AdamThomasandClaude Sonnet 5
b268e308ab
- app/email/ : sender (smtplib, STARTTLS ou SSL, connexion réutilisée pour un
lot) + templates (rendu, textes dans locales/fr.json). EMAIL_ENABLED=false
(défaut) ⇒ journalisé seulement, sans destinataire ni corps (RGPD).
- Lien magique : POST .../auth/magic-link envoie désormais l'email
(PUBLIC_BASE_URL + magic_link_path + ?token=). Helper app/auth/magic_link.py
partagé. Sans SMTP, le jeton non nominatif reste journalisé pour le dev.
- Récapitulatif de planning : POST /editions/{id}/notifications/planning
(COORDINATION). subject/body sont des modèles ({prenom}, {nom}, {nb_creneaux},
{nb_heures}, {creneaux}, {lien_connexion} → lien magique personnel émis).
Cible tous les bénévoles avec email ou une liste. Envoi en BackgroundTasks.
- Config : PUBLIC_BASE_URL, EMAIL_ENABLED, SMTP_* ; .env.example,
docker-compose (dev + prod), deploy/README.
- 9 tests (sender activé/désactivé, rendu, notifications : contenu, gabarit par
défaut, lien magique embarqué, sous-ensemble, réservé COORDINATION).
137 tests au total ; ruff + alembic check verts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM
101 lines
3.1 KiB
Python
101 lines
3.1 KiB
Python
import datetime as dt
|
|
import logging
|
|
|
|
from sqlmodel import select
|
|
|
|
from app.auth.tokens import hash_token
|
|
from app.models import MagicLinkToken, Role, local_now
|
|
|
|
|
|
def _url(edition, suffix):
|
|
return f"/editions/{edition.id}/auth/{suffix}"
|
|
|
|
|
|
def test_magic_link_unknown_email_is_accepted_without_token(
|
|
raw_client, session, edition
|
|
):
|
|
resp = raw_client.post(
|
|
_url(edition, "magic-link"), json={"email": "personne@example.fr"}
|
|
)
|
|
assert resp.status_code == 202
|
|
assert session.exec(select(MagicLinkToken)).all() == []
|
|
|
|
|
|
def test_full_flow_magic_link_then_jwt_then_me(
|
|
raw_client, session, edition, make_account, caplog
|
|
):
|
|
make_account(Role.LEAD, email="ref@example.fr")
|
|
|
|
with caplog.at_level(logging.INFO, logger="app.auth"):
|
|
resp = raw_client.post(
|
|
_url(edition, "magic-link"), json={"email": "REF@example.fr"}
|
|
)
|
|
assert resp.status_code == 202
|
|
log_line = next(m for m in caplog.messages if "Lien magique" in m)
|
|
raw_token = log_line.split("jeton=")[-1].strip()
|
|
|
|
verified = raw_client.post(
|
|
_url(edition, "verify"), json={"token": raw_token}
|
|
)
|
|
assert verified.status_code == 200
|
|
body = verified.json()
|
|
assert body["token_type"] == "bearer"
|
|
assert body["account"]["role"] == "LEAD"
|
|
assert body["account"]["auth_method"] == "magic_link"
|
|
|
|
me = raw_client.get(
|
|
"/auth/me",
|
|
headers={"Authorization": f"Bearer {body['access_token']}"},
|
|
)
|
|
assert me.status_code == 200
|
|
assert me.json()["email"] == "ref@example.fr"
|
|
|
|
|
|
def test_verify_is_single_use(raw_client, session, edition, make_account):
|
|
account = make_account(Role.VOLUNTEER, email="v@example.fr")
|
|
session.add(
|
|
MagicLinkToken(
|
|
account_id=account.id,
|
|
token_hash=hash_token("jeton-connu"),
|
|
expires_at=local_now() + dt.timedelta(minutes=10),
|
|
)
|
|
)
|
|
session.commit()
|
|
|
|
first = raw_client.post(_url(edition, "verify"), json={"token": "jeton-connu"})
|
|
assert first.status_code == 200
|
|
second = raw_client.post(
|
|
_url(edition, "verify"), json={"token": "jeton-connu"}
|
|
)
|
|
assert second.status_code == 401
|
|
assert second.json()["detail"]["code"] == "auth.invalid_token"
|
|
|
|
|
|
def test_verify_rejects_expired_token(raw_client, session, edition, make_account):
|
|
account = make_account(Role.VOLUNTEER, email="v@example.fr")
|
|
session.add(
|
|
MagicLinkToken(
|
|
account_id=account.id,
|
|
token_hash=hash_token("perime"),
|
|
expires_at=local_now() - dt.timedelta(minutes=1),
|
|
)
|
|
)
|
|
session.commit()
|
|
resp = raw_client.post(_url(edition, "verify"), json={"token": "perime"})
|
|
assert resp.status_code == 401
|
|
|
|
|
|
def test_verify_rejects_unknown_token(raw_client, edition):
|
|
resp = raw_client.post(_url(edition, "verify"), json={"token": "n'importe"})
|
|
assert resp.status_code == 401
|
|
|
|
|
|
def test_me_requires_a_valid_bearer(raw_client):
|
|
assert raw_client.get("/auth/me").status_code == 401
|
|
assert (
|
|
raw_client.get(
|
|
"/auth/me", headers={"Authorization": "Bearer pas-un-jwt"}
|
|
).status_code
|
|
== 401
|
|
)
|