spb/sorti-ka

1# ==============================================================================2# Author: Simon-Pierre Boucher <contact@spboucher.ai>3# File:   tests/test_auth.py4# Desc:   Tests de la connexion KA ID — session signée HMAC, vérification du5#         jeton HS256 du hub (issuer, audience, expiration, signature).6# ==============================================================================7from __future__ import annotations89import base6410import hashlib11import hmac12import json13import time1415import pytest1617from sortika import auth181920@pytest.fixture(autouse=True)21def _secrets(monkeypatch):22    monkeypatch.setenv("SESSION_SECRET", "test-session-secret")23    monkeypatch.setenv("KA_SSO_SECRET", "test-ka-secret")242526def _hub_jwt(claims: dict, secret: str = "test-ka-secret") -> str:27    def b64(d: dict) -> str:28        return base64.urlsafe_b64encode(29            json.dumps(d).encode()).decode().rstrip("=")30    h, p = b64({"alg": "HS256", "typ": "JWT"}), b64(claims)31    sig = base64.urlsafe_b64encode(32        hmac.new(secret.encode(), f"{h}.{p}".encode(),33                 hashlib.sha256).digest()).decode().rstrip("=")34    return f"{h}.{p}.{sig}"353637def _claims(**over) -> dict:38    base = {"iss": auth.KA_HUB_URL, "aud": "sorti-ka",39            "sub": "42", "ka_id": "ka-0123456789",40            "email": "membre@exemple.com", "name": "Membre Test",41            "exp": time.time() + 300}42    base.update(over)43    return base444546def test_session_sign_verify():47    tok = auth._sign({"uid": 1, "exp": time.time() + 60})48    assert auth._verify(tok)["uid"] == 149    assert auth._verify(tok + "x") is None50    assert auth._verify(auth._sign({"uid": 1, "exp": time.time() - 1})) is None515253def test_hub_token_valid():54    claims = auth._verify_ka_token(_hub_jwt(_claims()))55    assert claims and claims["ka_id"] == "ka-0123456789"565758def test_hub_token_rejections():59    # mauvaise signature60    assert auth._verify_ka_token(_hub_jwt(_claims(), secret="autre")) is None61    # mauvais émetteur62    assert auth._verify_ka_token(_hub_jwt(_claims(iss="https://evil.com"))) is None63    # mauvaise audience (jeton émis pour lou-ka)64    assert auth._verify_ka_token(_hub_jwt(_claims(aud="lou-ka"))) is None65    # expiré66    assert auth._verify_ka_token(_hub_jwt(_claims(exp=time.time() - 10))) is None67