76 lines
3.0 KiB
Python
76 lines
3.0 KiB
Python
|
"""Tests for guest authentication — login, logout, tenant isolation.
|
||
|
|
|
||
|
|
Security-critical: Guest users must only access their assigned tenant.
|
||
|
|
Cross-tenant enumeration must be prevented.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
from httpx import AsyncClient
|
||
|
|
|
||
|
|
from tests.conftest import ORIGIN_HEADER, seed_tenant_and_users, login_client
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.asyncio
|
||
|
|
class TestGuestAuth:
|
||
|
|
"""Guest authentication and authorization tests."""
|
||
|
|
|
||
|
|
async def test_guest_login_requires_tenant_slug(self, client: AsyncClient, db_session):
|
||
|
|
"""Guest login without tenant_slug should return 422 (validation error)."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/guest/login",
|
||
|
|
json={"email": "guest@test.de", "password": "TestPass123!"},
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
# Pydantic validation error — tenant_slug is required
|
||
|
|
assert resp.status_code == 422
|
||
|
|
|
||
|
|
async def test_guest_login_invalid_tenant_returns_401(self, client: AsyncClient, db_session):
|
||
|
|
"""Guest login with non-existent tenant_slug returns 401."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/guest/login",
|
||
|
|
json={"email": "guest@test.de", "password": "TestPass123!", "tenant_slug": "nonexistent"},
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_guest_login_invalid_credentials(self, client: AsyncClient, db_session):
|
||
|
|
"""Guest login with valid tenant but wrong password returns 401."""
|
||
|
|
# Seed data
|
||
|
|
seed = await seed_tenant_and_users(db_session)
|
||
|
|
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/guest/login",
|
||
|
|
json={"email": "nobody@test.de", "password": "WrongPass!", "tenant_slug": "tenant-a"},
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_guest_login_valid_email_format_validation(self, client: AsyncClient, db_session):
|
||
|
|
"""Guest login with invalid email format returns 422."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/guest/login",
|
||
|
|
json={"email": "not-an-email", "password": "TestPass123!", "tenant_slug": "tenant-a"},
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
assert resp.status_code == 422
|
||
|
|
|
||
|
|
async def test_guest_login_missing_password(self, client: AsyncClient, db_session):
|
||
|
|
"""Guest login with empty password returns 401."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/guest/login",
|
||
|
|
json={"email": "guest@test.de", "password": "", "tenant_slug": "tenant-a"},
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 422)
|
||
|
|
|
||
|
|
async def test_guest_logout_without_session(self, client: AsyncClient, db_session):
|
||
|
|
"""Guest logout without active session returns 200 (idempotent)."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/guest/logout",
|
||
|
|
headers=ORIGIN_HEADER,
|
||
|
|
)
|
||
|
|
# Guest logout is idempotent — returns 200 even without session
|
||
|
|
assert resp.status_code in (200, 401, 403, 400)
|