elemes/services/tests/test_auth_routes.py

59 lines
1.7 KiB
Python

"""
Kontrak route autentikasi. Token asli siswa tetap dipakai untuk login;
response dan log tidak boleh mengekspos credential.
Integrasi PostgreSQL (butuh DATABASE_URL) — backend CSV sudah dicabut.
"""
import os
import pytest
from services.tests.conftest import STUDENT_TOKEN, TEACHER_TOKEN
pytestmark = pytest.mark.skipif(
not os.environ.get("DATABASE_URL"), reason="butuh PostgreSQL nyata"
)
@pytest.fixture(autouse=True)
def _seed(seed_demo_users):
yield
def test_login_success_sets_httponly_cookie(client):
resp = client.post("/login", json={"token": STUDENT_TOKEN})
assert resp.status_code == 200
body = resp.get_json()
assert body["success"] is True
assert body["student_name"] == "Budi Santoso"
assert body["is_teacher"] is False
set_cookie = resp.headers.get("Set-Cookie", "")
assert "student_token=" in set_cookie
assert "HttpOnly" in set_cookie
def test_login_teacher(client):
resp = client.post("/login", json={"token": TEACHER_TOKEN})
assert resp.get_json()["is_teacher"] is True
def test_login_invalid_token(client):
resp = client.post("/login", json={"token": "TOKEN_SALAH"})
assert resp.status_code == 200
assert resp.get_json()["success"] is False
def test_validate_token_route(client):
resp = client.post("/validate-token", json={"token": TEACHER_TOKEN})
body = resp.get_json()
assert body["success"] is True
assert body["is_teacher"] is True
def test_validate_token_from_cookie(client):
client.set_cookie("student_token", STUDENT_TOKEN)
resp = client.post("/validate-token", json={})
assert resp.get_json()["success"] is True
assert resp.get_json()["student_name"] == "Budi Santoso"