87 lines
2.5 KiB
Python
87 lines
2.5 KiB
Python
|
from app.core.jwt import create_access_token
|
||
|
|
|
||
|
|
STRONG_PASSWORD = "Kz8#Fj2!Lm9@Qw4$xR"
|
||
|
|
|
||
|
|
USERS_QUERY = "{ users { email } }"
|
||
|
|
ME_QUERY = "{ me { email } }"
|
||
|
|
|
||
|
|
REGISTER_MUTATION = """
|
||
|
|
mutation Register($email: String!, $password: String!) {
|
||
|
|
registerUser(email: $email, password: $password) {
|
||
|
|
accessToken
|
||
|
|
tokenType
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"""
|
||
|
|
|
||
|
|
|
||
|
|
def _graphql(client, query, variables=None, token=None):
|
||
|
|
headers = {}
|
||
|
|
if token:
|
||
|
|
headers["Authorization"] = f"Bearer {token}"
|
||
|
|
return client.post(
|
||
|
|
"/graphql",
|
||
|
|
json={"query": query, "variables": variables},
|
||
|
|
headers=headers,
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def _errors(data):
|
||
|
|
return [e.get("message", "") for e in data.get("errors", [])]
|
||
|
|
|
||
|
|
|
||
|
|
def test_users_requires_authentication(client):
|
||
|
|
data = _graphql(client, USERS_QUERY).json()
|
||
|
|
assert "Authentication required" in _errors(data)
|
||
|
|
|
||
|
|
|
||
|
|
# GraphQL-запрос `users` без админ-прав → ошибка «Admin only»;
|
||
|
|
def test_users_denied_for_non_admin(client, make_user):
|
||
|
|
user = make_user(email="bob@vault.test")
|
||
|
|
token = create_access_token(str(user.id))
|
||
|
|
data = _graphql(client, USERS_QUERY, token=token).json()
|
||
|
|
assert "Admin only" in _errors(data)
|
||
|
|
|
||
|
|
|
||
|
|
def test_users_allowed_for_admin(client, make_admin):
|
||
|
|
admin = make_admin()
|
||
|
|
token = create_access_token(str(admin.id))
|
||
|
|
data = _graphql(client, USERS_QUERY, token=token).json()
|
||
|
|
assert data.get("errors") in (None, [])
|
||
|
|
assert isinstance(data["data"]["users"], list)
|
||
|
|
|
||
|
|
|
||
|
|
def test_register_user_public_mutation(client):
|
||
|
|
data = _graphql(
|
||
|
|
client,
|
||
|
|
REGISTER_MUTATION,
|
||
|
|
{"email": "graph@vault.test", "password": STRONG_PASSWORD},
|
||
|
|
).json()
|
||
|
|
assert data.get("errors") in (None, [])
|
||
|
|
payload = data["data"]["registerUser"]
|
||
|
|
assert payload["accessToken"]
|
||
|
|
assert payload["tokenType"] == "bearer"
|
||
|
|
|
||
|
|
|
||
|
|
def test_register_user_rejects_weak_password(client):
|
||
|
|
data = _graphql(
|
||
|
|
client,
|
||
|
|
REGISTER_MUTATION,
|
||
|
|
{"email": "graph-weak@vault.test", "password": "password"},
|
||
|
|
).json()
|
||
|
|
assert data.get("errors")
|
||
|
|
|
||
|
|
|
||
|
|
def test_me_returns_email_with_token(client, make_user):
|
||
|
|
user = make_user(email="me@vault.test")
|
||
|
|
token = create_access_token(str(user.id))
|
||
|
|
data = _graphql(client, ME_QUERY, token=token).json()
|
||
|
|
assert data.get("errors") in (None, [])
|
||
|
|
assert data["data"]["me"]["email"] == "me@vault.test"
|
||
|
|
|
||
|
|
|
||
|
|
def test_me_requires_authentication(client):
|
||
|
|
data = _graphql(client, ME_QUERY).json()
|
||
|
|
assert "Authentication required" in _errors(data)
|
||
|
|
|