User authentication with tests.

tests/api/routes/controller/test_users.py

@@ -17,46 +17,237 @@
 
 import pytest
 
-from fastapi import FastAPI, status
-from fastapi.encoders import jsonable_encoder
+from typing import Optional, Union
+from fastapi import FastAPI, HTTPException, status
+from starlette.datastructures import Secret
 from httpx import AsyncClient
+from jose import jwt
 
+from sqlalchemy.ext.asyncio import AsyncSession
 from gns3server.db.repositories.users import UsersRepository
+from gns3server.services import auth_service
+from gns3server.services.authentication import SECRET_KEY, ALGORITHM
 from gns3server.schemas.users import User
 
 pytestmark = pytest.mark.asyncio
 
 
-# async def test_route_exist(app: FastAPI, client: AsyncClient) -> None:
-#
-#     params = {"username": "test_username", "email": "user@email.com", "password": "test_password"}
-#     response = await client.post(app.url_path_for("create_user"), json=params)
-#     assert response.status_code != status.HTTP_404_NOT_FOUND
-#
-#
-# async def test_users_can_register_successfully(app: FastAPI, client: AsyncClient) -> None:
-#
-#     user_repo = UsersRepository()
-#     params = {"username": "test_username2", "email": "user2@email.com", "password": "test_password2"}
-#
-#     # make sure the user doesn't exist in the database
-#     user_in_db = await user_repo.get_user_by_username(params["username"])
-#     assert user_in_db is None
-#
-#     # register the user
-#     res = await client.post(app.url_path_for("create_user"), json=params)
-#     assert res.status_code == status.HTTP_201_CREATED
-#
-#     # make sure the user does exists in the database now
-#     user_in_db = await user_repo.get_user_by_username(params["username"])
-#     assert user_in_db is not None
-#     assert user_in_db.email == params["email"]
-#     assert user_in_db.username == params["username"]
-#
-#     # check that the user returned in the response is equal to the user in the database
-#     created_user = User(**res.json()).json()
-#     print(created_user)
-#     #print(user_in_db.__dict__)
-#     test = jsonable_encoder(user_in_db.__dict__, exclude={"_sa_instance_state", "hashed_password"})
-#     print(test)
-#     assert created_user == test
+class TestUserRoutes:
+
+    async def test_route_exist(self, app: FastAPI, client: AsyncClient) -> None:
+
+        new_user = {"username": "test_user1", "email": "user1@email.com", "password": "test_password"}
+        response = await client.post(app.url_path_for("create_user"), json=new_user)
+        assert response.status_code != status.HTTP_404_NOT_FOUND
+
+    async def test_users_can_register_successfully(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        params = {"username": "test_user2", "email": "user2@email.com", "password": "test_password"}
+
+        # make sure the user doesn't exist in the database
+        user_in_db = await user_repo.get_user_by_username(params["username"])
+        assert user_in_db is None
+
+        # register the user
+        res = await client.post(app.url_path_for("create_user"), json=params)
+        assert res.status_code == status.HTTP_201_CREATED
+
+        # make sure the user does exists in the database now
+        user_in_db = await user_repo.get_user_by_username(params["username"])
+        assert user_in_db is not None
+        assert user_in_db.email == params["email"]
+        assert user_in_db.username == params["username"]
+
+        # check that the user returned in the response is equal to the user in the database
+        created_user = User(**res.json()).json()
+        assert created_user == User.from_orm(user_in_db).json()
+
+    @pytest.mark.parametrize(
+        "attr, value, status_code",
+        (
+                ("email", "user2@email.com", status.HTTP_400_BAD_REQUEST),
+                ("username", "test_user2", status.HTTP_400_BAD_REQUEST),
+                ("email", "invalid_email@one@two.io", status.HTTP_422_UNPROCESSABLE_ENTITY),
+                ("password", "short", status.HTTP_422_UNPROCESSABLE_ENTITY),
+                ("username", "user2@#$%^<>", status.HTTP_422_UNPROCESSABLE_ENTITY),
+                ("username", "ab", status.HTTP_422_UNPROCESSABLE_ENTITY),
+        )
+    )
+    async def test_user_registration_fails_when_credentials_are_taken(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            attr: str,
+            value: str,
+            status_code: int,
+    ) -> None:
+
+        new_user = {"email": "not_taken@email.com", "username": "not_taken_username", "password": "test_password"}
+        new_user[attr] = value
+        res = await client.post(app.url_path_for("create_user"), json=new_user)
+        assert res.status_code == status_code
+
+    async def test_users_saved_password_is_hashed(
+        self,
+        app: FastAPI,
+        client: AsyncClient,
+        db_session: AsyncSession
+    ) -> None:
+
+        user_repo = UsersRepository(db_session)
+        new_user = {"username": "test_user3", "email": "user3@email.com", "password": "test_password"}
+
+        # send post request to create user and ensure it is successful
+        res = await client.post(app.url_path_for("create_user"), json=new_user)
+        assert res.status_code == status.HTTP_201_CREATED
+
+        # ensure that the users password is hashed in the db
+        # and that we can verify it using our auth service
+        user_in_db = await user_repo.get_user_by_username(new_user["username"])
