    })
    assert response.status_code == 401
    assert response.json() == {"detail": "Неверный логин или пароль"}


def test_logout_success(client, db_session):
    # Подготавливаем судью и аккаунт
    email = f"judge_{uuid.uuid4().hex}@example.com"

    judge = Judge(last_name="Тестов", first_name="Тест")
    db_session.add(judge)
    db_session.commit()
    db_session.refresh(judge)

    account = JudgeAccount(judge_id=judge.id, email=email, is_active=True)
    account.set_password("password123")
    db_session.add(account)
    db_session.commit()

    # Логинимся и получаем токен
    login_resp = client.post("/api/lk/login", data={
        "email": email,
        "password": "password123"
    })
    token = login_resp.json()["access_token"]

    # Убеждаемся, что токен есть в сессиях
    assert token in _SESSIONS

    # Выполняем выход
    logout_resp = client.post("/api/lk/logout", headers={
        "Authorization": f"Bearer {token}"
    })
    assert logout_resp.status_code == 200
    assert logout_resp.json() == {"message": "Выход выполнен успешно"}

    # Проверяем, что токен удалён
    assert token not in _SESSIONS

    # 5. Попытка использовать отозванный токен (проверка на любом защищённом эндпоинте lk, пока заглушка)
    # Если защищённых эндпоинтов кроме логаута ещё нет, можно проверить просто повторный logout
    logout_again_resp = client.post("/api/lk/logout", headers={
        "Authorization": f"Bearer {token}"
    })
    assert logout_again_resp.status_code == 401
    assert logout_again_resp.json() == {"detail": "Токен недействителен или уже удалён"}