27 lines
902 B
Python
27 lines
902 B
Python
from app.platform import session
|
|
|
|
SECRET = "test-secret"
|
|
|
|
|
|
def test_sign_then_verify_round_trips():
|
|
token = session.sign({"account_id": 7, "email": "m@example.com"}, SECRET)
|
|
assert session.verify(token, SECRET) == {"account_id": 7, "email": "m@example.com"}
|
|
|
|
|
|
def test_verify_rejects_tampered_payload():
|
|
token = session.sign({"account_id": 7}, SECRET)
|
|
payload_b64, _, sig = token.partition(".")
|
|
# Flip the payload but keep the old signature -> must be rejected.
|
|
forged = session.sign({"account_id": 8}, SECRET).split(".")[0] + "." + sig
|
|
assert session.verify(forged, SECRET) is None
|
|
|
|
|
|
def test_verify_rejects_wrong_secret():
|
|
token = session.sign({"account_id": 7}, SECRET)
|
|
assert session.verify(token, "other-secret") is None
|
|
|
|
|
|
def test_verify_rejects_garbage():
|
|
assert session.verify("not-a-token", SECRET) is None
|
|
assert session.verify("", SECRET) is None
|