+        assert user_in_db is not None
+        assert user_in_db.hashed_password != new_user["password"]
+        assert auth_service.verify_password(new_user["password"], user_in_db.hashed_password)
+
+
+class TestAuthTokens:
+
+    async def test_can_create_token_successfully(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User
+    ) -> None:
+
+        token = auth_service.create_access_token(test_user.username)
+        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+        username = payload.get("sub")
+        assert username == test_user.username
+
+    async def test_token_missing_user_is_invalid(self, app: FastAPI, client: AsyncClient) -> None:
+
+        token = auth_service.create_access_token(None)
+        with pytest.raises(jwt.JWTError):
+            jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+
+    async def test_can_retrieve_username_from_token(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User
+    ) -> None:
+
+        token = auth_service.create_access_token(test_user.username)
+        username = auth_service.get_username_from_token(token)
+        assert username == test_user.username
+
+
+    @pytest.mark.parametrize(
+        "secret, wrong_token",
+        (
+                (SECRET_KEY, "asdf"),  # use wrong token
+                (SECRET_KEY, ""),  # use wrong token
+                ("ABC123", "use correct token"),  # use wrong secret
+        ),
+    )
+    async def test_error_when_token_or_secret_is_wrong(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            secret: Union[Secret, str],
+            wrong_token: Optional[str],
+    ) -> None:
+
+        token = auth_service.create_access_token(test_user.username)
+        if wrong_token == "use correct token":
+            wrong_token = token
+        with pytest.raises(HTTPException):
+            auth_service.get_username_from_token(wrong_token, secret_key=str(secret))
+
+
+class TestUserLogin:
+
+    async def test_user_can_login_successfully_and_receives_valid_token(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        client.headers["content-type"] = "application/x-www-form-urlencoded"
+        login_data = {
+            "username": test_user.username,
+            "password": "user1_password",
+        }
+        res = await client.post(app.url_path_for("login"), data=login_data)
+        assert res.status_code == status.HTTP_200_OK
+
+        # check that token exists in response and has user encoded within it
+        token = res.json().get("access_token")
+        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+        assert "sub" in payload
+        username = payload.get("sub")
+        assert username == test_user.username
+
+        # check that token is proper type
+        assert "token_type" in res.json()
+        assert res.json().get("token_type") == "bearer"
+
+    @pytest.mark.parametrize(
+        "username, password, status_code",
+        (
+            ("wrong_username", "user1_password", status.HTTP_401_UNAUTHORIZED),
+            ("user1", "wrong_password", status.HTTP_401_UNAUTHORIZED),
+            ("user1", None, status.HTTP_401_UNAUTHORIZED),
+        ),
+    )
+    async def test_user_with_wrong_creds_doesnt_receive_token(
+        self,
+        app: FastAPI,
+        client: AsyncClient,
+        test_user: User,
+        username: str,
+        password: str,
+        status_code: int,
+    ) -> None:
+
+        client.headers["content-type"] = "application/x-www-form-urlencoded"
+        login_data = {
+            "username": username,
+            "password": password,
+        }
+        res = await client.post(app.url_path_for("login"), data=login_data)
+        assert res.status_code == status_code
+        assert "access_token" not in res.json()
+
+
+class TestUserMe:
+
+    async def test_authenticated_user_can_retrieve_own_data(
+            self,
+            app: FastAPI,
+            authorized_client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        res = await authorized_client.get(app.url_path_for("get_current_active_user"))
+        assert res.status_code == status.HTTP_200_OK
+        user = User(**res.json())
+        assert user.username == test_user.username
+        assert user.email == test_user.email
+        assert user.user_id == test_user.user_id
+
+    async def test_user_cannot_access_own_data_if_not_authenticated(
+            self, app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+    ) -> None:
+
+        res = await client.get(app.url_path_for("get_current_active_user"))
+        assert res.status_code == status.HTTP_401_UNAUTHORIZED

tests/conftest.py

@@ -7,7 +7,6 @@ import os
 
 from fastapi import FastAPI
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
-from asgi_lifespan import LifespanManager
 from httpx import AsyncClient
 from unittest.mock import MagicMock, patch
 from pathlib import Path
@@ -17,25 +16,16 @@ from gns3server.config import Config
 from gns3server.compute import MODULES
 from gns3server.compute.port_manager import PortManager
 from gns3server.compute.project_manager import ProjectManager
-from gns3server.db.database import Base
+from gns3server.db.models import Base, User
+from gns3server.db.repositories.users import UsersRepository
+from gns3server.api.routes.controller.dependencies.database import get_db_session
+from gns3server.schemas.users import UserCreate
+from gns3server.services import auth_service
 
