justin/provenance
1
0
Fork 0
Code Issues 173 Pull Requests Actions Packages Projects Releases Wiki Activity

Test auth flows and switch core tests to session auth

Browse Source 
New auth suite covers registration, login (incl. wrong-password), email verification, password reset (old sessions + old password rejected), logout revocation, and no-enumeration on reset. Core tenancy tests now authenticate via real sessions. A capturing mailer makes email flows assertable. 13 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>
This commit is contained in:
Justin Paul
2026-06-06 10:51:51 -04:00
parent 00bfe8bfca
commit 9f8dd960f4
3 changed files with 171 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_core_api.py
+20 -38
View File
@@ -1,91 +1,73 @@
"""End-to-end coverage of the core data model through the API: tenancy, the
privacy seam, and the pre-auth actor shim."""
privacy seam, and real session auth."""
async def _create_user(client, email: str) -> str:
resp = await client.post(
"/api/v1/users", json={"email": email, "display_name": email}
)
assert resp.status_code == 201, resp.text
return resp.json()["id"]
from tests.conftest import auth, register
async def test_tree_and_person_flow(client):
user_id = await _create_user(client, "keeper@example.com")
headers = {"X-User-Id": user_id}
token = await register(client, "keeper@example.com")
resp = await client.post(
"/api/v1/trees", json={"name": "Smith Family", "visibility": "private"}, headers=headers
"/api/v1/trees",
json={"name": "Smith Family", "visibility": "private"},
headers=auth(token),
)
assert resp.status_code == 201, resp.text
tree = resp.json()
assert tree["visibility"] == "private"
assert tree["owner_id"] == user_id
tree_id = tree["id"]
resp = await client.get("/api/v1/trees", headers=headers)
resp = await client.get("/api/v1/trees", headers=auth(token))
assert resp.status_code == 200
assert len(resp.json()) == 1
resp = await client.post(
f"/api/v1/trees/{tree_id}/persons",
json={"given": "John", "surname": "Smith"},
headers=headers,
headers=auth(token),
)
assert resp.status_code == 201, resp.text
person = resp.json()
assert person["primary_name"] == "John Smith"
assert person["tree_id"] == tree_id
resp = await client.get(f"/api/v1/trees/{tree_id}/persons", headers=headers)
resp = await client.get(f"/api/v1/trees/{tree_id}/persons", headers=auth(token))
assert resp.status_code == 200
assert len(resp.json()) == 1
async def test_private_tree_isolated_from_other_users(client):
owner = await _create_user(client, "owner@example.com")
other = await _create_user(client, "stranger@example.com")
owner = await register(client, "owner@example.com")
other = await register(client, "stranger@example.com")
resp = await client.post(
"/api/v1/trees", json={"name": "Private", "visibility": "private"},
headers={"X-User-Id": owner},
"/api/v1/trees", json={"name": "Private", "visibility": "private"}, headers=auth(owner)
)
tree_id = resp.json()["id"]
# A non-member cannot view a private tree, nor list its people.
resp = await client.get(f"/api/v1/trees/{tree_id}", headers={"X-User-Id": other})
resp = await client.get(f"/api/v1/trees/{tree_id}", headers=auth(other))
assert resp.status_code == 403
resp = await client.get(f"/api/v1/trees/{tree_id}/persons", headers={"X-User-Id": other})
resp = await client.get(f"/api/v1/trees/{tree_id}/persons", headers=auth(other))
assert resp.status_code == 403
async def test_public_tree_viewable_but_not_editable_by_non_member(client):
owner = await _create_user(client, "owner2@example.com")
viewer = await _create_user(client, "viewer2@example.com")
owner = await register(client, "owner2@example.com")
viewer = await register(client, "viewer2@example.com")
resp = await client.post(
"/api/v1/trees", json={"name": "Public", "visibility": "public"},
headers={"X-User-Id": owner},
"/api/v1/trees", json={"name": "Public", "visibility": "public"}, headers=auth(owner)
)
tree_id = resp.json()["id"]
# Visible to a non-member...
resp = await client.get(f"/api/v1/trees/{tree_id}", headers={"X-User-Id": viewer})
resp = await client.get(f"/api/v1/trees/{tree_id}", headers=auth(viewer))
assert resp.status_code == 200
# ...but not writable (not an editor).
resp = await client.post(
f"/api/v1/trees/{tree_id}/persons", json={"given": "Nope"},
headers={"X-User-Id": viewer},
f"/api/v1/trees/{tree_id}/persons", json={"given": "Nope"}, headers=auth(viewer)
)
assert resp.status_code == 403
async def test_duplicate_email_conflicts(client):
await _create_user(client, "dupe@example.com")
resp = await client.post("/api/v1/users", json={"email": "dupe@example.com"})
assert resp.status_code == 409
async def test_auth_required_without_header(client):
async def test_auth_required_without_token(client):
resp = await client.get("/api/v1/trees")
assert resp.status_code == 401