71 lines
2.8 KiB
Python
71 lines
2.8 KiB
Python
|
"""The internal token's derivation, and its cross-language contract with the Go daemon.
|
||
|
|
|
||
|
|
The daemon (backend/daemon/) and this app must compute byte-identical tokens from
|
||
|
|
the same THERMOGRAPH_AUTH_SECRET. If they drift, every callback fails with 401 --
|
||
|
|
which reads like an auth bug rather than like the configuration drift it is, so
|
||
|
|
the shared vector below is pinned on both sides.
|
||
|
|
"""
|
||
|
|
import hashlib
|
||
|
|
import hmac
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
|
||
|
|
from api import internal_routes
|
||
|
|
|
||
|
|
# Must equal backend/daemon/internal/config/derive_test.go's sharedVector*.
|
||
|
|
SHARED_VECTOR_SECRET = "test-auth-secret"
|
||
|
|
SHARED_VECTOR_TOKEN = "4c3830b2158941ff52720d198b65f7924372a3a482b8da52540a4d9be38247ea"
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.fixture(autouse=True)
|
||
|
|
def _clear_token_env(monkeypatch):
|
||
|
|
"""Both knobs start unset so each test states exactly the config it exercises."""
|
||
|
|
monkeypatch.delenv("THERMOGRAPH_INTERNAL_TOKEN", raising=False)
|
||
|
|
monkeypatch.delenv("THERMOGRAPH_AUTH_SECRET", raising=False)
|
||
|
|
|
||
|
|
|
||
|
|
def test_derived_token_matches_go(monkeypatch):
|
||
|
|
"""The pinned cross-language vector. Changing the label or construction here
|
||
|
|
requires the identical change in the Go daemon's config package."""
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_AUTH_SECRET", SHARED_VECTOR_SECRET)
|
||
|
|
assert internal_routes.resolve_internal_token() == SHARED_VECTOR_TOKEN
|
||
|
|
|
||
|
|
|
||
|
|
def test_vector_is_actually_hmac_of_the_label():
|
||
|
|
"""Guards against the vector and the implementation drifting together if
|
||
|
|
someone regenerates the constant from the code it is supposed to check."""
|
||
|
|
expected = hmac.new(
|
||
|
|
SHARED_VECTOR_SECRET.encode(),
|
||
|
|
internal_routes._DERIVE_LABEL,
|
||
|
|
hashlib.sha256,
|
||
|
|
).hexdigest()
|
||
|
|
assert expected == SHARED_VECTOR_TOKEN
|
||
|
|
|
||
|
|
|
||
|
|
def test_explicit_token_wins_over_derivation(monkeypatch):
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_AUTH_SECRET", SHARED_VECTOR_SECRET)
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_INTERNAL_TOKEN", "explicit-wins")
|
||
|
|
assert internal_routes.resolve_internal_token() == "explicit-wins"
|
||
|
|
|
||
|
|
|
||
|
|
def test_no_secret_at_all_leaves_the_surface_closed():
|
||
|
|
"""Neither knob set => no token => the router 404s. Fail closed, never open."""
|
||
|
|
assert internal_routes.resolve_internal_token() == ""
|
||
|
|
|
||
|
|
|
||
|
|
def test_derivation_is_not_the_auth_secret_itself(monkeypatch):
|
||
|
|
"""Domain separation: a leak of the internal token must not hand over the
|
||
|
|
session-signing key it was derived from."""
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_AUTH_SECRET", SHARED_VECTOR_SECRET)
|
||
|
|
token = internal_routes.resolve_internal_token()
|
||
|
|
assert token != SHARED_VECTOR_SECRET
|
||
|
|
assert SHARED_VECTOR_SECRET not in token
|
||
|
|
|
||
|
|
|
||
|
|
def test_different_secrets_derive_different_tokens(monkeypatch):
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_AUTH_SECRET", "secret-a")
|
||
|
|
a = internal_routes.resolve_internal_token()
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_AUTH_SECRET", "secret-b")
|
||
|
|
b = internal_routes.resolve_internal_token()
|
||
|
|
assert a != b
|