opencloud-backend/tests/test_auth.py

import uuid

import pytest
from fastapi.testclient import TestClient

from app.routers import auth as auth_router
from tests.conftest import (
    bearer,
    capture_email,
    confirm_email,
    login_user,
    register_and_confirm,
    register_user,
)


# ---------------------------------------------------------------------------
# register
# ---------------------------------------------------------------------------


def test_register_success(client: TestClient, monkeypatch) -> None:
    email = f"reg-{uuid.uuid4().hex[:8]}@example.com"
    captured = capture_email(monkeypatch)
    r = register_user(client, email, "regpassword", "注册测试")
    assert r.status_code == 201
    assert r.json()["message"] == "注册成功，请查收确认邮件"
    assert "token" in captured


def test_register_duplicate_email(client: TestClient, monkeypatch) -> None:
    email = f"dup-{uuid.uuid4().hex[:8]}@example.com"
    register_user(client, email, "firstpass", "第一个用户")
    r = register_user(client, email, "secondpass", "第二个用户")
    assert r.status_code == 409
    assert "该邮箱已被注册" == r.json()["detail"]


def test_register_duplicate_username(client: TestClient, monkeypatch) -> None:
    email_a = f"dupname-a-{uuid.uuid4().hex[:8]}@example.com"
    email_b = f"dupname-b-{uuid.uuid4().hex[:8]}@example.com"
    register_user(client, email_a, "passA123", "同名用户")
    r = register_user(client, email_b, "passB123", "同名用户")
    assert r.status_code == 409
    assert "这个昵称已经被使用" == r.json()["detail"]


def test_register_short_password(client: TestClient) -> None:
    r = register_user(client, f"s-{uuid.uuid4().hex[:8]}@e.com", "1234567", "短密码")
    assert r.status_code == 422


def test_register_short_username(client: TestClient) -> None:
    r = register_user(client, f"s-{uuid.uuid4().hex[:8]}@e.com", "pass12345", "A")
    assert r.status_code == 422


def test_register_invalid_email(client: TestClient) -> None:
    r = register_user(client, "not-an-email", "pass12345", "坏邮箱")
    assert r.status_code == 422


# ---------------------------------------------------------------------------
# confirm-email
# ---------------------------------------------------------------------------


def test_confirm_email_valid(client: TestClient, monkeypatch) -> None:
    email = f"confirm-{uuid.uuid4().hex[:8]}@example.com"
    captured = capture_email(monkeypatch)
    r = register_user(client, email, "confirmpass", "确认测试")
    assert r.status_code == 201
    token = captured.get("token")
    assert token
    cr = confirm_email(client, token)
    assert cr.status_code == 200
    assert cr.json()["message"] == "邮箱确认成功"


def test_confirm_email_invalid_token(client: TestClient) -> None:
    r = confirm_email(client, "not-a-valid-token-at-all-never")
    assert r.status_code == 400
    assert "无效" in r.json()["detail"]


# ---------------------------------------------------------------------------
# login
# ---------------------------------------------------------------------------


def test_login_success(client: TestClient, monkeypatch) -> None:
    email = f"login-{uuid.uuid4().hex[:8]}@example.com"
    info = register_and_confirm(client, monkeypatch, email, "loginpass", "登录测试")
    assert info["token"]
    assert info["user_id"]


def test_login_wrong_password(client: TestClient, monkeypatch) -> None:
    email = f"loginfail-{uuid.uuid4().hex[:8]}@example.com"
    register_and_confirm(client, monkeypatch, email, "rightpass", "登录失败")
    r = login_user(client, email, "wrongpass")
    assert r.status_code == 401
    assert "邮箱或密码错误" == r.json()["detail"]


def test_login_nonexistent_email(client: TestClient) -> None:
    r = login_user(client, "nobody@example.com", "whatever")
    assert r.status_code == 401


def test_login_unverified_email(client: TestClient, monkeypatch) -> None:
    email = f"unverified-{uuid.uuid4().hex[:8]}@example.com"
    capture_email(monkeypatch)
    register_user(client, email, "unverified", "未确认")
    r = login_user(client, email, "unverified")
    assert r.status_code == 403
    assert "邮箱尚未确认" == r.json()["detail"]


def test_login_disabled_user(client: TestClient, monkeypatch) -> None:
    from tests.conftest import ADMIN_EMAIL, ADMIN_PASSWORD

    email = f"disabled-{uuid.uuid4().hex[:8]}@example.com"
    info = register_and_confirm(client, monkeypatch, email, "disabled", "禁用测试")
    admin_tok = login_user(client, ADMIN_EMAIL, ADMIN_PASSWORD).json()["access_token"]
    client.patch(
        f"/api/v1/admin/users/{info['user_id']}",
        headers=bearer(admin_tok),
        json={"is_disabled": True},
    )
    r = login_user(client, email, "disabled")
    assert r.status_code == 403
    assert "账号已被禁用" == r.json()["detail"]

    client.patch(
        f"/api/v1/admin/users/{info['user_id']}",
        headers=bearer(admin_tok),
        json={"is_disabled": False},
    )


