| """
|
| Authentication, Session Lifecycle, Rate Limiting, and CSRF Protection Tests.
|
| """
|
|
|
| from __future__ import annotations
|
|
|
| import datetime
|
| from collections.abc import Generator
|
|
|
| import pytest
|
| from fastapi.testclient import TestClient
|
| from sqlalchemy import select
|
|
|
| from backend.app.api.auth.rate_limiter import login_rate_limiter
|
| from backend.app.api.main import app, seed_default_accounts
|
| from backend.app.storage.database import SessionLocal
|
| from backend.app.storage.models.entities import StudentModel
|
|
|
|
|
| @pytest.fixture
|
| def client() -> Generator[TestClient, None, None]:
|
| seed_default_accounts()
|
| with TestClient(app) as c:
|
| yield c
|
|
|
|
|
| @pytest.fixture(autouse=True)
|
| def reset_rate_limiter() -> None:
|
|
|
| login_rate_limiter._attempts.clear()
|
|
|
|
|
| def test_officer_login_me_and_logout(client: TestClient) -> None:
|
|
|
| login_res = client.post("/api/auth/login", json={"username": "officer", "password": "officer123"})
|
| assert login_res.status_code == 200
|
| data = login_res.json()
|
| assert data["role"] == "officer"
|
| assert data["username"] == "officer"
|
| assert "csrf_token" in data
|
| assert "placement_session" in client.cookies
|
|
|
|
|
| me_res = client.get("/api/auth/me")
|
| assert me_res.status_code == 200
|
| assert me_res.json()["username"] == "officer"
|
|
|
|
|
| logout_res = client.post("/api/auth/logout")
|
| assert logout_res.status_code == 200
|
|
|
|
|
| after_res = client.get("/api/auth/me")
|
| assert after_res.status_code == 401
|
|
|
|
|
| def test_student_code_issuance_and_login(client: TestClient) -> None:
|
|
|
| db = SessionLocal()
|
| roll_no = "BT2026_TEST_01"
|
| stmt = select(StudentModel).where(StudentModel.roll_no == roll_no)
|
| stu = db.execute(stmt).scalar_one_or_none()
|
| if not stu:
|
| stu = StudentModel(
|
| id="stu_test_01",
|
| roll_no=roll_no,
|
| name="Alice Test",
|
| email="alice@college.edu",
|
| branch="CSE",
|
| program="B.Tech",
|
| cgpa=8.5,
|
| tenth_percentage=85.0,
|
| date_of_birth=datetime.date(2004, 5, 15),
|
| )
|
| db.add(stu)
|
| db.commit()
|
| db.close()
|
|
|
|
|
| login_res = client.post("/api/auth/login", json={"username": "officer", "password": "officer123"})
|
| assert login_res.status_code == 200
|
| csrf = login_res.json()["csrf_token"]
|
| issue_res = client.post(
|
| "/api/auth/student-otp/issue",
|
| json={"roll_no": roll_no},
|
| headers={"X-CSRF-Token": csrf},
|
| )
|
| assert issue_res.status_code == 200
|
| code = issue_res.json()["access_code"]
|
| assert len(code) == 6
|
|
|
|
|
| client.post("/api/auth/logout")
|
| student_login_res = client.post(
|
| "/api/auth/student-login",
|
| json={"roll_no": roll_no, "code": code, "date_of_birth": "2004-05-15"},
|
| )
|
| assert student_login_res.status_code == 200
|
| data = student_login_res.json()
|
| assert data["role"] == "student"
|
| assert data["username"] == roll_no
|
| assert data["student_id"] == "stu_test_01"
|
|
|
|
|
| def test_login_rate_limiting_enforcement(client: TestClient) -> None:
|
|
|
| for _ in range(5):
|
| res = client.post("/api/auth/login", json={"username": "officer", "password": "wrong_password"})
|
| assert res.status_code == 401
|
|
|
|
|
| res_6th = client.post("/api/auth/login", json={"username": "officer", "password": "wrong_password"})
|
| assert res_6th.status_code == 429
|
| assert "Too many failed login attempts" in res_6th.json()["detail"]
|
|
|
|
|
| def test_csrf_protection_on_mutations(client: TestClient) -> None:
|
|
|
| login_res = client.post("/api/auth/login", json={"username": "officer", "password": "officer123"})
|
| assert login_res.status_code == 200
|
| csrf_token = login_res.json().get("csrf_token")
|
| assert csrf_token is not None
|
|
|
|
|
| no_header_res = client.post("/api/policies/policy-001-strict-one-offer/activate")
|
| assert no_header_res.status_code == 403
|
|
|
|
|
| mismatch_res = client.post(
|
| "/api/policies/policy-001-strict-one-offer/activate",
|
| headers={"X-CSRF-Token": "tampered_token_xyz"},
|
| )
|
| assert mismatch_res.status_code == 403
|
| assert "CSRF token mismatch" in mismatch_res.json()["detail"]
|
|
|
|
|
| valid_res = client.post(
|
| "/api/policies/policy-001-strict-one-offer/activate",
|
| headers={"X-CSRF-Token": csrf_token},
|
| )
|
| assert valid_res.status_code == 200
|
|
|
