ljwx-children/tests/unit/test_auth_utils.py

"""
Unit tests for backend.auth.utils module.

Tests:
- Password hashing and verification
- JWT token creation and verification
- Token blacklist functions
"""

import pytest
from datetime import datetime, timedelta
import jwt as pyjwt

from backend.auth.utils import (
    hash_password,
    verify_password,
    create_access_token,
    create_refresh_token,
    verify_token,
    SECRET_KEY,
    ALGORITHM,
)


class TestPasswordHashing:
    """Test password hashing functions."""

    def test_hash_password_returns_string(self):
        """hash_password should return a string."""
        password = "SecurePassword123!"
        hashed = hash_password(password)

        assert isinstance(hashed, str)
        assert len(hashed) > 0

    def test_hash_password_different_each_time(self):
        """hash_password should return different hashes for same password (salt)."""
        password = "SecurePassword123!"
        hash1 = hash_password(password)
        hash2 = hash_password(password)

        assert hash1 != hash2  # Different salts

    def test_verify_password_success(self):
        """verify_password should return True for correct password."""
        password = "SecurePassword123!"
        hashed = hash_password(password)

        assert verify_password(password, hashed) is True

    def test_verify_password_failure(self):
        """verify_password should return False for incorrect password."""
        password = "SecurePassword123!"
        hashed = hash_password(password)
        wrong_password = "WrongPassword456!"

        assert verify_password(wrong_password, hashed) is False

    def test_verify_password_empty_password(self):
        """verify_password should handle empty passwords."""
        hashed = hash_password("test")

        assert verify_password("", hashed) is False


class TestJWTTokens:
    """Test JWT token creation and verification."""

    def test_create_access_token_returns_string(self):
        """create_access_token should return a string."""
        data = {"sub": "user-123", "role": "child"}
        token = create_access_token(data)

        assert isinstance(token, str)
        assert len(token) > 0

    def test_create_access_token_contains_payload(self):
        """create_access_token should encode payload data."""
        data = {"sub": "user-123", "role": "psychologist"}
        token = create_access_token(data)

        # Decode without verification to check payload
        payload = pyjwt.decode(token, options={"verify_signature": False})

        assert payload["sub"] == "user-123"
        assert payload["role"] == "psychologist"
        assert "exp" in payload  # Expiration
        assert "iat" in payload  # Issued at
        assert "jti" in payload  # JWT ID

    def test_create_access_token_default_expiration(self):
        """create_access_token should use default 7-day expiration."""
        data = {"sub": "user-123"}
        token = create_access_token(data)

        payload = pyjwt.decode(token, options={"verify_signature": False})
        exp = datetime.fromtimestamp(payload["exp"])
        iat = datetime.fromtimestamp(payload["iat"])

        # Should be approximately 7 days (allow 1 second tolerance)
        delta = exp - iat
        assert 6.99 < delta.days < 7.01

    def test_create_access_token_custom_expiration(self):
        """create_access_token should accept custom expiration."""
        data = {"sub": "user-123"}
        custom_expiry = timedelta(hours=1)
        token = create_access_token(data, expires_delta=custom_expiry)

        payload = pyjwt.decode(token, options={"verify_signature": False})
        exp = datetime.fromtimestamp(payload["exp"])
        iat = datetime.fromtimestamp(payload["iat"])

        # Should be approximately 1 hour
        delta = (exp - iat).total_seconds()
        assert 3595 < delta < 3605  # Allow 5 second tolerance

    def test_create_refresh_token_contains_token_type(self):
        """create_refresh_token should mark token_type as 'refresh'."""
        data = {"sub": "user-123"}
        token = create_refresh_token(data)

        payload = pyjwt.decode(token, options={"verify_signature": False})

        assert payload["token_type"] == "refresh"
        assert payload["sub"] == "user-123"

    def test_create_refresh_token_30_day_expiration(self):
        """create_refresh_token should use 30-day expiration."""
        data = {"sub": "user-123"}
        token = create_refresh_token(data)

        payload = pyjwt.decode(token, options={"verify_signature": False})
        exp = datetime.fromtimestamp(payload["exp"])
        iat = datetime.fromtimestamp(payload["iat"])

        # Should be approximately 30 days
        delta = exp - iat
        assert 29.99 < delta.days < 30.01

    def test_verify_token_success(self):
        """verify_token should decode valid token."""
        data = {"sub": "user-123", "role": "guardian"}
        token = create_access_token(data)

        payload = verify_token(token)

        assert payload["sub"] == "user-123"
        assert payload["role"] == "guardian"

    def test_verify_token_invalid_signature(self):
        """verify_token should raise InvalidTokenError for tampered token."""
        data = {"sub": "user-123"}
        token = create_access_token(data)

        # Tamper with token
        tampered_token = token[:-5] + "XXXXX"

        with pytest.raises(pyjwt.InvalidTokenError):
            verify_token(tampered_token)

    def test_verify_token_expired(self):
        """verify_token should raise ExpiredSignatureError for expired token."""
        data = {"sub": "user-123"}
        # Create token that expired 1 hour ago
        expired_delta = timedelta(hours=-1)
        token = create_access_token(data, expires_delta=expired_delta)

        with pytest.raises(pyjwt.ExpiredSignatureError):
            verify_token(token)

    def test_verify_token_invalid_format(self):
        """verify_token should raise InvalidTokenError for malformed token."""
        invalid_token = "not.a.valid.jwt.token"

        with pytest.raises(pyjwt.InvalidTokenError):
            verify_token(invalid_token)


class TestTokenBlacklist:
    """Test token blacklist functions."""

    @pytest.mark.asyncio
    async def test_is_token_blacklisted_placeholder(self):
        """is_token_blacklisted should return False (placeholder implementation)."""
        from backend.auth.utils import is_token_blacklisted

        result = await is_token_blacklisted("some-jti")

        assert result is False  # Placeholder always returns False

    @pytest.mark.asyncio
    async def test_blacklist_token_placeholder(self):
        """blacklist_token should not raise errors (placeholder implementation)."""
        from backend.auth.utils import blacklist_token

        # Should not raise any errors
        await blacklist_token("some-jti", 3600)


class TestSecurityConstants:
    """Test security configuration constants."""

    def test_secret_key_configured(self):
        """SECRET_KEY should be configured."""
        assert SECRET_KEY is not None
        assert len(SECRET_KEY) > 0

    def test_algorithm_is_hs256(self):
        """ALGORITHM should be HS256."""
        assert ALGORITHM == "HS256"