File size: 7,160 Bytes
aef804e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 | """
Mobile API Authentication Tests
Tests for mobile API authentication endpoints:
- Login success and failure
- Token refresh
- Token validation (/api/auth/me)
- Logout
All tests use API-first approach with TestClient (no browser).
Response structure matches web API for consistency.
"""
import pytest
from fastapi.testclient import TestClient
class TestMobileLogin:
"""Test mobile login endpoint"""
def test_mobile_login_success(self, mobile_api_client: TestClient, mobile_test_user):
"""Test successful login with valid credentials"""
# Login with valid credentials
response = mobile_api_client.post("/api/auth/login", json={
"username": mobile_test_user.email,
"password": "MobileTest123!"
})
# Verify response
assert response.status_code == 200
data = response.json()
# Verify token structure
assert "access_token" in data
assert isinstance(data["access_token"], str)
assert len(data["access_token"]) > 0
# Verify token type
assert data.get("token_type") == "bearer"
# Verify expires_in field (if present)
if "expires_in" in data:
assert isinstance(data["expires_in"], int)
assert data["expires_in"] > 0
def test_mobile_login_invalid_credentials(self, mobile_api_client: TestClient):
"""Test login with invalid credentials returns 401"""
response = mobile_api_client.post("/api/auth/login", json={
"username": "nonexistent@example.com",
"password": "WrongPassword123!"
})
# Verify error response
assert response.status_code == 401
data = response.json()
# Verify error message
assert "detail" in data
# Verify access_token NOT in response
assert "access_token" not in data
def test_mobile_login_wrong_password(self, mobile_api_client: TestClient, mobile_test_user):
"""Test login with correct email but wrong password"""
response = mobile_api_client.post("/api/auth/login", json={
"username": mobile_test_user.email,
"password": "WrongPassword123!"
})
# Verify error response
assert response.status_code == 401
assert "access_token" not in response.json()
class TestMobileTokenRefresh:
"""Test mobile token refresh endpoint"""
def test_mobile_token_refresh(self, mobile_api_client: TestClient, mobile_auth_headers: dict):
"""Test token refresh returns new access token"""
# Get old token from headers
old_token = mobile_auth_headers["Authorization"].replace("Bearer ", "")
# Refresh token
response = mobile_api_client.post("/api/auth/refresh", headers=mobile_auth_headers)
# Verify response
assert response.status_code == 200
data = response.json()
# Verify new token returned
assert "access_token" in data
assert isinstance(data["access_token"], str)
assert len(data["access_token"]) > 0
# Verify new token differs from old token
new_token = data["access_token"]
assert new_token != old_token
# Verify token type
assert data.get("token_type") == "bearer"
class TestMobileTokenValidation:
"""Test mobile token validation via /api/auth/me"""
def test_mobile_token_validation(self, mobile_api_client: TestClient, mobile_auth_headers: dict, mobile_test_user):
"""Test token validation returns user data"""
# Get current user info
response = mobile_api_client.get("/api/auth/me", headers=mobile_auth_headers)
# Verify response
assert response.status_code == 200
data = response.json()
# Verify user data fields
assert "id" in data
assert "email" in data
assert data["email"] == mobile_test_user.email
# Verify role or status field (if present)
if "role" in data:
assert data["role"] is not None
if "status" in data:
assert data["status"] is not None
def test_mobile_token_validation_without_auth(self, mobile_api_client: TestClient):
"""Test token validation fails without auth header"""
response = mobile_api_client.get("/api/auth/me")
# Verify unauthorized response
assert response.status_code == 401
def test_mobile_token_validation_invalid_token(self, mobile_api_client: TestClient):
"""Test token validation fails with invalid token"""
response = mobile_api_client.get("/api/auth/me", headers={
"Authorization": "Bearer invalid_token_12345"
})
# Verify unauthorized response
assert response.status_code == 401
class TestMobileLogout:
"""Test mobile logout endpoint"""
def test_mobile_logout(self, mobile_api_client: TestClient, mobile_auth_headers: dict):
"""Test logout invalidates token"""
# Logout
response = mobile_api_client.post("/api/auth/logout", headers=mobile_auth_headers)
# Verify logout response
assert response.status_code == 200
data = response.json()
# Verify success message
assert "success" in data or "message" in data
# Note: JWT tokens are stateless, so logout is client-side
# The server logs the logout event but doesn't invalidate the token
# Subsequent requests will still work until token expires
def test_mobile_logout_without_auth(self, mobile_api_client: TestClient):
"""Test logout requires authentication"""
response = mobile_api_client.post("/api/auth/logout")
# Verify unauthorized response
assert response.status_code == 401
class TestMobileAuthResponseStructure:
"""Test mobile auth responses match web API structure"""
def test_mobile_login_response_structure(self, mobile_api_client: TestClient, mobile_test_user):
"""Test login response structure matches web API"""
response = mobile_api_client.post("/api/auth/login", json={
"username": mobile_test_user.email,
"password": "MobileTest123!"
})
data = response.json()
# Verify expected fields present
expected_fields = ["access_token", "token_type"]
for field in expected_fields:
assert field in data, f"Missing field: {field}"
# Verify field types
assert isinstance(data["access_token"], str)
assert isinstance(data["token_type"], str)
def test_mobile_me_response_structure(self, mobile_api_client: TestClient, mobile_auth_headers: dict):
"""Test /api/auth/me response structure matches web API"""
response = mobile_api_client.get("/api/auth/me", headers=mobile_auth_headers)
data = response.json()
# Verify expected fields present
expected_fields = ["id", "email"]
for field in expected_fields:
assert field in data, f"Missing field: {field}"
# Verify field types
assert isinstance(data["id"], str)
assert isinstance(data["email"], str)
|