test_supabase_auth.py

import sys
import time
import jwt
import pytest
from app.config import settings
from app.utils.auth import verify_supabase_jwt

# Ensure settings has a valid secret key
if not hasattr(settings, "SUPABASE_JWT_SECRET") or not settings.SUPABASE_JWT_SECRET:
    settings.SUPABASE_JWT_SECRET = "supabase-jwt-secret-placeholder-2026-secure-random"

def test_verify_valid_token():
    # Generate a valid token
    payload = {
        "sub": "test-user-123",
        "email": "test@example.com",
        "aud": "authenticated",
        "exp": int(time.time()) + 3600,
        "user_metadata": {
            "full_name": "Test User",
            "avatar_url": "https://example.com/avatar.jpg"
        }
    }
    token = jwt.encode(payload, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
    
    decoded = verify_supabase_jwt(token)
    assert decoded["uid"] == "test-user-123"
    assert decoded["email"] == "test@example.com"
    assert decoded["name"] == "Test User"
    assert decoded["picture"] == "https://example.com/avatar.jpg"
    assert decoded["exp"] == payload["exp"]

def test_verify_token_fallback_keys():
    # Test fallback name/picture in claims
    payload = {
        "sub": "test-user-fallback",
        "email": "fallback@example.com",
        "aud": "authenticated",
        "exp": int(time.time()) + 3600,
        "name": "Fallback Name",
        "picture": "https://example.com/fallback.jpg"
    }
    token = jwt.encode(payload, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
    decoded = verify_supabase_jwt(token)
    assert decoded["uid"] == "test-user-fallback"
    assert decoded["name"] == "Fallback Name"
    assert decoded["picture"] == "https://example.com/fallback.jpg"

    # Test fallback name/picture in user_metadata as 'name'/'picture'
    payload_metadata = {
        "sub": "test-user-metadata-fallback",
        "email": "meta@example.com",
        "aud": "authenticated",
        "exp": int(time.time()) + 3600,
        "user_metadata": {
            "name": "Metadata Name",
            "picture": "https://example.com/meta.jpg"
        }
    }
    token_metadata = jwt.encode(payload_metadata, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
    decoded_metadata = verify_supabase_jwt(token_metadata)
    assert decoded_metadata["uid"] == "test-user-metadata-fallback"
    assert decoded_metadata["name"] == "Metadata Name"
    assert decoded_metadata["picture"] == "https://example.com/meta.jpg"

def test_expired_token():
    # Token expired in the past
    payload = {
        "sub": "test-expired",
        "email": "expired@example.com",
        "aud": "authenticated",
        "exp": int(time.time()) - 100
    }
    token = jwt.encode(payload, settings.SUPABASE_JWT_SECRET, algorithm="HS256")
    with pytest.raises(jwt.ExpiredSignatureError):
        verify_supabase_jwt(token)

def test_invalid_signature():
    # Signed with wrong secret
    payload = {
        "sub": "test-invalid-sig",
        "email": "sig@example.com",
        "aud": "authenticated",
        "exp": int(time.time()) + 3600
    }
    token = jwt.encode(payload, "wrong-secret-key-123456", algorithm="HS256")
    with pytest.raises(jwt.InvalidSignatureError):
        verify_supabase_jwt(token)

def test_malformed_token():
    # Entirely malformed token string
    with pytest.raises(jwt.InvalidTokenError):
        verify_supabase_jwt("not-a-valid-jwt-token-string")

if __name__ == "__main__":
    print("Running Supabase Auth offline verification tests manually...")
    try:
        test_verify_valid_token()
        print("- test_verify_valid_token: PASSED")
        test_verify_token_fallback_keys()
        print("- test_verify_token_fallback_keys: PASSED")
        try:
            test_expired_token()
            print("- test_expired_token: PASSED")
        except AssertionError:
            print("- test_expired_token: FAILED (assert failed)")
        except jwt.ExpiredSignatureError:
            print("- test_expired_token: PASSED (raised ExpiredSignatureError)")
        except Exception as e:
            print(f"- test_expired_token: FAILED ({type(e).__name__}: {e})")

        try:
            test_invalid_signature()
            print("- test_invalid_signature: PASSED")
        except AssertionError:
            print("- test_invalid_signature: FAILED (assert failed)")
        except jwt.InvalidSignatureError:
            print("- test_invalid_signature: PASSED (raised InvalidSignatureError)")
        except Exception as e:
            print(f"- test_invalid_signature: FAILED ({type(e).__name__}: {e})")

        try:
            test_malformed_token()
            print("- test_malformed_token: PASSED")
        except AssertionError:
            print("- test_malformed_token: FAILED (assert failed)")
        except jwt.InvalidTokenError:
            print("- test_malformed_token: PASSED (raised InvalidTokenError)")
        except Exception as e:
            print(f"- test_malformed_token: FAILED ({type(e).__name__}: {e})")

        print("All manual tests PASSED successfully!")
    except Exception as e:
        print(f"Test run failed with error: {e}")
        sys.exit(1)