Jarian Cottingham
4bd538b217
Critical: build_leaf_cert self-signed leaves with the leaf key instead of the YubiKey-held Intermediate CA key. Now extracts TBS, signs via pkcs11-tool (ECDSA-SHA384), reassembles, and verifies against the intermediate CA public key before returning. - setup-certauth.sh: ~1100 lines of stale inline api/ copies replaced with copy-from-repo (single source of truth); writes private /etc/certauth/certauth.env (0600); DB init loads env, no more swallowed errors; systemd unit gets EnvironmentFile= - config.py: YubiKey serials no longer hard-coded (env, fail closed); aarch64-only PKCS#11 path replaced with arch-neutral default; all paths env-overridable (CERTAUTH_*) - main.py: removed dead fastapi.security.CSRFProtection import (crashed startup); module-relative static/templates dirs; created_by resolved from the authenticated user instead of hard-coded 1; unclosed file handles fixed; domain_id 0 stored as NULL (FK bug) - models.py: certificates.domain_id FK pointed at users(id), now domains(id) - login: CSRF token now actually sent and validated - tests: 23 tests (auth, API flows, DER helpers, signing pipeline) - README, LICENSE, requirements.txt, pyproject.toml
33 lines
867 B
Python
33 lines
867 B
Python
"""JWT auth unit tests."""
|
|
|
|
from datetime import timedelta
|
|
|
|
import pytest
|
|
from fastapi import HTTPException
|
|
|
|
from auth import create_access_token, get_current_user
|
|
|
|
|
|
def test_token_roundtrip():
|
|
token = create_access_token({"sub": "certauth"})
|
|
assert get_current_user(token) == "certauth"
|
|
|
|
|
|
def test_rejects_garbage_token():
|
|
with pytest.raises(HTTPException) as exc:
|
|
get_current_user("not-a-jwt")
|
|
assert exc.value.status_code == 401
|
|
|
|
|
|
def test_rejects_expired_token():
|
|
token = create_access_token({"sub": "certauth"}, expires_delta=timedelta(minutes=-5))
|
|
with pytest.raises(HTTPException) as exc:
|
|
get_current_user(token)
|
|
assert exc.value.status_code == 401
|
|
|
|
|
|
def test_rejects_token_without_subject():
|
|
token = create_access_token({"other": "claim"})
|
|
with pytest.raises(HTTPException):
|
|
get_current_user(token)
|