# ---------------------------------------------------------------------------
# refresh
# ---------------------------------------------------------------------------


def test_refresh_success(client: TestClient, monkeypatch) -> None:
    email = f"refresh-{uuid.uuid4().hex[:8]}@example.com"
    register_and_confirm(client, monkeypatch, email, "refreshpass", "刷新测试")
    r = client.post("/api/v1/auth/refresh")
    assert r.status_code == 200
    assert "access_token" in r.json()


def test_refresh_no_cookie(client: TestClient) -> None:
    session_client = TestClient(client.app)
    r = session_client.post("/api/v1/auth/refresh")
    assert r.status_code == 401
    assert "缺少刷新令牌" == r.json()["detail"]


def test_refresh_invalid_cookie(client: TestClient) -> None:
    r = client.post(
        "/api/v1/auth/refresh",
        cookies={"opencloud_refresh": "not-a-valid-refresh-token-at-all"},
    )
    assert r.status_code == 401


# ---------------------------------------------------------------------------
# logout
# ---------------------------------------------------------------------------


def test_logout(client: TestClient) -> None:
    r = client.post("/api/v1/auth/logout")
    assert r.status_code == 200
    assert r.json()["message"] == "已退出登录"


# ---------------------------------------------------------------------------
# forgot-password / reset-password
# ---------------------------------------------------------------------------


def test_forgot_password_existing_email(client: TestClient, monkeypatch) -> None:
    email = f"forgot-{uuid.uuid4().hex[:8]}@example.com"
    register_and_confirm(client, monkeypatch, email, "forgotpass", "忘记密码")
    captured = {}
    monkeypatch.setattr(auth_router, "send_password_reset_email", captured.__setitem__)
    r = client.post("/api/v1/auth/forgot-password", json={"email": email})
    assert r.status_code == 202
    assert "邮件" in r.json()["message"]


def test_forgot_password_nonexistent_email(client: TestClient) -> None:
    r = client.post("/api/v1/auth/forgot-password", json={"email": "ghost@example.com"})
    assert r.status_code == 202


def test_reset_password_valid(client: TestClient, monkeypatch) -> None:
    email = f"reset-{uuid.uuid4().hex[:8]}@example.com"
    register_and_confirm(client, monkeypatch, email, "oldpass12", "重置密码")
    captured = {}
    monkeypatch.setattr(auth_router, "send_password_reset_email", lambda r, t: captured.update(token=t))

    client.post("/api/v1/auth/forgot-password", json={"email": email})
    token = captured.get("token")
    assert token

    r = client.post(
        "/api/v1/auth/reset-password",
        json={"token": token, "password": "newpass12"},
    )
    assert r.status_code == 200
    assert r.json()["message"] == "密码已重置，请重新登录"

    r = login_user(client, email, "oldpass12")
    assert r.status_code == 401
    r = login_user(client, email, "newpass12")
    assert r.status_code == 200


def test_reset_password_invalid_token(client: TestClient) -> None:
    r = client.post(
        "/api/v1/auth/reset-password",
        json={"token": "not-a-real-reset-token-ever", "password": "newpass12"},
    )
    assert r.status_code == 400
    assert "无效" in r.json()["detail"]


# ---------------------------------------------------------------------------
# change-password
# ---------------------------------------------------------------------------


def test_change_password(client: TestClient, monkeypatch) -> None:
    email = f"chpw-{uuid.uuid4().hex[:8]}@example.com"
    info = register_and_confirm(client, monkeypatch, email, "oldpass12", "改密")
    r = client.patch(
        "/api/v1/auth/password",
        headers=bearer(info["token"]),
        json={"password": "updatedpass12"},
    )
    assert r.status_code == 200
    assert "access_token" in r.json()

    r = login_user(client, email, "oldpass12")
    assert r.status_code == 401
    r = login_user(client, email, "updatedpass12")
    assert r.status_code == 200


# ---------------------------------------------------------------------------
# me
# ---------------------------------------------------------------------------


def test_me(client: TestClient, monkeypatch) -> None:
    email = f"me-{uuid.uuid4().hex[:8]}@example.com"
    info = register_and_confirm(client, monkeypatch, email, "mepass12!", "我的信息")
    r = client.get("/api/v1/auth/me", headers=bearer(info["token"]))
    assert r.status_code == 200
    body = r.json()
    assert body["user"]["email"] == email
    assert body["user"]["username"] == "我的信息"


def test_me_unauthenticated(client: TestClient) -> None:
    r = client.get("/api/v1/auth/me")
    assert r.status_code == 401