Spaces:
Running
Running
| """ | |
| check_auth.py — offline checks for login (services/auth.py). No network, no database. | |
| uv run python scripts/check_auth.py | |
| Covers the session token (sign / verify / tamper / expiry / wrong secret), the | |
| company-domain rule, and verify_google_credential() against FAKE Google replies | |
| (wrong audience, unverified email, wrong domain, wrong hd, good). A real Google | |
| sign-in still needs a Google Client ID and is tested in the browser. | |
| """ | |
| from __future__ import annotations | |
| import sys | |
| from pathlib import Path | |
| sys.path.insert(0, str(Path(__file__).resolve().parent.parent)) | |
| from app.config import settings # noqa: E402 | |
| from app.services import auth # noqa: E402 | |
| FAILED = 0 | |
| def check(label: str, ok: bool) -> None: | |
| global FAILED | |
| FAILED += 0 if ok else 1 | |
| print(f" [{'ok ' if ok else 'FAIL'}] {label}") | |
| class FakeResp: | |
| def __init__(self, status: int, data: dict): | |
| self.status_code = status | |
| self._data = data | |
| def json(self): | |
| return self._data | |
| def google_reply(**overrides) -> dict: | |
| base = { | |
| "aud": "client-123", "iss": "https://accounts.google.com", "email_verified": "true", | |
| "email": "ali@elipsestudio.com", "name": "Ali Khan", "picture": "http://x/p.png", "hd": "elipsestudio.com", | |
| } | |
| base.update(overrides) | |
| return base | |
| def expect_error(credential_reply: dict | None, status: int = 200) -> bool: | |
| auth.requests.get = lambda *a, **k: FakeResp(status, credential_reply or {}) # type: ignore[assignment] | |
| try: | |
| auth.verify_google_credential("tok") | |
| return False | |
| except auth.AuthError: | |
| return True | |
| def main() -> int: | |
| settings.auth_secret = "s" * 40 | |
| settings.google_client_id = "client-123" | |
| settings.allowed_email_domains = "elipsestudio.com, other.org" | |
| settings.allowed_emails = "" # ignore whatever the real .env lists, so this test is the same on every machine | |
| settings.auth_token_days = 7 | |
| print("\nsession token") | |
| tok = auth.create_token(7, "ali@elipsestudio.com", "Ali Khan") | |
| claims = auth.decode_token(tok) | |
| check("a fresh token verifies and carries the user id", claims is not None and claims["sub"] == "7") | |
| check("three dot-separated JWT parts", tok.count(".") == 2) | |
| h, p, sig = tok.split(".") | |
| check("tampered payload is rejected", auth.decode_token(f"{h}.{p[:-2]}xx.{sig}") is None) | |
| check("tampered signature is rejected", auth.decode_token(f"{h}.{p}.{sig[:-2]}xx") is None) | |
| check("an expired token is rejected", auth.decode_token(auth.create_token(7, "a@elipsestudio.com", "A", days=-1)) is None) | |
| check("garbage is rejected, not raised", auth.decode_token("not-a-token") is None and auth.decode_token("") is None) | |
| settings.auth_secret = "t" * 40 | |
| check("a token signed with another secret is rejected", auth.decode_token(tok) is None) | |
| settings.auth_secret = "s" * 40 | |
| settings.auth_secret = "" | |
| check("no AUTH_SECRET -> cannot issue a token", _raises(lambda: auth.create_token(1, "a@b.c", "A"))) | |
| check("no AUTH_SECRET -> nothing verifies", auth.decode_token(tok) is None) | |
| settings.auth_secret = "s" * 40 | |
| print("\ncompany domain") | |
| check("elipsestudio.com allowed", auth.email_domain_allowed("Ali@ElipseStudio.com")) | |
| check("second configured domain allowed", auth.email_domain_allowed("x@other.org")) | |
| check("gmail.com refused", not auth.email_domain_allowed("ali@gmail.com")) | |
| check("look-alike domain refused", not auth.email_domain_allowed("ali@elipsestudio.com.evil.io")) | |
| check("sub-domain refused", not auth.email_domain_allowed("ali@mail.elipsestudio.com")) | |
| check("no @ refused", not auth.email_domain_allowed("elipsestudio.com")) | |
| print("\napproved emails (ALLOWED_EMAILS)") | |
| settings.allowed_emails = "Boss@Gmail.com, sara@partner.io" | |
| check("a listed email is allowed, case-insensitive", auth.email_allowed("boss@gmail.com")) | |
| check("an unlisted gmail is still refused", not auth.email_allowed("other@gmail.com")) | |
| check("a company-domain email is still allowed by domain", auth.email_allowed("x@elipsestudio.com")) | |
| check("a look-alike of a listed email is refused", not auth.email_allowed("boss@gmail.com.evil.io")) | |
| settings.allowed_emails = "" | |
| print("\nverify_google_credential (fake Google replies)") | |
| real_get = auth.requests.get | |
| try: | |
| auth.requests.get = lambda *a, **k: FakeResp(200, google_reply()) # type: ignore[assignment] | |
| who = auth.verify_google_credential("tok") | |
| check("a good reply returns email/name/picture", who["email"] == "ali@elipsestudio.com" and who["name"] == "Ali Khan") | |
| check("Google says invalid (HTTP 400)", expect_error({}, 400)) | |
| check("wrong audience refused", expect_error(google_reply(aud="someone-else"))) | |
| check("wrong issuer refused", expect_error(google_reply(iss="https://evil.example"))) | |
| check("unverified email refused", expect_error(google_reply(email_verified="false"))) | |
| check("gmail address refused", expect_error(google_reply(email="ali@gmail.com", hd=""))) | |
| check("wrong hd refused even with a good-looking email", expect_error(google_reply(hd="evil.io"))) | |
| settings.google_client_id = "" | |
| check("no GOOGLE_CLIENT_ID -> clear error", expect_error(google_reply())) | |
| finally: | |
| auth.requests.get = real_get | |
| print() | |
| print("All checks passed." if not FAILED else f"{FAILED} check(s) FAILED") | |
| return 1 if FAILED else 0 | |
| def _raises(fn) -> bool: | |
| try: | |
| fn() | |
| except auth.AuthError: | |
| return True | |
| return False | |
| if __name__ == "__main__": | |
| sys.exit(main()) | |