 sys._called_from_test = True
 sys.original_platform = sys.platform
 
 
-SQLALCHEMY_DATABASE_URL = "sqlite:///./test.db"
-
-engine = create_async_engine(
-    SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False}
-)
-
-
-async def start_db():
-    async with engine.begin() as conn:
-        await conn.run_sync(Base.metadata.drop_all)
-        await conn.run_sync(Base.metadata.create_all)
-
-
 if sys.platform.startswith("win") and sys.version_info < (3, 8):
     @pytest.yield_fixture(scope="session")
     def event_loop(request):
@@ -49,34 +39,64 @@ if sys.platform.startswith("win") and sys.version_info < (3, 8):
         yield loop
         asyncio.set_event_loop(None)
 
+# https://github.com/pytest-dev/pytest-asyncio/issues/68
+# this event_loop is used by pytest-asyncio, and redefining it
+# is currently the only way of changing the scope of this fixture
+@pytest.yield_fixture(scope="session")
+def event_loop(request):
 
-# @pytest.mark.asyncio
-# @pytest.fixture(scope="session", autouse=True)
-# async def database_connection() -> None:
-#
-#     from gns3server.db.tasks import connect_to_db
-#     os.environ["DATABASE_URI"] = "sqlite:///./sql_app_test.db"
-#     await connect_to_db()
-#     yield
+    loop = asyncio.get_event_loop_policy().new_event_loop()
+    yield loop
+    loop.close()
 
 
-@pytest.fixture#(scope="session")
-async def app() -> FastAPI:
+@pytest.fixture(scope="session")
+async def app(db_engine) -> FastAPI:
 
-    from gns3server.api.server import app as gns3_app
-    gns3_app.add_event_handler("startup", start_db())
-    return gns3_app
+    async with db_engine.begin() as conn:
+        await conn.run_sync(Base.metadata.drop_all)
+        await conn.run_sync(Base.metadata.create_all)
+    from gns3server.api.server import app as gns3app
+    yield gns3app
 
 
-# Grab a reference to our database when needed
-#@pytest.fixture
-#def db(app: FastAPI) -> Database:
-#    return app.state._db
+@pytest.fixture(scope="session")
+def db_engine():
+
+    db_url = os.getenv("GNS3_TEST_DATABASE_URI", "sqlite:///:memory:")  # "sqlite:///./sql_test_app.db"
+    engine = create_async_engine(db_url, connect_args={"check_same_thread": False}, future=True)
+    yield engine
+    engine.sync_engine.dispose()
+
+
+@pytest.fixture(scope="class")
+async def db_session(app: FastAPI, db_engine):
+
+    # recreate database tables for each class
+    # preferred and faster way would be to rollback the session/transaction
+    # but it doesn't work for some reason
+    async with db_engine.begin() as conn:
+        await conn.run_sync(Base.metadata.drop_all)
+        await conn.run_sync(Base.metadata.create_all)
+
+    session = AsyncSession(db_engine)
+    try:
+        yield session
+    finally:
+        await session.close()
+
 
 @pytest.fixture
-async def client(app: FastAPI) -> AsyncClient:
+async def client(app: FastAPI, db_session: AsyncSession) -> AsyncClient:
+
+    async def _get_test_db():
+        try:
+            yield db_session
+        finally:
+            pass
+
+    app.dependency_overrides[get_db_session] = _get_test_db
 
-    #async with LifespanManager(app):
     async with AsyncClient(
             app=app,
             base_url="http://test-api",
@@ -85,6 +105,32 @@ async def client(app: FastAPI) -> AsyncClient:
         yield client
 
 
+@pytest.fixture
+async def test_user(db_session: AsyncSession) -> User:
+
+    new_user = UserCreate(
+        username="user1",
+        email="user1@email.com",
+        password="user1_password",
+    )
+    user_repo = UsersRepository(db_session)
+    existing_user = await user_repo.get_user_by_username(new_user.username)
+    if existing_user:
+        return existing_user
+    return await user_repo.create_user(new_user)
+
+
+@pytest.fixture
+def authorized_client(client: AsyncClient, test_user: User) -> AsyncClient:
+
+    access_token = auth_service.create_access_token(test_user.username)
+    client.headers = {
+        **client.headers,
+        "Authorization": f"Bearer {access_token}",
+    }
+    return client
+
+
 @pytest.fixture
 def controller_config_path(tmpdir):