forked from cardosofelipe/fast-next-template
e19026453f
- Introduced session management endpoints to list, revoke, and cleanup sessions per user. - Added cron-based job for periodic cleanup of expired sessions. - Implemented `CRUDSession` for session-specific database operations. - Integrated session cleanup startup and shutdown events in the application lifecycle. - Enhanced CORS configuration to include `X-Device-Id` for session tracking. - Added comprehensive integration tests for multi-device login, per-device logout, session listing, and cleanup logic.
422 lines
14 KiB
Python
422 lines
14 KiB
Python
"""
|
|
Integration tests for session management.
|
|
|
|
Tests the critical per-device logout functionality.
|
|
"""
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.main import app
|
|
from app.core.database import get_db
|
|
from app.models.user import User
|
|
from app.core.auth import get_password_hash
|
|
from app.utils.test_utils import setup_test_db, teardown_test_db
|
|
import uuid
|
|
|
|
|
|
@pytest.fixture(scope="function")
|
|
def test_db_session():
|
|
"""Create test database session."""
|
|
test_engine, TestingSessionLocal = setup_test_db()
|
|
with TestingSessionLocal() as session:
|
|
yield session
|
|
teardown_test_db(test_engine)
|
|
|
|
|
|
@pytest.fixture(scope="function")
|
|
def client(test_db_session):
|
|
"""Create test client with test database."""
|
|
def override_get_db():
|
|
try:
|
|
yield test_db_session
|
|
finally:
|
|
pass
|
|
|
|
app.dependency_overrides[get_db] = override_get_db
|
|
with TestClient(app) as test_client:
|
|
yield test_client
|
|
app.dependency_overrides.clear()
|
|
|
|
|
|
@pytest.fixture
|
|
def test_user(test_db_session):
|
|
"""Create a test user."""
|
|
user = User(
|
|
id=uuid.uuid4(),
|
|
email="sessiontest@example.com",
|
|
password_hash=get_password_hash("TestPassword123"),
|
|
first_name="Session",
|
|
last_name="Test",
|
|
phone_number="+1234567890",
|
|
is_active=True,
|
|
is_superuser=False,
|
|
preferences=None,
|
|
)
|
|
test_db_session.add(user)
|
|
test_db_session.commit()
|
|
test_db_session.refresh(user)
|
|
return user
|
|
|
|
|
|
class TestMultiDeviceLogin:
|
|
"""Test multi-device login scenarios."""
|
|
|
|
def test_login_from_multiple_devices(self, client, test_user):
|
|
"""Test that user can login from multiple devices simultaneously."""
|
|
# Login from PC
|
|
pc_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "pc-device-001"}
|
|
)
|
|
assert pc_response.status_code == 200
|
|
pc_tokens = pc_response.json()
|
|
assert "access_token" in pc_tokens
|
|
assert "refresh_token" in pc_tokens
|
|
pc_refresh = pc_tokens["refresh_token"]
|
|
|
|
# Login from Phone
|
|
phone_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "phone-device-001"}
|
|
)
|
|
assert phone_response.status_code == 200
|
|
phone_tokens = phone_response.json()
|
|
assert "access_token" in phone_tokens
|
|
assert "refresh_token" in phone_tokens
|
|
phone_refresh = phone_tokens["refresh_token"]
|
|
|
|
# Verify both tokens are different
|
|
assert pc_refresh != phone_refresh
|
|
|
|
# Both should be able to access protected endpoints
|
|
pc_me = client.get(
|
|
"/api/v1/auth/me",
|
|
headers={"Authorization": f"Bearer {pc_tokens['access_token']}"}
|
|
)
|
|
assert pc_me.status_code == 200
|
|
|
|
phone_me = client.get(
|
|
"/api/v1/auth/me",
|
|
headers={"Authorization": f"Bearer {phone_tokens['access_token']}"}
|
|
)
|
|
assert phone_me.status_code == 200
|
|
|
|
def test_logout_from_one_device_does_not_affect_other(self, client, test_user):
|
|
"""
|
|
CRITICAL TEST: Logout from PC should NOT logout from Phone.
|
|
|
|
This is the main requirement for session management.
