feat: simplify auth flow - replace JWT with session cookies
Replace complex JWT + refresh token authentication with simple session-based auth using signed cookies. **Removed:** - JWT token service (jwt_service.py) - Refresh token store (refresh_store.py) - Refresh token model and database table - JWKS fetching and OIDC token verification - python-jose dependency **Added:** - Session service (session.py) with HMAC-SHA256 signed cookies - Auth dependencies module for shared auth logic - Session-based auth endpoints **Updated:** - All API endpoints to use session-based auth - Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS - Tests: rewritten for session-based flow - Frontend: no changes needed (already uses cookies) Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓
This commit is contained in:
Fusion
@@ -1,16 +1,9 @@
|
||||
from datetime import UTC, datetime, timedelta
|
||||
import base64
|
||||
|
||||
import httpx
|
||||
import pytest
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from src.auth.cookies import build_cookie_options
|
||||
from src.auth.jwt_service import decode_access_token, mint_access_token
|
||||
from src.auth.oidc import build_login_redirect_url, exchange_code_for_tokens, verify_provider_access_token
|
||||
from src.auth.refresh_store import create_refresh_token, hash_refresh_token, revoke_refresh_token, rotate_refresh_token
|
||||
from src.auth.oidc import build_login_redirect_url
|
||||
from src.auth.session import create_session_cookie, decode_session_cookie
|
||||
from src.config import Settings
|
||||
from src.models.user import User
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
@@ -38,153 +31,44 @@ def test_login_redirect_url_contains_required_oidc_params() -> None:
|
||||
settings=settings,
|
||||
redirect_uri="http://localhost:8000/auth/callback",
|
||||
state="state-123",
|
||||
nonce="nonce-123",
|
||||
)
|
||||
|
||||
assert "response_type=code" in url
|
||||
assert "client_id=headquarter-web" in url
|
||||
assert "scope=openid+profile+email" in url
|
||||
assert "state=state-123" in url
|
||||
assert "nonce=nonce-123" in url
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_mint_and_decode_internal_access_token_round_trip() -> None:
|
||||
def test_create_and_decode_session_cookie_round_trip() -> None:
|
||||
settings = Settings()
|
||||
expires_at = datetime.now(UTC) + timedelta(minutes=15)
|
||||
user_id = "test-user-123"
|
||||
|
||||
token = mint_access_token(
|
||||
settings=settings,
|
||||
subject="user-123",
|
||||
email="dev@headquarter.local",
|
||||
name="Dev User",
|
||||
expires_at=expires_at,
|
||||
)
|
||||
cookie = create_session_cookie(settings=settings, user_id=user_id)
|
||||
payload = decode_session_cookie(settings=settings, cookie_value=cookie)
|
||||
|
||||
claims = decode_access_token(settings=settings, token=token)
|
||||
|
||||
assert claims["sub"] == "user-123"
|
||||
assert claims["email"] == "dev@headquarter.local"
|
||||
assert claims["name"] == "Dev User"
|
||||
assert "exp" in claims
|
||||
assert payload["user_id"] == user_id
|
||||
assert "exp" in payload
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_refresh_token_hash_is_deterministic_and_non_reversible() -> None:
|
||||
raw_token = "refresh-token-abc"
|
||||
|
||||
first_hash = hash_refresh_token(raw_token)
|
||||
second_hash = hash_refresh_token(raw_token)
|
||||
|
||||
assert first_hash == second_hash
|
||||
assert first_hash != raw_token
|
||||
assert len(first_hash) == 64
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_decode_access_token_rejects_invalid_signature() -> None:
|
||||
def test_decode_session_rejects_invalid_signature() -> None:
|
||||
settings = Settings()
|
||||
other_settings = Settings(jwt_secret="different-secret")
|
||||
expires_at = datetime.now(UTC) + timedelta(minutes=15)
|
||||
other_settings = Settings(session_secret="different-secret")
|
||||
user_id = "test-user-123"
|
||||
|
||||
token = mint_access_token(
|
||||
settings=other_settings,
|
||||
subject="user-123",
|
||||
email="dev@headquarter.local",
