Fusion
78 lines
2.2 KiB
Python
78 lines
2.2 KiB
Python
"""Tests for credential models and storage interface."""
|
|
|
|
import uuid
|
|
|
|
import pytest
|
|
|
|
from app.git.credentials import AccessTokenCredential, CredentialStorage, GitCredential
|
|
from app.git.types import CredentialKind
|
|
|
|
|
|
class MinimalCredentialStorage(CredentialStorage):
|
|
"""Concrete subclass for testing."""
|
|
|
|
def create(self, credential: GitCredential) -> uuid.UUID:
|
|
return credential.id
|
|
|
|
def get(self, credential_id: uuid.UUID) -> GitCredential | None:
|
|
return None
|
|
|
|
def delete(self, credential_id: uuid.UUID) -> None:
|
|
return None
|
|
|
|
|
|
def test_git_credential_can_be_instantiated() -> None:
|
|
cred = GitCredential(
|
|
kind=CredentialKind.ssh_key,
|
|
encrypted_payload="encrypted-data",
|
|
)
|
|
assert cred.kind == CredentialKind.ssh_key
|
|
assert cred.encrypted_payload == "encrypted-data"
|
|
assert isinstance(cred.id, uuid.UUID)
|
|
|
|
|
|
def test_access_token_credential_can_be_instantiated() -> None:
|
|
cred = AccessTokenCredential(encrypted_payload="encrypted-data")
|
|
assert cred.kind == CredentialKind.access_token
|
|
assert cred.encrypted_payload == "encrypted-data"
|
|
|
|
|
|
def test_credential_storage_cannot_be_instantiated_directly() -> None:
|
|
with pytest.raises(TypeError):
|
|
CredentialStorage() # type: ignore[abstract]
|
|
|
|
|
|
def test_no_plaintext_secret_fields() -> None:
|
|
fields = set(GitCredential.model_fields.keys())
|
|
assert "token" not in fields
|
|
assert "private_key" not in fields
|
|
|
|
|
|
def test_extra_forbidden() -> None:
|
|
with pytest.raises(ValueError):
|
|
GitCredential(
|
|
kind=CredentialKind.access_token,
|
|
encrypted_payload="encrypted-data",
|
|
secret_plaintext="should-fail", # type: ignore[call-arg]
|
|
)
|
|
|
|
|
|
def test_minimal_credential_storage_implements_all_methods() -> None:
|
|
storage = MinimalCredentialStorage()
|
|
cred = GitCredential(
|
|
kind=CredentialKind.access_token,
|
|
encrypted_payload="encrypted-data",
|
|
)
|
|
assert storage.create(cred) == cred.id
|
|
assert storage.get(cred.id) is None
|
|
storage.delete(cred.id)
|
|
|
|
|
|
def test_encrypted_payload_not_in_repr() -> None:
|
|
cred = GitCredential(
|
|
kind=CredentialKind.ssh_key,
|
|
encrypted_payload="secret-value",
|
|
)
|
|
repr_str = repr(cred)
|
|
assert "secret-value" not in repr_str
|