working base site setup with gatekeeping working

nonpacks/profiles/tests.py

@@ -1,3 +1,76 @@
+import secrets
+
+from django.contrib.auth import get_user_model
 from django.test import TestCase
 
-# Create your tests here.
+from .models import ApiToken, UserProfile
+
+
+class ApiTokenAuthTests(TestCase):
+    """Credential auth: 'Authorization: Bearer <username> <token>'."""
+
+    def setUp(self):
+        User = get_user_model()
+        self.alice = User.objects.create_user(username='Alice', password='pw')
+        UserProfile.objects.get_or_create(user=self.alice)
+        self.bob = User.objects.create_user(username='Bob', password='pw')
+        UserProfile.objects.get_or_create(user=self.bob)
+        self.token = secrets.token_urlsafe(48)
+        ApiToken.objects.create(
+            user=self.alice,
+            token=self.token,
+            key_prefix=self.token[:8],
+            label='test',
+        )
+
+    def _auth(self, credential=None, username=None, token=None):
+        if credential is None:
+            credential = f'{username or ""} {token or ""}'.strip()
+        return self.client.get(
+            '/home/',
+            HTTP_AUTHORIZATION=f'Bearer {credential}',
+            HTTP_ACCEPT='application/json',
+        )
+
+    def test_valid_credentials_pass(self):
+        resp = self._auth(username='Alice', token=self.token)
+        self.assertEqual(resp.status_code, 200)
+
+    def test_wrong_username_rejected(self):
+        # A valid token presented under another user's name must not work.
+        resp = self._auth(username='Bob', token=self.token)
+        self.assertEqual(resp.status_code, 401)
+
+    def test_wrong_token_rejected(self):
+        resp = self._auth(username='Alice', token='x' * 64)
+        self.assertEqual(resp.status_code, 401)
+
+    def test_revoked_token_rejected(self):
+        ApiToken.objects.all().delete()
+        resp = self._auth(username='Alice', token=self.token)
+        self.assertEqual(resp.status_code, 401)
+
+    def test_missing_username_rejected(self):
+        resp = self._auth(token=self.token)
+        self.assertEqual(resp.status_code, 401)
+
+    def test_missing_credentials_rejected(self):
+        resp = self._auth()
+        self.assertEqual(resp.status_code, 401)
+
+    def test_username_case_insensitive(self):
+        resp = self._auth(username='aLiCe', token=self.token)
+        self.assertEqual(resp.status_code, 200)
+
+    def test_unknown_user_rejected(self):
+        resp = self._auth(username='Nobody', token=self.token)
+        self.assertEqual(resp.status_code, 401)
+
+    def test_authenticates_as_owner(self):
+        self.client.get(
+            '/home/',
+            HTTP_AUTHORIZATION=f'Bearer Alice {self.token}',
+            HTTP_ACCEPT='application/json',
+        )
+        token = ApiToken.objects.get(token=self.token)
+        self.assertIsNotNone(token.last_used)