|
||||
name="Dev User",
|
||||
expires_at=expires_at,
|
||||
)
|
||||
cookie = create_session_cookie(settings=other_settings, user_id=user_id)
|
||||
|
||||
with pytest.raises(Exception):
|
||||
decode_access_token(settings=settings, token=token)
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_exchange_code_for_tokens_posts_expected_payload() -> None:
|
||||
settings = Settings()
|
||||
|
||||
def handler(request: httpx.Request) -> httpx.Response:
|
||||
assert request.url == httpx.URL(settings.resolved_authentik_token_url)
|
||||
payload = dict(httpx.QueryParams(request.content.decode("utf-8")))
|
||||
assert payload["grant_type"] == "authorization_code"
|
||||
assert payload["code"] == "auth-code"
|
||||
assert payload["redirect_uri"] == "http://localhost:8000/auth/callback"
|
||||
return httpx.Response(200, json={"access_token": "provider-token", "refresh_token": "provider-refresh"})
|
||||
|
||||
transport = httpx.MockTransport(handler)
|
||||
async with httpx.AsyncClient(transport=transport) as client:
|
||||
token_payload = await exchange_code_for_tokens(
|
||||
settings=settings,
|
||||
code="auth-code",
|
||||
redirect_uri="http://localhost:8000/auth/callback",
|
||||
client=client,
|
||||
)
|
||||
|
||||
assert token_payload["access_token"] == "provider-token"
|
||||
with pytest.raises(ValueError, match="invalid session signature"):
|
||||
decode_session_cookie(settings=settings, cookie_value=cookie)
|
||||
|
||||
|
||||
@pytest.mark.integration
|
||||
def test_verify_provider_access_token_with_jwks_oct_key() -> None:
|
||||
settings = Settings(authentik_audience="headquarter-web", authentik_issuer="https://authentik.local/")
|
||||
shared_secret = b"shared-secret-123"
|
||||
jwks = {
|
||||
"keys": [
|
||||
{
|
||||
"kty": "oct",
|
||||
"alg": "HS256",
|
||||
"k": base64.urlsafe_b64encode(shared_secret).decode("utf-8").rstrip("="),
|
||||
"kid": "kid-1",
|
||||
}
|
||||
]
|
||||
}
|
||||
def test_decode_session_rejects_expired_cookie(monkeypatch) -> None:
|
||||
settings = Settings(session_ttl_hours=-1) # Already expired
|
||||
user_id = "test-user-123"
|
||||
|
||||
from jose import jwt # type: ignore[import-untyped]
|
||||
cookie = create_session_cookie(settings=settings, user_id=user_id)
|
||||
|
||||
token = jwt.encode(
|
||||
{
|
||||
"sub": "authentik-user",
|
||||
"iss": settings.authentik_issuer,
|
||||
"aud": settings.authentik_audience,
|
||||
"exp": int((datetime.now(UTC) + timedelta(minutes=5)).timestamp()),
|
||||
},
|
||||
shared_secret,
|
||||
algorithm="HS256",
|
||||
headers={"kid": "kid-1"},
|
||||
)
|
||||
|
||||
claims = verify_provider_access_token(settings=settings, token=token, jwks=jwks)
|
||||
|
||||
assert claims["sub"] == "authentik-user"
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_refresh_store_create_rotate_and_revoke(db_session: AsyncSession) -> None:
|
||||
user = User(email="dev-auth@headquarter.local", name="Dev Auth", authentik_id="auth-dev", avatar_url=None)
|
||||
db_session.add(user)
|
||||
await db_session.commit()
|
||||
await db_session.refresh(user)
|
||||
|
||||
raw_refresh_token, stored_token = await create_refresh_token(
|
||||
session=db_session,
|
||||
user_id=user.id,
|
||||
expires_at=datetime.now(UTC) + timedelta(days=7),
|
||||
user_agent="pytest",
|
||||
ip_address="127.0.0.1",
|
||||
)
|
||||
assert raw_refresh_token
|
||||
assert stored_token.revoked_at is None
|
||||
|
||||
rotated_raw, rotated_stored = await rotate_refresh_token(
|
||||
session=db_session,
|
||||
raw_token=raw_refresh_token,
|
||||
user_agent="pytest-rotated",
|
||||
ip_address="127.0.0.2",
|
||||
)
|
||||
assert rotated_raw != raw_refresh_token
|
||||
assert rotated_stored.revoked_at is None
|
||||
assert stored_token.revoked_at is not None
|
||||
|
||||
revoked = await revoke_refresh_token(session=db_session, raw_token=rotated_raw)
|
||||
assert revoked is True
|
||||
with pytest.raises(ValueError, match="session expired"):
|
||||
decode_session_cookie(settings=settings, cookie_value=cookie)
|
||||
|
||||
Reference in New Issue
Block a user