|
|
"""
|
|
# Login from PC
|
|
pc_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "pc-device-001"}
|
|
)
|
|
assert pc_response.status_code == 200
|
|
pc_tokens = pc_response.json()
|
|
pc_access = pc_tokens["access_token"]
|
|
pc_refresh = pc_tokens["refresh_token"]
|
|
|
|
# Login from Phone
|
|
phone_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "phone-device-001"}
|
|
)
|
|
assert phone_response.status_code == 200
|
|
phone_tokens = phone_response.json()
|
|
phone_access = phone_tokens["access_token"]
|
|
phone_refresh = phone_tokens["refresh_token"]
|
|
|
|
# Logout from PC
|
|
logout_response = client.post(
|
|
"/api/v1/auth/logout",
|
|
json={"refresh_token": pc_refresh},
|
|
headers={"Authorization": f"Bearer {pc_access}"}
|
|
)
|
|
assert logout_response.status_code == 200
|
|
assert logout_response.json()["success"] == True
|
|
|
|
# PC refresh should fail (logged out)
|
|
pc_refresh_response = client.post(
|
|
"/api/v1/auth/refresh",
|
|
json={"refresh_token": pc_refresh}
|
|
)
|
|
assert pc_refresh_response.status_code == 401
|
|
response_data = pc_refresh_response.json()
|
|
assert "revoked" in response_data["errors"][0]["message"].lower()
|
|
|
|
# Phone refresh should still work ✅ THIS IS THE CRITICAL ASSERTION
|
|
phone_refresh_response = client.post(
|
|
"/api/v1/auth/refresh",
|
|
json={"refresh_token": phone_refresh}
|
|
)
|
|
assert phone_refresh_response.status_code == 200
|
|
new_phone_tokens = phone_refresh_response.json()
|
|
assert "access_token" in new_phone_tokens
|
|
|
|
# Phone can still access protected endpoints
|
|
phone_me = client.get(
|
|
"/api/v1/auth/me",
|
|
headers={"Authorization": f"Bearer {new_phone_tokens['access_token']}"}
|
|
)
|
|
assert phone_me.status_code == 200
|
|
assert phone_me.json()["email"] == "sessiontest@example.com"
|
|
|
|
def test_logout_all_devices(self, client, test_user):
|
|
"""Test logging out from all devices simultaneously."""
|
|
# Login from 3 devices
|
|
devices = []
|
|
for i, device_name in enumerate(["pc", "phone", "tablet"]):
|
|
response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": f"{device_name}-device-00{i}"}
|
|
)
|
|
assert response.status_code == 200
|
|
tokens = response.json()
|
|
devices.append({
|
|
"name": device_name,
|
|
"access": tokens["access_token"],
|
|
"refresh": tokens["refresh_token"]
|
|
})
|
|
|
|
# Logout from all devices using first device's access token
|
|
logout_all_response = client.post(
|
|
"/api/v1/auth/logout-all",
|
|
headers={"Authorization": f"Bearer {devices[0]['access']}"}
|
|
)
|
|
assert logout_all_response.status_code == 200
|
|
assert "3" in logout_all_response.json()["message"] # 3 sessions terminated
|
|
|
|
# All refresh tokens should now fail
|
|
for device in devices:
|
|
refresh_response = client.post(
|
|
"/api/v1/auth/refresh",
|
|
json={"refresh_token": device["refresh"]}
|
|
)
|
|
assert refresh_response.status_code == 401
|
|
|
|
def test_list_active_sessions(self, client, test_user):
|
|
"""Test listing active sessions."""
|
|
# Login from 2 devices
|
|
pc_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "pc-device-001"}
|
|
)
|
|
pc_tokens = pc_response.json()
|
|
|
|
phone_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "phone-device-001"}
|
|
)
|
|
|
|
# List sessions
|
|
sessions_response = client.get(
|
|
"/api/v1/sessions/me",
|
|
headers={"Authorization": f"Bearer {pc_tokens['access_token']}"}
|
|
)
|
|
assert sessions_response.status_code == 200
|
|
sessions_data = sessions_response.json()
|
|
assert sessions_data["total"] == 2
|
|
assert len(sessions_data["sessions"]) == 2
|
|
|
|
# Check session details
|
|
session = sessions_data["sessions"][0]
|
|
assert "device_name" in session
|
|
assert "ip_address" in session
|
|
assert "last_used_at" in session
|
|
assert "created_at" in session
|
|
|
|
def test_revoke_specific_session(self, client, test_user):
|
|
"""Test revoking a specific session by ID."""
|
|
# Login from 2 devices
|
|
pc_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "pc-device-001"}
|
|
)
|
|
pc_tokens = pc_response.json()
|
|
|
|
phone_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
},
|
|
headers={"X-Device-Id": "phone-device-001"}
|
|
)
|
|
phone_tokens = phone_response.json()
|
|
|
|
# List sessions to get IDs
|
|
sessions_response = client.get(
|
|
"/api/v1/sessions/me",
|
|
headers={"Authorization": f"Bearer {pc_tokens['access_token']}"}
|
|
)
|
|
sessions = sessions_response.json()["sessions"]
|
|
|
|
# Find the phone session by device_id
|
|
phone_session = next((s for s in sessions if s["device_id"] == "phone-device-001"), None)
|
|
assert phone_session is not None, "Phone session not found in session list"
|
|
session_id_to_revoke = phone_session["id"]
|
|
revoke_response = client.delete(
|
|
f"/api/v1/sessions/{session_id_to_revoke}",
|
|
headers={"Authorization": f"Bearer {pc_tokens['access_token']}"}
|
|
)
|
|
assert revoke_response.status_code == 200
|
|
|
|
# Phone refresh should fail
|
|
phone_refresh_response = client.post(
|
|
"/api/v1/auth/refresh",
|
|
json={"refresh_token": phone_tokens["refresh_token"]}
|
|
)
|
|
assert phone_refresh_response.status_code == 401
|
|
|
|
# PC refresh should still work
|
|
pc_refresh_response = client.post(
|
|
"/api/v1/auth/refresh",
|
|
json={"refresh_token": pc_tokens["refresh_token"]}
|
|
)
|
|
assert pc_refresh_response.status_code == 200
|
|
|
|
|
|
class TestSessionEdgeCases:
|
|
"""Test edge cases and error scenarios."""
