zl-q
c9a2c75c35
- JWT 验证器新增 apikey 参数，支持云端 JWKS 认证头 - Auth 网关新增上游超时/错误映射为 503 状态码 - Auth 网关新增重定向 URL 校验，阻断开放重定向风险 - 用户依赖传递 anon_key 给 JWT 验证器 - 新增相关单元测试覆盖 JWKS 头、503 映射、重定向校验 - 新增实现计划文档
88 lines
3.5 KiB
Python
88 lines
3.5 KiB
Python
from __future__ import annotations
|
|
|
|
import pytest
|
|
from pydantic import ValidationError
|
|
from pytest import MonkeyPatch
|
|
|
|
from core.config.settings import Settings, SupabaseSettings
|
|
|
|
|
|
def test_social_prefixed_supabase_env_populates_settings(
|
|
monkeypatch: MonkeyPatch,
|
|
) -> None:
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__PUBLIC_URL", "https://public.example:8443")
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__ANON_KEY", "anon-key")
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__SERVICE_ROLE_KEY", "service-key")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__HOST", "db")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__PORT", "5432")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__NAME", "app")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__USER", "user")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__PASSWORD", "pass")
|
|
|
|
settings = Settings()
|
|
|
|
assert str(settings.supabase.public_url) == "https://public.example:8443/"
|
|
assert settings.supabase.anon_key == "anon-key"
|
|
assert settings.supabase.service_role_key == "service-key"
|
|
|
|
supabase_settings = settings.model_dump()["supabase"]
|
|
assert str(supabase_settings["public_url"]) == "https://public.example:8443/"
|
|
assert supabase_settings["anon_key"] == "anon-key"
|
|
assert supabase_settings["service_role_key"] == "service-key"
|
|
assert "jwt_secret" not in supabase_settings
|
|
assert "public_scheme" not in supabase_settings
|
|
assert "public_host" not in supabase_settings
|
|
assert "kong_http_port" not in supabase_settings
|
|
assert settings.database_url == "postgresql+asyncpg://user:pass@db:5432/app"
|
|
|
|
|
|
def test_cloud_supabase_env_populates_settings(monkeypatch: MonkeyPatch) -> None:
|
|
monkeypatch.setenv(
|
|
"SOCIAL_SUPABASE__PUBLIC_URL", "https://project.example.supabase.co"
|
|
)
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__ANON_KEY", "anon-key")
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__SERVICE_ROLE_KEY", "service-key")
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__JWT_AUDIENCE", "authenticated")
|
|
|
|
settings = Settings()
|
|
|
|
assert str(settings.supabase.public_url) == "https://project.example.supabase.co/"
|
|
assert settings.supabase.jwt_audience == "authenticated"
|
|
assert settings.supabase.jwt_issuer == "https://project.example.supabase.co/auth/v1"
|
|
assert (
|
|
settings.supabase.jwks_url
|
|
== "https://project.example.supabase.co/auth/v1/.well-known/jwks.json"
|
|
)
|
|
|
|
supabase_settings = settings.model_dump()["supabase"]
|
|
assert "jwt_secret" not in supabase_settings
|
|
|
|
|
|
def test_missing_public_url_raises_validation_error() -> None:
|
|
with pytest.raises(ValidationError) as exc_info:
|
|
SupabaseSettings()
|
|
|
|
assert "public_url" in str(exc_info.value)
|
|
|
|
|
|
def test_public_url_with_trailing_slash_normalizes_correctly(
|
|
monkeypatch: MonkeyPatch,
|
|
) -> None:
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__PUBLIC_URL", "https://example.supabase.co/")
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__ANON_KEY", "anon-key")
|
|
monkeypatch.setenv("SOCIAL_SUPABASE__SERVICE_ROLE_KEY", "service-key")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__HOST", "db")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__PORT", "5432")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__NAME", "app")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__USER", "user")
|
|
monkeypatch.setenv("SOCIAL_DATABASE__PASSWORD", "pass")
|
|
|
|
settings = Settings()
|
|
|
|
assert settings.supabase.jwt_issuer == "https://example.supabase.co/auth/v1"
|
|
assert (
|
|
settings.supabase.jwks_url
|
|
== "https://example.supabase.co/auth/v1/.well-known/jwks.json"
|
|
)
|
|
assert settings.supabase.url == "https://example.supabase.co/"
|