File size: 5,140 Bytes
1520141 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 | import sys
import time
import jwt
import pytest
from app.config import settings
from app.utils.auth import verify_supabase_jwt
# Ensure settings has a valid secret key
if not hasattr(settings, "SUPABASE_JWT_SECRET") or not settings.SUPABASE_JWT_SECRET:
settings.SUPABASE_JWT_SECRET = "supabase-jwt-secret-placeholder-2026-secure-random"
def test_verify_valid_token():
# Generate a valid token
payload = {
"sub": "test-user-123",
"email": "test@example.com",
"aud": "authenticated",
"exp": int(time.time()) + 3600,
"user_metadata": {
"full_name": "Test User",
"avatar_url": "https://example.com/avatar.jpg"
}
}
token = jwt.encode(payload, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
decoded = verify_supabase_jwt(token)
assert decoded["uid"] == "test-user-123"
assert decoded["email"] == "test@example.com"
assert decoded["name"] == "Test User"
assert decoded["picture"] == "https://example.com/avatar.jpg"
assert decoded["exp"] == payload["exp"]
def test_verify_token_fallback_keys():
# Test fallback name/picture in claims
payload = {
"sub": "test-user-fallback",
"email": "fallback@example.com",
"aud": "authenticated",
"exp": int(time.time()) + 3600,
"name": "Fallback Name",
"picture": "https://example.com/fallback.jpg"
}
token = jwt.encode(payload, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
decoded = verify_supabase_jwt(token)
assert decoded["uid"] == "test-user-fallback"
assert decoded["name"] == "Fallback Name"
assert decoded["picture"] == "https://example.com/fallback.jpg"
# Test fallback name/picture in user_metadata as 'name'/'picture'
payload_metadata = {
"sub": "test-user-metadata-fallback",
"email": "meta@example.com",
"aud": "authenticated",
"exp": int(time.time()) + 3600,
"user_metadata": {
"name": "Metadata Name",
"picture": "https://example.com/meta.jpg"
}
}
token_metadata = jwt.encode(payload_metadata, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
decoded_metadata = verify_supabase_jwt(token_metadata)
assert decoded_metadata["uid"] == "test-user-metadata-fallback"
assert decoded_metadata["name"] == "Metadata Name"
assert decoded_metadata["picture"] == "https://example.com/meta.jpg"
def test_expired_token():
# Token expired in the past
payload = {
"sub": "test-expired",
"email": "expired@example.com",
"aud": "authenticated",
"exp": int(time.time()) - 100
}
token = jwt.encode(payload, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
with pytest.raises(jwt.ExpiredSignatureError):
verify_supabase_jwt(token)
def test_invalid_signature():
# Signed with wrong secret
payload = {
"sub": "test-invalid-sig",
"email": "sig@example.com",
"aud": "authenticated",
"exp": int(time.time()) + 3600
}
token = jwt.encode(payload, "wrong-secret-key-123456", algorithm="HS256")
with pytest.raises(jwt.InvalidSignatureError):
verify_supabase_jwt(token)
def test_malformed_token():
# Entirely malformed token string
with pytest.raises(jwt.InvalidTokenError):
verify_supabase_jwt("not-a-valid-jwt-token-string")
if __name__ == "__main__":
print("Running Supabase Auth offline verification tests manually...")
try:
test_verify_valid_token()
print("- test_verify_valid_token: PASSED")
test_verify_token_fallback_keys()
print("- test_verify_token_fallback_keys: PASSED")
try:
test_expired_token()
print("- test_expired_token: PASSED")
except AssertionError:
print("- test_expired_token: FAILED (assert failed)")
except jwt.ExpiredSignatureError:
print("- test_expired_token: PASSED (raised ExpiredSignatureError)")
except Exception as e:
print(f"- test_expired_token: FAILED ({type(e).__name__}: {e})")
try:
test_invalid_signature()
print("- test_invalid_signature: PASSED")
except AssertionError:
print("- test_invalid_signature: FAILED (assert failed)")
except jwt.InvalidSignatureError:
print("- test_invalid_signature: PASSED (raised InvalidSignatureError)")
except Exception as e:
print(f"- test_invalid_signature: FAILED ({type(e).__name__}: {e})")
try:
test_malformed_token()
print("- test_malformed_token: PASSED")
except AssertionError:
print("- test_malformed_token: FAILED (assert failed)")
except jwt.InvalidTokenError:
print("- test_malformed_token: PASSED (raised InvalidTokenError)")
except Exception as e:
print(f"- test_malformed_token: FAILED ({type(e).__name__}: {e})")
print("All manual tests PASSED successfully!")
except Exception as e:
print(f"Test run failed with error: {e}")
sys.exit(1)
|