headquarter/apps/api/tests/integration/test_auth_services.py

from datetime import UTC, datetime, timedelta
import base64

import httpx
import pytest
from sqlalchemy.ext.asyncio import AsyncSession

from src.auth.cookies import build_cookie_options
from src.auth.jwt_service import decode_access_token, mint_access_token
from src.auth.oidc import build_login_redirect_url, exchange_code_for_tokens, verify_provider_access_token
from src.auth.refresh_store import create_refresh_token, hash_refresh_token, revoke_refresh_token, rotate_refresh_token
from src.config import Settings
from src.models.user import User


@pytest.mark.integration
def test_cookie_options_follow_environment_defaults(monkeypatch) -> None:
    monkeypatch.setenv("APP_ENV", "development")
    dev_settings = Settings()
    dev_options = build_cookie_options(dev_settings)

    monkeypatch.setenv("APP_ENV", "production")
    prod_settings = Settings()
    prod_options = build_cookie_options(prod_settings)

    assert dev_options["httponly"] is True
    assert dev_options["secure"] is False
    assert dev_options["samesite"] == "lax"
    assert prod_options["secure"] is True
    assert prod_options["samesite"] == "strict"


@pytest.mark.integration
def test_login_redirect_url_contains_required_oidc_params() -> None:
    settings = Settings()

    url = build_login_redirect_url(
        settings=settings,
        redirect_uri="http://localhost:8000/auth/callback",
        state="state-123",
        nonce="nonce-123",
    )

    assert "response_type=code" in url
    assert "client_id=headquarter-web" in url
    assert "scope=openid+profile+email" in url
    assert "state=state-123" in url
    assert "nonce=nonce-123" in url


@pytest.mark.integration
def test_mint_and_decode_internal_access_token_round_trip() -> None:
    settings = Settings()
    expires_at = datetime.now(UTC) + timedelta(minutes=15)

    token = mint_access_token(
        settings=settings,
        subject="user-123",
        email="dev@headquarter.local",
        name="Dev User",
        expires_at=expires_at,
    )

    claims = decode_access_token(settings=settings, token=token)

    assert claims["sub"] == "user-123"
    assert claims["email"] == "dev@headquarter.local"
    assert claims["name"] == "Dev User"
    assert "exp" in claims


@pytest.mark.integration
def test_refresh_token_hash_is_deterministic_and_non_reversible() -> None:
    raw_token = "refresh-token-abc"

    first_hash = hash_refresh_token(raw_token)
    second_hash = hash_refresh_token(raw_token)

    assert first_hash == second_hash
    assert first_hash != raw_token
    assert len(first_hash) == 64


@pytest.mark.integration
def test_decode_access_token_rejects_invalid_signature() -> None:
    settings = Settings()
    other_settings = Settings(jwt_secret="different-secret")
    expires_at = datetime.now(UTC) + timedelta(minutes=15)

    token = mint_access_token(
        settings=other_settings,
        subject="user-123",
        email="dev@headquarter.local",
        name="Dev User",
        expires_at=expires_at,
    )

    with pytest.raises(Exception):
        decode_access_token(settings=settings, token=token)


@pytest.mark.asyncio
@pytest.mark.integration
async def test_exchange_code_for_tokens_posts_expected_payload() -> None:
    settings = Settings()

    def handler(request: httpx.Request) -> httpx.Response:
        assert request.url == httpx.URL(settings.resolved_authentik_token_url)
        payload = dict(httpx.QueryParams(request.content.decode("utf-8")))
        assert payload["grant_type"] == "authorization_code"
        assert payload["code"] == "auth-code"
        assert payload["redirect_uri"] == "http://localhost:8000/auth/callback"
        return httpx.Response(200, json={"access_token": "provider-token", "refresh_token": "provider-refresh"})

    transport = httpx.MockTransport(handler)
    async with httpx.AsyncClient(transport=transport) as client:
        token_payload = await exchange_code_for_tokens(
            settings=settings,
            code="auth-code",
            redirect_uri="http://localhost:8000/auth/callback",
            client=client,
        )

    assert token_payload["access_token"] == "provider-token"


@pytest.mark.integration
def test_verify_provider_access_token_with_jwks_oct_key() -> None:
    settings = Settings(authentik_audience="headquarter-web", authentik_issuer="https://authentik.local/")
    shared_secret = b"shared-secret-123"
    jwks = {
        "keys": [
            {
                "kty": "oct",
                "alg": "HS256",
                "k": base64.urlsafe_b64encode(shared_secret).decode("utf-8").rstrip("="),
                "kid": "kid-1",
            }
        ]
    }

    from jose import jwt  # type: ignore[import-untyped]

    token = jwt.encode(
        {
            "sub": "authentik-user",
            "iss": settings.authentik_issuer,
            "aud": settings.authentik_audience,
            "exp": int((datetime.now(UTC) + timedelta(minutes=5)).timestamp()),
        },
        shared_secret,
        algorithm="HS256",
        headers={"kid": "kid-1"},
    )

    claims = verify_provider_access_token(settings=settings, token=token, jwks=jwks)

    assert claims["sub"] == "authentik-user"


@pytest.mark.asyncio
@pytest.mark.integration
async def test_refresh_store_create_rotate_and_revoke(db_session: AsyncSession) -> None:
    user = User(email="dev-auth@headquarter.local", name="Dev Auth", authentik_id="auth-dev", avatar_url=None)
    db_session.add(user)
    await db_session.commit()
    await db_session.refresh(user)

    raw_refresh_token, stored_token = await create_refresh_token(
        session=db_session,
        user_id=user.id,
        expires_at=datetime.now(UTC) + timedelta(days=7),
        user_agent="pytest",
        ip_address="127.0.0.1",
    )
    assert raw_refresh_token
    assert stored_token.revoked_at is None

    rotated_raw, rotated_stored = await rotate_refresh_token(
        session=db_session,
        raw_token=raw_refresh_token,
        user_agent="pytest-rotated",
        ip_address="127.0.0.2",
    )
    assert rotated_raw != raw_refresh_token
    assert rotated_stored.revoked_at is None
    assert stored_token.revoked_at is not None

    revoked = await revoke_refresh_token(session=db_session, raw_token=rotated_raw)
    assert revoked is True