diff options
Diffstat (limited to 'packages/meshbay-hub/tests/test_public_groups_toggle.py')
| -rw-r--r-- | packages/meshbay-hub/tests/test_public_groups_toggle.py | 25 |
1 files changed, 10 insertions, 15 deletions
diff --git a/packages/meshbay-hub/tests/test_public_groups_toggle.py b/packages/meshbay-hub/tests/test_public_groups_toggle.py index 0d36b99..e52fa85 100644 --- a/packages/meshbay-hub/tests/test_public_groups_toggle.py +++ b/packages/meshbay-hub/tests/test_public_groups_toggle.py @@ -212,24 +212,19 @@ async def test_disabled_hands_a_non_member_no_node(client, db_session): def _mhp_token(hub_id): - """A peer-hub JWT, signed with the running hub's own key. + """A peer-hub JWT — from the hub's own issuer, which is the point. - `federation._issue_mhp_token` binds `_hub_sk_pem` at import time, before the - lifespan loads it, so it cannot be used from a test. This signs directly. + This used to sign by hand, and its two comments recorded, accurately, the + reasons it had to: `_issue_mhp_token` bound `_hub_sk_pem` at import, before + the lifespan loads it, so it signed with `None`; and it sets an `aud` that + the verifier named no audience for, which PyJWT refuses outright. Both were + written down here as facts to route around rather than as the defects they + were — between them MHP could not complete one authenticated request + between two real hubs. Fixed at the source, so this can call it. """ - import time - import uuid + from meshbay_hub.api.federation import _issue_mhp_token - import jwt - from meshbay_hub import auth as hub_auth - - now = int(time.time()) - # No `aud`: export_directory verifies without an expected audience, and PyJWT - # rejects a token that carries `aud` when decode() is given none. - return jwt.encode( - {"iss": hub_id, "sub": hub_id, - "jti": str(uuid.uuid4()), "iat": now, "exp": now + 300}, - hub_auth._hub_sk_pem, algorithm="EdDSA") + return _issue_mhp_token(hub_id) @pytest.mark.asyncio |