Omar SobhandClaude Fable 5
c4349bf292
- tc-auth: argon2id passwords, hashed opaque bearer tokens in auth_sessions
(migration 0002), anti-enumeration login errors, redacted token Debug
- tc-api: axum router with /healthz, /api/auth/login|logout, /api/user/me,
/api/team/{claws,credits,permissions}; Authed bearer extractor + RBAC
permission derivation; integration-tested over real TCP vs real Postgres
- teamclaw-server: config -> pool -> self-migrate -> serve
Co-Authored-By: Claude Fable 5 <[email protected]>
128 lines
4.3 KiB
Rust
128 lines
4.3 KiB
Rust
use tc_auth::{AuthError, AuthService};
|
|
use tc_domain::{Role, User, UserId, Workspace, WorkspaceId};
|
|
|
|
async fn seeded(pool: &sqlx::PgPool) -> (Workspace, User) {
|
|
let ws = Workspace {
|
|
id: WorkspaceId::new(),
|
|
name: "Acme".into(),
|
|
plan: "team".into(),
|
|
};
|
|
tc_db::repo::workspaces::insert(pool, &ws).await.unwrap();
|
|
let user = User {
|
|
id: UserId::new(),
|
|
workspace_id: ws.id,
|
|
email: "[email protected]".into(),
|
|
role: Role::Owner,
|
|
display_name: "Owner".into(),
|
|
created_at: time::OffsetDateTime::UNIX_EPOCH,
|
|
};
|
|
tc_db::repo::users::insert(pool, &user).await.unwrap();
|
|
(ws, user)
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn register_login_authenticate_round_trip() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let (ws, user) = seeded(&pool).await;
|
|
let auth = AuthService::new(pool);
|
|
|
|
auth.set_password(user.id, "correct horse battery staple")
|
|
.await
|
|
.unwrap();
|
|
let token = auth
|
|
.login_local("[email protected]", "correct horse battery staple")
|
|
.await
|
|
.unwrap();
|
|
|
|
let authed = auth.authenticate(token.secret()).await.unwrap();
|
|
assert_eq!(authed.user_id, user.id);
|
|
assert_eq!(authed.workspace_id, ws.id);
|
|
assert_eq!(authed.role, Role::Owner);
|
|
assert!(authed.role.is_owner());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn wrong_password_is_rejected_without_detail() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let (_, user) = seeded(&pool).await;
|
|
let auth = AuthService::new(pool);
|
|
auth.set_password(user.id, "right").await.unwrap();
|
|
|
|
let err = auth
|
|
.login_local("[email protected]", "wrong")
|
|
.await
|
|
.unwrap_err();
|
|
assert!(matches!(err, AuthError::InvalidCredentials));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn unknown_email_is_the_same_error_as_wrong_password() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let auth = AuthService::new(pool);
|
|
let err = auth.login_local("[email protected]", "pw").await.unwrap_err();
|
|
// Indistinguishable from a wrong password: no account enumeration.
|
|
assert!(matches!(err, AuthError::InvalidCredentials));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn user_without_password_cannot_login_locally() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let (_, _user) = seeded(&pool).await;
|
|
let auth = AuthService::new(pool);
|
|
let err = auth.login_local("[email protected]", "pw").await.unwrap_err();
|
|
assert!(matches!(err, AuthError::InvalidCredentials));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn unknown_token_is_unauthenticated() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let auth = AuthService::new(pool);
|
|
let err = auth.authenticate("not-a-real-token").await.unwrap_err();
|
|
assert!(matches!(err, AuthError::Unauthenticated));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn expired_session_is_unauthenticated() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let (_, user) = seeded(&pool).await;
|
|
let auth = AuthService::new(pool.clone());
|
|
auth.set_password(user.id, "pw").await.unwrap();
|
|
let token = auth.login_local("[email protected]", "pw").await.unwrap();
|
|
|
|
sqlx::query("UPDATE auth_sessions SET expires_at = now() - interval '1 minute'")
|
|
.execute(&pool)
|
|
.await
|
|
.unwrap();
|
|
|
|
let err = auth.authenticate(token.secret()).await.unwrap_err();
|
|
assert!(matches!(err, AuthError::Unauthenticated));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn logout_invalidates_the_token() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let (_, user) = seeded(&pool).await;
|
|
let auth = AuthService::new(pool);
|
|
auth.set_password(user.id, "pw").await.unwrap();
|
|
let token = auth.login_local("[email protected]", "pw").await.unwrap();
|
|
|
|
auth.authenticate(token.secret()).await.unwrap();
|
|
auth.logout(token.secret()).await.unwrap();
|
|
let err = auth.authenticate(token.secret()).await.unwrap_err();
|
|
assert!(matches!(err, AuthError::Unauthenticated));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn tokens_are_unique_per_login() {
|
|
let pool = tc_testkit::test_pool().await;
|
|
let (_, user) = seeded(&pool).await;
|
|
let auth = AuthService::new(pool);
|
|
auth.set_password(user.id, "pw").await.unwrap();
|
|
let a = auth.login_local("[email protected]", "pw").await.unwrap();
|
|
let b = auth.login_local("[email protected]", "pw").await.unwrap();
|
|
assert_ne!(a.secret(), b.secret());
|
|
// Both remain valid concurrently (multiple devices).
|
|
auth.authenticate(a.secret()).await.unwrap();
|
|
auth.authenticate(b.secret()).await.unwrap();
|
|
}
|