michele
a63e5bd7ab
Replace Faradworks Inc. TOS/privacy/contact/metadata with Michele Bigi. Dual-read pinscope_* keys; write periscope_* only. AGPL LICENSE and GitHub fork parent unchanged. validate.py not edited.
46 lines
1.4 KiB
Python
46 lines
1.4 KiB
Python
"""Fase A identity fence — dual-read PinScope issuers, write Periscope only."""
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
import jwt
|
|
|
|
from backend.pinscope_compat import JWT_ISSUER, LEGACY_JWT_ISSUERS
|
|
from backend.services.local_jwt import ALGORITHM, decode_token, issue_token
|
|
|
|
|
|
def test_issue_token_uses_periscope_issuer(monkeypatch):
|
|
from backend.config import settings
|
|
|
|
monkeypatch.setattr(settings, "auth_jwt_secret", "unit-test-secret-32-bytes-min!!")
|
|
token = issue_token("usr_test", "a@b.c")
|
|
payload = jwt.decode(
|
|
token,
|
|
"unit-test-secret-32-bytes-min!!",
|
|
algorithms=[ALGORITHM],
|
|
issuer=JWT_ISSUER,
|
|
options={"verify_aud": False},
|
|
)
|
|
assert payload["iss"] == JWT_ISSUER
|
|
assert payload["iss"] not in LEGACY_JWT_ISSUERS
|
|
|
|
|
|
def test_decode_token_accepts_legacy_pinscope_issuer(monkeypatch):
|
|
from backend.config import settings
|
|
|
|
monkeypatch.setattr(settings, "auth_jwt_secret", "unit-test-secret-32-bytes-min!!")
|
|
now = datetime.now(timezone.utc)
|
|
token = jwt.encode(
|
|
{
|
|
"sub": "usr_legacy",
|
|
"email": "old@b.c",
|
|
"iss": "pinscope-local",
|
|
"iat": now,
|
|
"exp": now + timedelta(days=1),
|
|
},
|
|
"unit-test-secret-32-bytes-min!!",
|
|
algorithm=ALGORITHM,
|
|
)
|
|
decoded = decode_token(token)
|
|
assert decoded is not None
|
|
assert decoded["sub"] == "usr_legacy"
|