|
|
|
|
def test_logout_with_invalid_refresh_token(self, client, test_user):
|
|
"""Test logout with invalid refresh token."""
|
|
# Login first
|
|
login_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
}
|
|
)
|
|
tokens = login_response.json()
|
|
|
|
# Try to logout with invalid refresh token
|
|
logout_response = client.post(
|
|
"/api/v1/auth/logout",
|
|
json={"refresh_token": "invalid_token"},
|
|
headers={"Authorization": f"Bearer {tokens['access_token']}"}
|
|
)
|
|
# Should still return success (idempotent)
|
|
assert logout_response.status_code == 200
|
|
|
|
def test_refresh_with_deactivated_session(self, client, test_user):
|
|
"""Test refresh after session has been deactivated."""
|
|
# Login
|
|
login_response = client.post(
|
|
"/api/v1/auth/login",
|
|
json={
|
|
"email": "sessiontest@example.com",
|
|
"password": "TestPassword123"
|
|
}
|
|
)
|
|
tokens = login_response.json()
|
|
|
|
# Logout
|
|
client.post(
|
|
"/api/v1/auth/logout",
|
|
json={"refresh_token": tokens["refresh_token"]},
|
|
headers={"Authorization": f"Bearer {tokens['access_token']}"}
|
|
)
|
|
|
|
# Try to refresh with deactivated session
|
|
refresh_response = client.post(
|
|
"/api/v1/auth/refresh",
|
|
json={"refresh_token": tokens["refresh_token"]}
|
|
)
|
|
assert refresh_response.status_code == 401
|
|
response_data = refresh_response.json()
|
|
assert "revoked" in response_data["errors"][0]["message"].lower()
|
|
|
|
def test_cannot_revoke_other_users_session(self, client, test_db_session):
|
|
"""Test that users cannot revoke other users' sessions."""
|
|
# Create two users
|
|
user1 = User(
|
|
id=uuid.uuid4(),
|
|
email="user1@example.com",
|
|
password_hash=get_password_hash("TestPassword123"),
|
|
first_name="User",
|
|
last_name="One",
|
|
is_active=True,
|
|
is_superuser=False,
|
|
)
|
|
user2 = User(
|
|
id=uuid.uuid4(),
|
|
email="user2@example.com",
|
|
password_hash=get_password_hash("TestPassword123"),
|
|
first_name="User",
|
|
last_name="Two",
|
|
is_active=True,
|
|
is_superuser=False,
|
|
)
|
|
test_db_session.add_all([user1, user2])
|
|
test_db_session.commit()
|
|
|
|
# User1 login
|
|
user1_login = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"email": "user1@example.com", "password": "TestPassword123"}
|
|
)
|
|
user1_tokens = user1_login.json()
|
|
|
|
# User2 login
|
|
user2_login = client.post(
|
|
"/api/v1/auth/login",
|
|
json={"email": "user2@example.com", "password": "TestPassword123"}
|
|
)
|
|
|
|
# User1 gets their sessions
|
|
user1_sessions = client.get(
|
|
"/api/v1/sessions/me",
|
|
headers={"Authorization": f"Bearer {user1_tokens['access_token']}"}
|
|
)
|
|
user1_session_id = user1_sessions.json()["sessions"][0]["id"]
|
|
|
|
# User2 lists their sessions
|
|
user2_sessions = client.get(
|
|
"/api/v1/sessions/me",
|
|
headers={"Authorization": f"Bearer {user2_login.json()['access_token']}"}
|
|
)
|
|
user2_session_id = user2_sessions.json()["sessions"][0]["id"]
|
|
|
|
# User1 tries to revoke User2's session (should fail)
|
|
revoke_response = client.delete(
|
|
f"/api/v1/sessions/{user2_session_id}",
|
|
headers={"Authorization": f"Bearer {user1_tokens['access_token']}"}
|
|
)
|
|
assert revoke_response.status_code == 403
|