wuyang
32 lines
1.3 KiB
Python
32 lines
1.3 KiB
Python
from __future__ import annotations
|
|
|
|
import pytest
|
|
from fastapi import HTTPException
|
|
|
|
from agent_platform.auth import UserIdentity, decode_openwebui_identity, issue_internal_identity, verify_service_bearer
|
|
|
|
|
|
def test_signed_identity_is_verified(identity_jwt: str, settings) -> None:
|
|
identity = decode_openwebui_identity(identity_jwt, settings.openwebui_forward_jwt_secret)
|
|
assert identity.user_id == "user-123"
|
|
assert identity.email == "user@example.test"
|
|
|
|
|
|
def test_invalid_identity_is_rejected(settings) -> None:
|
|
with pytest.raises(HTTPException) as error:
|
|
decode_openwebui_identity("not-a-jwt", settings.openwebui_forward_jwt_secret)
|
|
assert error.value.status_code == 401
|
|
|
|
|
|
def test_internal_identity_can_be_reissued_from_verified_claims(settings) -> None:
|
|
expected = UserIdentity("user-123", "user@example.test", "Test User", "user")
|
|
token = issue_internal_identity(expected, settings.openwebui_forward_jwt_secret)
|
|
assert decode_openwebui_identity(token, settings.openwebui_forward_jwt_secret) == expected
|
|
|
|
|
|
def test_service_bearer_uses_exact_match() -> None:
|
|
verify_service_bearer("Bearer expected", "expected")
|
|
with pytest.raises(HTTPException) as error:
|
|
verify_service_bearer("Bearer expect", "expected")
|
|
assert error.value.status_code == 401
|