44 lines
1.7 KiB
Python
44 lines
1.7 KiB
Python
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from device_auth import DeviceStore
|
|
|
|
|
|
class DeviceAuthTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.root = tempfile.TemporaryDirectory()
|
|
self.store = DeviceStore(Path(self.root.name) / 'auth.db')
|
|
|
|
def tearDown(self):
|
|
self.root.cleanup()
|
|
|
|
def test_pairing_is_single_use_and_devices_have_independent_credentials(self):
|
|
code = self.store.create_code()
|
|
first = self.store.enroll(code, 'one')
|
|
with self.assertRaises(PermissionError):
|
|
self.store.enroll(code, 'replay')
|
|
second = self.store.enroll(self.store.create_code(), 'two')
|
|
self.assertNotEqual(first['token'], second['token'])
|
|
self.assertEqual(first['deviceId'], self.store.authenticate(first['token']))
|
|
self.store.revoke(first['deviceId'])
|
|
with self.assertRaises(PermissionError):
|
|
self.store.authenticate(first['token'])
|
|
self.assertEqual(second['deviceId'], self.store.authenticate(second['token']))
|
|
|
|
def test_expired_pairing_and_unknown_tokens_are_rejected(self):
|
|
with self.assertRaises(PermissionError):
|
|
self.store.enroll(self.store.create_code(lifetime=-1), 'expired')
|
|
with self.assertRaises(PermissionError):
|
|
self.store.authenticate('old-shared-apk-token')
|
|
|
|
def test_database_contains_hashes_not_bearer_tokens(self):
|
|
enrolled = self.store.enroll(self.store.create_code(), 'phone')
|
|
with self.store.connect() as db:
|
|
value = db.execute('SELECT token_hash FROM devices').fetchone()[0]
|
|
self.assertNotEqual(enrolled['token'], value)
|
|
self.assertEqual(64, len(value))
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|