auth für user

tests/auth/test_account.py

@@ -0,0 +1,108 @@
+from cryptography.fernet import Fernet
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy.pool import StaticPool
+
+from app.auth.account import authenticate_self_service
+from app.db.models import Base
+from app.db.repositories import UserRepository
+from app.security.credentials import CredentialCipher
+
+
+def _make_session_and_cipher():
+    engine = create_engine("sqlite://", connect_args={"check_same_thread": False}, poolclass=StaticPool)
+    Base.metadata.create_all(engine)
+    factory = sessionmaker(bind=engine, expire_on_commit=False)
+    cipher = CredentialCipher(Fernet.generate_key().decode("ascii"))
+    return factory(), cipher
+
+
+def _seed_user(session, cipher, **overrides):
+    values = dict(
+        name="Max",
+        enabled=True,
+        mywhoosh_email_enc=cipher.encrypt("max@mywhoosh.example"),
+        mywhoosh_password_enc=cipher.encrypt("mw-secret"),
+        garmin_email_enc=cipher.encrypt("max@garmin.example"),
+        garmin_password_enc=cipher.encrypt("garmin-secret"),
+    )
+    values.update(overrides)
+    return UserRepository(session).create(**values)
+
+
+def test_authenticates_with_mywhoosh_credentials() -> None:
+    session, cipher = _make_session_and_cipher()
+    user = _seed_user(session, cipher)
+
+    result = authenticate_self_service(session, cipher, "max@mywhoosh.example", "mw-secret")
+
+    assert result is not None
+    assert result.id == user.id
+
+
+def test_authenticates_with_garmin_credentials() -> None:
+    session, cipher = _make_session_and_cipher()
+    user = _seed_user(session, cipher)
+
+    result = authenticate_self_service(session, cipher, "max@garmin.example", "garmin-secret")
+
+    assert result is not None
+    assert result.id == user.id
+
+
+def test_rejects_wrong_password() -> None:
+    session, cipher = _make_session_and_cipher()
+    _seed_user(session, cipher)
+
+    assert authenticate_self_service(session, cipher, "max@mywhoosh.example", "wrong") is None
+
+
+def test_rejects_unknown_email() -> None:
+    session, cipher = _make_session_and_cipher()
+    _seed_user(session, cipher)
+
+    assert authenticate_self_service(session, cipher, "nobody@example.com", "mw-secret") is None
+
+
+def test_rejects_mixed_email_and_password_from_different_accounts() -> None:
+    """A MyWhoosh email paired with the Garmin password (or vice versa) for
+    the same user must not authenticate -- each pair is checked together."""
+    session, cipher = _make_session_and_cipher()
+    _seed_user(session, cipher)
+
+    assert authenticate_self_service(session, cipher, "max@mywhoosh.example", "garmin-secret") is None
+    assert authenticate_self_service(session, cipher, "max@garmin.example", "mw-secret") is None
+
+
+def test_rejects_empty_password() -> None:
+    session, cipher = _make_session_and_cipher()
+    _seed_user(session, cipher)
+
+    assert authenticate_self_service(session, cipher, "max@mywhoosh.example", "") is None
+
+
+def test_picks_correct_user_among_several() -> None:
+    session, cipher = _make_session_and_cipher()
+    _seed_user(
+        session,
+        cipher,
+        name="Anna",
+        mywhoosh_email_enc=cipher.encrypt("anna@mywhoosh.example"),
+        mywhoosh_password_enc=cipher.encrypt("anna-secret"),
+        garmin_email_enc=cipher.encrypt("anna@garmin.example"),
+        garmin_password_enc=cipher.encrypt("anna-garmin-secret"),
+    )
+    bob = _seed_user(
+        session,
+        cipher,
+        name="Bob",
+        mywhoosh_email_enc=cipher.encrypt("bob@mywhoosh.example"),
+        mywhoosh_password_enc=cipher.encrypt("bob-secret"),
+        garmin_email_enc=cipher.encrypt("bob@garmin.example"),
+        garmin_password_enc=cipher.encrypt("bob-garmin-secret"),
+    )
+
+    result = authenticate_self_service(session, cipher, "bob@mywhoosh.example", "bob-secret")
+
+    assert result is not None
+    assert result.id == bob.id