"""Tests for API Key authentication module."""
import pytest
import time
from unittest.mock import MagicMock
from src.dolibarr_mcp.auth.api_key import (
APIKeyAuth,
generate_api_key,
verify_api_key,
extract_bearer_token,
)
class TestAPIKeyGeneration:
"""Tests for API key generation."""
def test_generate_key_default_length(self):
"""Generate key with default length (32 bytes = 64 hex chars)."""
key = generate_api_key()
assert len(key) == 64
assert all(c in "0123456789abcdef" for c in key)
def test_generate_key_custom_length(self):
"""Generate key with custom length."""
key = generate_api_key(length=16)
assert len(key) == 32
def test_generate_unique_keys(self):
"""Each generated key should be unique."""
keys = [generate_api_key() for _ in range(100)]
assert len(set(keys)) == 100
class TestBearerTokenExtraction:
"""Tests for bearer token extraction from Authorization header."""
def test_extract_valid_bearer(self):
"""Extract token from valid Bearer header."""
token = extract_bearer_token("Bearer abc123")
assert token == "abc123"
def test_extract_bearer_case_insensitive(self):
"""Bearer keyword should be case-insensitive."""
token = extract_bearer_token("bearer abc123")
assert token == "abc123"
token = extract_bearer_token("BEARER abc123")
assert token == "abc123"
def test_extract_empty_header(self):
"""Return None for empty header."""
token = extract_bearer_token("")
assert token is None
def test_extract_none_header(self):
"""Return None for None header."""
token = extract_bearer_token(None)
assert token is None
def test_extract_invalid_format(self):
"""Return None for non-Bearer auth."""
token = extract_bearer_token("Basic abc123")
assert token is None
def test_extract_no_token(self):
"""Return None when token missing."""
token = extract_bearer_token("Bearer")
assert token is None
class TestAPIKeyAuth:
"""Tests for APIKeyAuth class."""
def test_init_with_keys(self):
"""Initialize with explicit keys."""
auth = APIKeyAuth(api_keys=["key1", "key2"])
assert len(auth._key_hashes) == 2
def test_verify_valid_key(self):
"""Verify a valid API key."""
key = "test_api_key_12345"
auth = APIKeyAuth(api_keys=[key])
assert auth.verify(key) is True
def test_verify_invalid_key(self):
"""Reject an invalid API key."""
auth = APIKeyAuth(api_keys=["valid_key"])
assert auth.verify("invalid_key") is False
def test_verify_empty_key(self):
"""Reject empty key."""
auth = APIKeyAuth(api_keys=["valid_key"])
assert auth.verify("") is False
def test_no_keys_allows_all(self):
"""When no keys configured, allow all requests."""
auth = APIKeyAuth(api_keys=[])
assert auth.verify("any_key") is True
def test_rate_limiting(self):
"""Rate limiting should block excess requests."""
key = "test_key"
auth = APIKeyAuth(api_keys=[key], rate_limit=5, rate_window=60)
# First 5 requests should succeed
for _ in range(5):
assert auth.verify(key) is True
# 6th request should be rate limited
assert auth.verify(key) is False
def test_failed_attempts_tracking(self):
"""Track failed authentication attempts."""
auth = APIKeyAuth(api_keys=["valid_key"])
client_ip = "192.168.1.100"
# Make some failed attempts
for _ in range(5):
auth.verify("invalid_key", client_ip)
# Check attempts are tracked
assert client_ip in auth._failed_attempts
assert len(auth._failed_attempts[client_ip]) == 5
def test_ip_blocking(self):
"""Block IP after too many failed attempts."""
auth = APIKeyAuth(api_keys=["valid_key"])
client_ip = "192.168.1.100"
# Make 20 failed attempts
for _ in range(20):
auth.verify("invalid_key", client_ip)
# IP should now be blocked
assert auth.is_blocked(client_ip) is True
def test_ip_not_blocked_under_threshold(self):
"""IP should not be blocked under threshold."""
auth = APIKeyAuth(api_keys=["valid_key"])
client_ip = "192.168.1.100"
# Make 10 failed attempts (under default 20)
for _ in range(10):
auth.verify("invalid_key", client_ip)
assert auth.is_blocked(client_ip) is False
def test_get_stats(self):
"""Get authentication statistics."""
auth = APIKeyAuth(api_keys=["key1", "key2"])
stats = auth.get_stats()
assert stats["keys_configured"] == 2
assert "total_requests_last_minute" in stats
assert "blocked_ips" in stats
assert "failed_attempts_last_hour" in stats
class TestGlobalAuthFunctions:
"""Tests for global authentication functions."""
def test_verify_api_key_function(self, monkeypatch):
"""Test the global verify_api_key function."""
# Set environment variable for test
monkeypatch.setenv("MCP_API_KEY", "global_test_key")
# Reset global instance
import src.dolibarr_mcp.auth.api_key as auth_module
auth_module._auth_instance = None
# Should verify the key
assert verify_api_key("global_test_key") is True
assert verify_api_key("wrong_key") is False
