2026-07-21 10:25:49 +02:00
|
|
|
from app.auth import security
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_password_hash_roundtrip():
|
|
|
|
|
hashed = security.hash_password("s3cret!")
|
|
|
|
|
assert security.verify_password("s3cret!", hashed)
|
|
|
|
|
assert not security.verify_password("wrong", hashed)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_jwt_roundtrip(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(security.settings, "jwt_secret", "test-secret")
|
|
|
|
|
token = security.create_access_token(user_id=42)
|
|
|
|
|
assert security.decode_access_token(token) == 42
|
2026-07-27 00:32:48 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_verify_password_returns_false_for_an_unparseable_hash():
|
|
|
|
|
"""B-13: only VerifyMismatchError was caught, so a corrupted stored hash raised
|
|
|
|
|
InvalidHashError and became an unhandled 500 on the login endpoint instead of a
|
|
|
|
|
plain "wrong credentials" 401."""
|
|
|
|
|
from app.auth.security import verify_password
|
|
|
|
|
|
|
|
|
|
assert verify_password("whatever", "not-an-argon2-hash") is False
|
|
|
|
|
assert verify_password("whatever", "") is False
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_verify_password_still_rejects_a_wrong_password():
|
|
|
|
|
from app.auth.security import hash_password, verify_password
|
|
|
|
|
|
|
|
|
|
stored = hash_password("correct-horse-battery")
|
|
|
|
|
assert verify_password("correct-horse-battery", stored) is True
|
|
|
|
|
assert verify_password("wrong", stored) is False
|
