diff options
Diffstat (limited to 'packages/meshbay-hub/tests/test_hub_api.py')
| -rw-r--r-- | packages/meshbay-hub/tests/test_hub_api.py | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py index 2afd27b..162b074 100644 --- a/packages/meshbay-hub/tests/test_hub_api.py +++ b/packages/meshbay-hub/tests/test_hub_api.py @@ -3,6 +3,7 @@ Integration tests for the Hub API. Uses SQLite in-memory + httpx.AsyncClient — no PostgreSQL, no network. """ +from meshbay_common.tokens import HUB_API_AUD from datetime import UTC import pytest @@ -142,7 +143,7 @@ async def test_jwt_offline_verify(client, hub_key_path): r_pk = await client.get("/v1/hub/pubkey") hub_pk_pem = r_pk.json()["pk_hub_pem"].encode() - decoded = pyjwt.decode(token, hub_pk_pem, algorithms=["EdDSA"]) + decoded = pyjwt.decode(token, hub_pk_pem, algorithms=["EdDSA"], audience=HUB_API_AUD) assert "jti" in decoded # mandatory # The token carries no user key. It used to, and the node recorded it as the # uploader's identity — so whoever issued tokens decided who could delete a @@ -339,7 +340,7 @@ async def test_jwt_contains_groups_claim(client): token_pre = r.json()["access_token"] r_pk = await client.get("/v1/hub/pubkey") hub_pk = r_pk.json()["pk_hub_pem"].encode() - decoded_pre = pyjwt.decode(token_pre, hub_pk, algorithms=["EdDSA"]) + decoded_pre = pyjwt.decode(token_pre, hub_pk, algorithms=["EdDSA"], audience=HUB_API_AUD) assert decoded_pre["groups"] == [] # Alice creates a group and adds Bob @@ -359,13 +360,13 @@ async def test_jwt_contains_groups_claim(client): r = await client.post("/v1/users/login", json={ "username": "grp_bob_test", "password": "bobpass99"}) token_post = r.json()["access_token"] - decoded_post = pyjwt.decode(token_post, hub_pk, algorithms=["EdDSA"]) + decoded_post = pyjwt.decode(token_post, hub_pk, algorithms=["EdDSA"], audience=HUB_API_AUD) assert group_id in decoded_post["groups"] # Alice (admin) should also have the group in her JWT r = await client.post("/v1/users/login", json={ "username": "grp_alice", "password": "alicepass99"}) - decoded_alice = pyjwt.decode(r.json()["access_token"], hub_pk, algorithms=["EdDSA"]) + decoded_alice = pyjwt.decode(r.json()["access_token"], hub_pk, algorithms=["EdDSA"], audience=HUB_API_AUD) assert group_id in decoded_alice["groups"] |