def test_admin_auth_should_not_allow_api_key_scheme(client, sample_api_key):
request.headers = {
"Authorization": "ApiKey-v1 {}".format(sample_api_key.secret)
}
with pytest.raises(AuthError) as exc:
requires_admin_auth()
assert exc.value.short_message == "Invalid scheme: can only use JWT for admin authentication"
def test_admin_auth_should_not_allow_request_with_old_iat(client):
iss = current_app.config['ADMIN_CLIENT_USER_NAME']
secret = current_app.config['API_INTERNAL_SECRETS'][0]
# code copied from notifications_python_client.authentication.py::create_jwt_token
headers = {"typ": 'JWT', "alg": 'HS256'}
claims = {'iss': iss, 'iat': int(time.time()) - 60}
token = jwt.encode(payload=claims, key=secret, headers=headers)
request.headers = {'Authorization': 'Bearer {}'.format(token)}
with pytest.raises(AuthError) as exc:
requires_admin_auth()
assert exc.value.short_message == "Invalid token: expired, check that your system clock is accurate"
def test_admin_auth_should_not_allow_request_with_no_iat(client):
iss = current_app.config['ADMIN_CLIENT_USER_NAME']
secret = current_app.config['API_INTERNAL_SECRETS'][0]
# code copied from notifications_python_client.authentication.py::create_jwt_token
headers = {"typ": 'JWT', "alg": 'HS256'}
claims = {
'iss': iss
# 'iat': not provided
}
token = jwt.encode(payload=claims, key=secret, headers=headers)
request.headers = {'Authorization': 'Bearer {}'.format(token)}
with pytest.raises(AuthError) as exc:
requires_admin_auth()
assert exc.value.short_message == "Unauthorized: admin authentication token not found"
def test_admin_auth_should_not_allow_request_with_no_iat(
client, sample_api_key):
iss = current_app.config["ADMIN_CLIENT_USER_NAME"]
# code copied from notifications_python_client.authentication.py::create_jwt_token
headers = {"typ": "JWT", "alg": "HS256"}
claims = {
"iss": iss
# 'iat': not provided
}
token = jwt.encode(payload=claims, key=str(uuid.uuid4()), headers=headers)
request.headers = {"Authorization": "Bearer {}".format(token)}
with pytest.raises(AuthError) as exc:
requires_admin_auth()
assert exc.value.short_message == "Invalid token: signature, api token is not valid"