Graham McIntire
581955bd69
Some checks failed
Build and Push / Build and Push Docker Image (push) Has been cancelled
Create shared ContactsFixtures module with globally-unique qso_timestamp seconds to prevent unique-constraint violations when async test modules run in parallel and insert contacts with identical dedup-key columns. The qso_timestamp column is timestamp(0), so microsecond offsets were truncated — use System.unique_integer monotonic seconds instead. Also make count-asserting tests resilient to sandbox-leaked contacts from prior tests by using >= assertions or status-based checks rather than exact counts. Includes automated DateTime.add → DateTime.shift migration from mix format.
127 lines
3.8 KiB
Elixir
127 lines
3.8 KiB
Elixir
defmodule MicrowavepropWeb.Api.V1.AuthControllerTest do
|
|
use MicrowavepropWeb.ConnCase, async: true
|
|
|
|
alias Microwaveprop.AccountsFixtures
|
|
alias MicrowavepropWeb.Api.RateLimiter
|
|
|
|
@password AccountsFixtures.valid_user_password()
|
|
|
|
setup do
|
|
RateLimiter.reset()
|
|
user = AccountsFixtures.user_fixture()
|
|
%{user: user}
|
|
end
|
|
|
|
describe "POST /api/v1/auth/tokens" do
|
|
test "issues a bearer token for valid credentials", %{conn: conn, user: user} do
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => @password,
|
|
"name" => "Test laptop"
|
|
})
|
|
|
|
assert %{"token" => token, "data" => data} = json_response(conn, 201)
|
|
assert String.starts_with?(token, "mwp_")
|
|
assert data["name"] == "Test laptop"
|
|
assert is_nil(data["last_used_at"])
|
|
assert is_nil(data["revoked_at"])
|
|
end
|
|
|
|
test "rejects bad credentials with 401", %{conn: conn, user: user} do
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => "wrong",
|
|
"name" => "x"
|
|
})
|
|
|
|
assert %{"detail" => "Invalid email or password.", "status" => 401} = json_response(conn, 401)
|
|
end
|
|
|
|
test "rejects bad credentials when user does not exist", %{conn: conn} do
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => "ghost@nope.example",
|
|
"password" => "anything",
|
|
"name" => "x"
|
|
})
|
|
|
|
assert json_response(conn, 401)
|
|
end
|
|
|
|
for missing <- ["email", "password", "name"] do
|
|
test "rejects missing #{missing} with 400", %{conn: conn, user: user} do
|
|
body = Map.delete(%{"email" => user.email, "password" => @password, "name" => "x"}, unquote(missing))
|
|
|
|
conn = post(conn, ~p"/api/v1/auth/tokens", body)
|
|
assert %{"status" => 400} = json_response(conn, 400)
|
|
end
|
|
end
|
|
|
|
test "accepts an ISO 8601 expires_at", %{conn: conn, user: user} do
|
|
future = DateTime.utc_now() |> DateTime.shift(hour: 1) |> DateTime.to_iso8601()
|
|
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => @password,
|
|
"name" => "x",
|
|
"expires_at" => future
|
|
})
|
|
|
|
assert %{"data" => %{"expires_at" => exp}} = json_response(conn, 201)
|
|
assert byte_size(exp) > 0
|
|
end
|
|
|
|
test "rejects malformed expires_at via changeset 422", %{conn: conn, user: user} do
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => @password,
|
|
"name" => "x",
|
|
"expires_at" => "garbage"
|
|
})
|
|
|
|
assert %{"status" => 422} = json_response(conn, 422)
|
|
end
|
|
|
|
test "treats blank expires_at as no expiry", %{conn: conn, user: user} do
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => @password,
|
|
"name" => "x",
|
|
"expires_at" => ""
|
|
})
|
|
|
|
assert %{"data" => %{"expires_at" => nil}} = json_response(conn, 201)
|
|
end
|
|
|
|
test "rejects non-string expires_at via changeset 422", %{conn: conn, user: user} do
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => @password,
|
|
"name" => "x",
|
|
"expires_at" => 123
|
|
})
|
|
|
|
assert %{"status" => 422} = json_response(conn, 422)
|
|
end
|
|
|
|
test "rejects expires_at in the past via changeset 422", %{conn: conn, user: user} do
|
|
past = DateTime.utc_now() |> DateTime.shift(second: -1) |> DateTime.to_iso8601()
|
|
|
|
conn =
|
|
post(conn, ~p"/api/v1/auth/tokens", %{
|
|
"email" => user.email,
|
|
"password" => @password,
|
|
"name" => "x",
|
|
"expires_at" => past
|
|
})
|
|
|
|
assert %{"errors" => %{"expires_at" => _}} = json_response(conn, 422)
|
|
end
|
|
end
|
|
end
|