o
    H\jr                     @  s  d Z ddlmZ ddlZddlZddlZddlZddlZddlm	Z	 e	e
 jd Zejdee ejdZedurGeedsGejd= ddlZddlmZ dd	lmZmZmZmZ dd
lmZ ddlm Z  ddl!m"Z" G dd dej#Z$e%dkrej&dd dS dS )zStandalone security checks.

This runner intentionally avoids pytest because the project package named
``platform`` currently collides with Python's standard-library module.
    )annotationsN)Path   platform__path__)rsa)EncodingNoEncryptionPrivateFormatPublicFormat)Flask)platform_api)jwt_authc                   @  sZ   e Zd Zedd Zedd ZedddZd	d
 Zdd Zdd Z	dd Z
dd ZdS )JWTConnectionChecksc                 C  s   t  | _t| jj| _tjddd}|t	j
tjt | _| t	j
tj}|d| _| jd | t| jtjd< dtjd< d	tjd
< tt}d|jd< |t | | _d S )Ni  i   )public_exponentkey_sizezutf-8ztest-key.pemJWT_PUBLIC_KEYS_DIRabsolutems-apiJWT_AUDIENCEhttps://absolutems.com.auJWT_ALLOWED_ISSUERSFREGISTER_BOOTSTRAP_SITES) tempfileTemporaryDirectorytemp_dirr   namekeys_dirr   generate_private_keyprivate_bytesr   PEMr
   PKCS8r	   private_pem
public_keypublic_bytesr   SubjectPublicKeyInfodecode
public_pemwrite_bytesstrosenvironr   __name__configregister_blueprintr   test_clientclient)clsprivate_keyr&   app r3   tests/platform/auth_checks.py
setUpClass&   s*   




zJWTConnectionChecks.setUpClassc                 C  s   | j   d S )N)r   cleanup)r0   r3   r3   r4   tearDownClass?   s   z!JWTConnectionChecks.tearDownClassreturnr(   c                 K  sV   t t }ddddddgdgd||d	 |d
 d}|| tj|| jdddidS )Nr   r   	wp-user-1
absolutems	test-siteadministratorzplatform:connectztest-request   i,  )issaudsub	tenant_idsite_idrolesscopesjtiiatnbfexpRS256kidztest-key)	algorithmheaders)inttimeupdatejwtencoder!   )r0   	overridesnowclaimsr3   r3   r4   
make_tokenC   s(   
zJWTConnectionChecks.make_tokenc                 C  s2   | j d}| d|j | d| d  d S )N/api/v1/platform/connection  zMissing Bearer tokenmessage)r/   getassertEqualstatus_codeget_jsonselfresponser3   r3   r4   test_missing_token_is_rejected[   s   z2JWTConnectionChecks.test_missing_token_is_rejectedc                 C  sn   | j jddd|   id}| }| d|j | |d  | d|d d	  | d
|d d  d S )NrV   AuthorizationBearer rL      authenticatedr:   identityrA   r9   subject)r/   rY   rU   r\   rZ   r[   
assertTrue)r^   r_   payloadr3   r3   r4   test_valid_token_is_accepted`   s   z0JWTConnectionChecks.test_valid_token_is_acceptedc                 C  s6   | j jddd| jdgd id}| d|j d S )NrV   ra   rb   zwp_invoices:read)rD   rc   i  r/   rY   rU   rZ   r[   r]   r3   r3   r4   test_wrong_scope_is_rejectedk   s   z0JWTConnectionChecks.test_wrong_scope_is_rejectedc                 C  s4   | j jddd| jdd id}| d|j d S )NrV   ra   rb   zhttps://attacker.example)r>   rc   rW   rk   r]   r3   r3   r4   test_wrong_issuer_is_rejectedt   s   z1JWTConnectionChecks.test_wrong_issuer_is_rejectedc                   sl   t j} fddt _z jjddd   id}W |t _n|t _w  d|j  d| d	  d S )
Nc              	     s   | dddd j dddS )Nr;   r:   r   r   revokedactive)key_idrB   rA   issueraudiencepublic_key_pem
key_statussite_status)r&   )rJ   r^   r3   r4   <lambda>   s   zZJWTConnectionChecks.test_registered_revoked_key_never_falls_back_to_file.<locals>.<lambda>rV   ra   rb   rc   rW   rn   rX   )	r   _registered_keyr/   rY   rU   rZ   r[   assertInr\   )r^   originalr_   r3   rv   r4   4test_registered_revoked_key_never_falls_back_to_file}   s   
zHJWTConnectionChecks.test_registered_revoked_key_never_falls_back_to_fileN)r8   r(   )r+   
__module____qualname__classmethodr5   r7   rU   r`   rj   rl   rm   r{   r3   r3   r3   r4   r   %   s    

		r   __main__)	verbosity)'__doc__
__future__r   r)   sysr   rN   unittestpathlibr   __file__resolveparentsPROJECT_ROOTpathinsertr(   modulesrY   loaded_platformhasattrrP   )cryptography.hazmat.primitives.asymmetricr   ,cryptography.hazmat.primitives.serializationr   r	   r
   r   flaskr   platform.gateway.platform_apir   platform.authr   TestCaser   r+   mainr3   r3   r3   r4   <module>   s.    o