import os
import tempfile
import jwt
import pytest
from core.oauth.token_manager import SecurityError, TokenManager
@pytest.fixture
def token_manager():
os.environ["OAUTH_JWT_SECRET_KEY"] = "test_secret_key"
# Use temporary directory for storage
with tempfile.TemporaryDirectory() as tmpdir:
os.environ["OAUTH_STORAGE_PATH"] = tmpdir
yield TokenManager()
def test_generate_access_token(token_manager):
"""Test access token generation"""
token = token_manager.generate_access_token(
client_id="test_client", scope="read write", user_id="user_123"
)
# Should be valid JWT
assert len(token.split(".")) == 3
# Validate
payload = token_manager.validate_access_token(token)
assert payload["client_id"] == "test_client"
assert payload["scope"] == "read write"
assert payload["sub"] == "user_123"
def test_access_token_expiry(token_manager):
"""Test expired token"""
# Generate with short TTL
token_manager.access_token_ttl = 1
token = token_manager.generate_access_token("client", "read")
import time
time.sleep(2)
# Should raise
with pytest.raises(jwt.ExpiredSignatureError):
token_manager.validate_access_token(token)
def test_refresh_token_rotation(token_manager):
"""Test refresh token rotation"""
# Generate initial tokens
access_token = token_manager.generate_access_token("client", "read")
refresh_token = token_manager.generate_refresh_token("client", access_token)
# Rotate
new_tokens = token_manager.rotate_refresh_token(refresh_token, "client")
assert "access_token" in new_tokens
assert "refresh_token" in new_tokens
assert new_tokens["refresh_token"] != refresh_token
# Old token should be revoked - reuse triggers SecurityError
with pytest.raises(SecurityError, match="reuse detected"):
token_manager.rotate_refresh_token(refresh_token, "client")
def test_refresh_token_reuse_detection(token_manager):
"""Test reuse detection"""
access_token = token_manager.generate_access_token("client", "read")
refresh_token = token_manager.generate_refresh_token("client", access_token)
# First rotation
token_manager.rotate_refresh_token(refresh_token, "client")
# Attempt reuse
with pytest.raises(SecurityError, match="reuse detected"):
token_manager.rotate_refresh_token(refresh_token, "client")
