47 lines
1.8 KiB
Python
47 lines
1.8 KiB
Python
|
"""Tests for token-based auth (Bearer header validation)."""
|
||
|
|
import pytest
|
||
|
|
|
||
|
|
|
||
|
|
pytestmark = pytest.mark.asyncio
|
||
|
|
|
||
|
|
|
||
|
|
async def test_no_auth_header_returns_401(app_client):
|
||
|
|
"""GET /api/agents without Authorization header -> 401."""
|
||
|
|
resp = await app_client.get("/api/agents")
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
|
||
|
|
async def test_invalid_bearer_returns_401(app_client):
|
||
|
|
"""GET /api/agents with wrong Bearer token -> 401."""
|
||
|
|
resp = await app_client.get("/api/agents", headers={"Authorization": "Bearer wrongtoken"})
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
|
||
|
|
async def test_valid_bearer_returns_200(app_client, auth_headers, seed_agent):
|
||
|
|
"""GET /api/agents with correct Bearer -> 200 and list payload."""
|
||
|
|
resp = await app_client.get("/api/agents", headers=auth_headers)
|
||
|
|
assert resp.status_code == 200, resp.text
|
||
|
|
body = resp.json()
|
||
|
|
assert isinstance(body, list)
|
||
|
|
assert any(a["id"] == "test_agent" for a in body)
|
||
|
|
|
||
|
|
|
||
|
|
async def test_health_endpoint_no_auth(app_client):
|
||
|
|
"""The /health endpoint is open: no auth header needed, returns 200."""
|
||
|
|
resp = await app_client.get("/health")
|
||
|
|
assert resp.status_code == 200
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.xfail(
|
||
|
|
reason="C3 regression: auth.py uses .replace('Bearer ', '') which is case-sensitive. "
|
||
|
|
"Lowercase 'bearer <token>' currently fails. Fix: use a case-insensitive prefix match.",
|
||
|
|
strict=False,
|
||
|
|
)
|
||
|
|
async def test_case_insensitive_bearer(app_client, auth_headers, seed_agent):
|
||
|
|
"""C3 regression: lowercase 'bearer change-me-in-production' must work."""
|
||
|
|
lower = {"Authorization": auth_headers["Authorization"].replace("Bearer ", "bearer ")}
|
||
|
|
resp = await app_client.get("/api/agents", headers=lower)
|
||
|
|
assert resp.status_code == 200, (
|
||
|
|
f"expected 200 with lowercase 'bearer' prefix, got {resp.status_code}: {resp.text}"
|
||
|
|
)
|