8b84378fe1
Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation: - Local memory backend (Zep-compatible): memory services/models, local graph builder + updater, AgentActivity seam, import-boundary isolation; Zep stays default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven. - Durable product persistence: projects/simulations/reports schema (migration 0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project read-first + ArtifactStore abstraction; durable JobQueue + worker.py. - SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM accounting), redacted AuditService, idempotency, CORS allowlist, safe API errors, single-use PasswordResetService + endpoints (covers invite-pending). - Exactly 3 roles (super_admin/admin/user) with tenant authz policy. - Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with admin/super-admin route guards, th/en i18n. - Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep. Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap). No commit of credentials; secrets handled via env/.env.example. Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel container build of deploy topology.
88 lines
3.1 KiB
Python
88 lines
3.1 KiB
Python
from datetime import datetime, timedelta, timezone
|
|
|
|
from app.models.saas import AuthSession
|
|
from app.services.identity import IdentityRepository, PasswordService, SessionService
|
|
|
|
|
|
def test_session_token_is_hashed_and_resolvable():
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import Session
|
|
from app.db import Base
|
|
|
|
engine = create_engine("sqlite+pysqlite:///:memory:")
|
|
Base.metadata.create_all(engine)
|
|
session = Session(engine)
|
|
try:
|
|
repo = IdentityRepository(session)
|
|
org = repo.create_organization(name="Org A", slug="org-a")
|
|
user = repo.create_user(
|
|
email="admin@example.com",
|
|
password_hash=PasswordService.hash_password("correct horse battery staple"),
|
|
)
|
|
membership = repo.create_membership(user.id, org.id, "admin")
|
|
raw_token, stored = SessionService.create(session, user, membership.id)
|
|
session.commit()
|
|
|
|
assert raw_token != stored.token_hash
|
|
assert len(stored.token_hash) == 64
|
|
resolved = SessionService.resolve(session, raw_token)
|
|
assert resolved is not None
|
|
assert resolved.user.id == user.id
|
|
assert resolved.membership.id == membership.id
|
|
assert resolved.organization.id == org.id
|
|
finally:
|
|
session.close()
|
|
engine.dispose()
|
|
|
|
|
|
def test_revoked_or_stale_auth_version_session_is_not_resolvable():
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import Session
|
|
from app.db import Base
|
|
|
|
engine = create_engine("sqlite+pysqlite:///:memory:")
|
|
Base.metadata.create_all(engine)
|
|
session = Session(engine)
|
|
try:
|
|
repo = IdentityRepository(session)
|
|
org = repo.create_organization(name="Org A", slug="org-a")
|
|
user = repo.create_user(email="user@example.com")
|
|
membership = repo.create_membership(user.id, org.id, "user")
|
|
raw_token, _stored = SessionService.create(session, user, membership.id)
|
|
session.commit()
|
|
|
|
user.auth_version += 1
|
|
session.commit()
|
|
assert SessionService.resolve(session, raw_token) is None
|
|
|
|
user.auth_version -= 1
|
|
session.commit()
|
|
assert SessionService.revoke(session, raw_token) is True
|
|
session.commit()
|
|
assert SessionService.resolve(session, raw_token) is None
|
|
finally:
|
|
session.close()
|
|
engine.dispose()
|
|
|
|
|
|
def test_expired_session_is_not_resolvable():
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import Session
|
|
from app.db import Base
|
|
|
|
engine = create_engine("sqlite+pysqlite:///:memory:")
|
|
Base.metadata.create_all(engine)
|
|
session = Session(engine)
|
|
try:
|
|
repo = IdentityRepository(session)
|
|
org = repo.create_organization(name="Org A", slug="org-a")
|
|
user = repo.create_user(email="expired@example.com")
|
|
membership = repo.create_membership(user.id, org.id, "user")
|
|
raw_token, stored = SessionService.create(session, user, membership.id)
|
|
stored.expires_at = datetime.now(timezone.utc) - timedelta(seconds=1)
|
|
session.commit()
|
|
assert SessionService.resolve(session, raw_token) is None
|
|
finally:
|
|
session.close()
|
|
engine.dispose()
|