From bdefcd025604f2c3009fe5e0cc01213c2ba62a6a Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 15 Sep 2026 02:16:39 +0200 Subject: feat(hub): usernames are at least 8 characters at registration Existing shorter accounts keep signing in. Test usernames padded to match. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XuNrwLf5EFWCMHzfoEvnpm --- packages/meshbay-hub/tests/test_device_auth.py | 46 +++++++++++++------------- 1 file changed, 23 insertions(+), 23 deletions(-) (limited to 'packages/meshbay-hub/tests/test_device_auth.py') diff --git a/packages/meshbay-hub/tests/test_device_auth.py b/packages/meshbay-hub/tests/test_device_auth.py index 752a0e6..e899f12 100644 --- a/packages/meshbay-hub/tests/test_device_auth.py +++ b/packages/meshbay-hub/tests/test_device_auth.py @@ -39,7 +39,7 @@ def _sign(sk, username: str, ts: int | None = None) -> dict: "signature": base64.b64encode(sk.sign(message)).decode()} -async def _account(client, username="alice") -> str: +async def _account(client, username="alice_test") -> str: await client.post("/v1/users/register", json={ "username": username, "auth_key": "k" * 44, "email": f"{username}@example.invalid"}) @@ -62,7 +62,7 @@ async def test_a_registered_device_signs_in(client): sk, pk = _device() assert (await _register_device(client, token, pk, "laptop")).status_code == 201 - resp = await client.post("/v1/users/auth", json=_sign(sk, "alice")) + resp = await client.post("/v1/users/auth", json=_sign(sk, "alice_test")) assert resp.status_code == 200, resp.text body = resp.json() @@ -77,12 +77,12 @@ async def test_the_session_it_returns_is_a_real_one(client): await _register_device(client, token, pk) device_token = (await client.post( - "/v1/users/auth", json=_sign(sk, "alice"))).json()["access_token"] + "/v1/users/auth", json=_sign(sk, "alice_test"))).json()["access_token"] me = await client.get("/v1/users/me", headers={"Authorization": f"Bearer {device_token}"}) assert me.status_code == 200 - assert me.json()["username"] == "alice" + assert me.json()["username"] == "alice_test" async def test_several_devices_on_one_account(client): @@ -95,7 +95,7 @@ async def test_several_devices_on_one_account(client): for sk in (sk_a, sk_b): assert (await client.post("/v1/users/auth", - json=_sign(sk, "alice"))).status_code == 200 + json=_sign(sk, "alice_test"))).status_code == 200 listed = await client.get("/v1/users/devices", headers={"Authorization": f"Bearer {token}"}) @@ -108,20 +108,20 @@ async def test_an_unregistered_key_is_refused(client): await _account(client) sk, _ = _device() - resp = await client.post("/v1/users/auth", json=_sign(sk, "alice")) + resp = await client.post("/v1/users/auth", json=_sign(sk, "alice_test")) assert resp.status_code == 401 async def test_another_accounts_device_cannot_sign_in_as_you(client): - token_a = await _account(client, "alice") - await _account(client, "bob") + token_a = await _account(client, "alice_test") + await _account(client, "bob_test") sk, pk = _device() await _register_device(client, token_a, pk) # Alice's device, Bob's name. The signature covers the username, so it does # not verify — and even if it did, the key is not on Bob's account. - resp = await client.post("/v1/users/auth", json=_sign(sk, "bob")) + resp = await client.post("/v1/users/auth", json=_sign(sk, "bob_test")) assert resp.status_code == 401 @@ -133,7 +133,7 @@ async def test_a_stale_signature_is_refused(client): await _register_device(client, token, pk) old = int(time.time()) - 3600 - resp = await client.post("/v1/users/auth", json=_sign(sk, "alice", ts=old)) + resp = await client.post("/v1/users/auth", json=_sign(sk, "alice_test", ts=old)) assert resp.status_code == 401 assert "timestamp" in resp.json()["detail"].lower() @@ -144,7 +144,7 @@ async def test_a_signature_for_a_different_timestamp_does_not_verify(client): sk, pk = _device() await _register_device(client, token, pk) - signed = _sign(sk, "alice") + signed = _sign(sk, "alice_test") signed["timestamp"] = signed["timestamp"] + 1 # inside the window, wrong assert (await client.post("/v1/users/auth", json=signed)).status_code == 401 @@ -164,14 +164,14 @@ async def test_a_device_cannot_enrol_itself(client): # what matters is that nothing was created. assert resp.status_code in (401, 403, 422) signed_in = await client.post("/v1/users/auth", json=_sign( - Ed25519PrivateKey.generate(), "alice")) + Ed25519PrivateKey.generate(), "alice_test")) assert signed_in.status_code == 401 async def test_one_key_belongs_to_one_account(client): """Sharing it would make "who signed in" a question with two answers.""" - token_a = await _account(client, "alice") - token_b = await _account(client, "bob") + token_a = await _account(client, "alice_test") + token_b = await _account(client, "bob_test") _, pk = _device() await _register_device(client, token_a, pk) @@ -189,11 +189,11 @@ async def test_a_suspended_account_cannot_sign_in_with_a_device(client): from meshbay_hub.db.models import User from sqlalchemy import update async with get_session_factory()() as s: - await s.execute(update(User).where(User.username == "alice") + await s.execute(update(User).where(User.username == "alice_test") .values(status="suspended")) await s.commit() - resp = await client.post("/v1/users/auth", json=_sign(sk, "alice")) + resp = await client.post("/v1/users/auth", json=_sign(sk, "alice_test")) assert resp.status_code == 403 @@ -212,13 +212,13 @@ async def test_the_hub_publishes_no_device_keys(client): auth keys must stay invisible to everyone but the hub: no endpoint returns another account's, and `/pubkeys` must not grow one. """ - token = await _account(client, "alice") + token = await _account(client, "alice_test") _, pk = _device() await _register_device(client, token, pk) # `/pubkeys` is itself behind a session — it is an account lookup for # invitations, not a public directory — so ask it as a signed-in member. - public = await client.get("/v1/users/alice/pubkeys", + public = await client.get("/v1/users/alice_test/pubkeys", headers={"Authorization": f"Bearer {token}"}) assert public.status_code == 200 body = public.text @@ -227,8 +227,8 @@ async def test_the_hub_publishes_no_device_keys(client): async def test_you_cannot_read_another_accounts_devices(client): - token_a = await _account(client, "alice") - token_b = await _account(client, "bob") + token_a = await _account(client, "alice_test") + token_b = await _account(client, "bob_test") _, pk = _device() await _register_device(client, token_a, pk, "alice-laptop") @@ -250,12 +250,12 @@ async def test_removing_a_device_stops_it_signing_in(client): assert gone.status_code == 200 assert (await client.post("/v1/users/auth", - json=_sign(sk, "alice"))).status_code == 401 + json=_sign(sk, "alice_test"))).status_code == 401 async def test_you_cannot_remove_someone_elses_device(client): - token_a = await _account(client, "alice") - token_b = await _account(client, "bob") + token_a = await _account(client, "alice_test") + token_b = await _account(client, "bob_test") _, pk = _device() device_id = (await _register_device(client, token_a, pk)).json()["id"] -- cgit v1.2.3