Update backend tests to use a cookie instead of the token header

Author: sinkozs

backend/app/tests/api/routes/test_items.py

@@ -8,12 +8,12 @@
 
 
 def test_create_item(
-    client: TestClient, superuser_token_headers: dict[str, str]
+    client: TestClient, superuser_auth_cookies: dict[str, str]
 ) -> None:
     data = {"title": "Foo", "description": "Fighters"}
     response = client.post(
         f"{settings.API_V1_STR}/items/",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
         json=data,
     )
     assert response.status_code == 200
@@ -25,12 +25,12 @@ def test_create_item(
 
 
 def test_read_item(
-    client: TestClient, superuser_token_headers: dict[str, str], db: Session
+    client: TestClient, superuser_auth_cookies: dict[str, str], db: Session
 ) -> None:
     item = create_random_item(db)
     response = client.get(
         f"{settings.API_V1_STR}/items/{item.id}",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
     )
     assert response.status_code == 200
     content = response.json()
@@ -41,52 +41,52 @@ def test_read_item(
 
 
 def test_read_item_not_found(
-    client: TestClient, superuser_token_headers: dict[str, str]
+    client: TestClient, superuser_auth_cookies: dict[str, str]
 ) -> None:
     response = client.get(
         f"{settings.API_V1_STR}/items/{uuid.uuid4()}",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
     )
     assert response.status_code == 404
     content = response.json()
     assert content["detail"] == "Item not found"
 
 
 def test_read_item_not_enough_permissions(
-    client: TestClient, normal_user_token_headers: dict[str, str], db: Session
+    client: TestClient, normal_user_auth_cookies: dict[str, str], db: Session
 ) -> None:
     item = create_random_item(db)
     response = client.get(
         f"{settings.API_V1_STR}/items/{item.id}",
-        headers=normal_user_token_headers,
+        cookies=normal_user_auth_cookies,
     )
     assert response.status_code == 400
     content = response.json()
     assert content["detail"] == "Not enough permissions"
 
 
 def test_read_items(
-    client: TestClient, superuser_token_headers: dict[str, str], db: Session
+    client: TestClient, superuser_auth_cookies: dict[str, str], db: Session
 ) -> None:
     create_random_item(db)
     create_random_item(db)
     response = client.get(
         f"{settings.API_V1_STR}/items/",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
     )
     assert response.status_code == 200
     content = response.json()
     assert len(content["data"]) >= 2
 
 
 def test_update_item(
-    client: TestClient, superuser_token_headers: dict[str, str], db: Session
+    client: TestClient, superuser_auth_cookies: dict[str, str], db: Session
 ) -> None:
     item = create_random_item(db)
     data = {"title": "Updated title", "description": "Updated description"}
     response = client.put(
         f"{settings.API_V1_STR}/items/{item.id}",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
         json=data,
     )
     assert response.status_code == 200
@@ -98,12 +98,12 @@ def test_update_item(
 
 
 def test_update_item_not_found(
-    client: TestClient, superuser_token_headers: dict[str, str]
+    client: TestClient, superuser_auth_cookies: dict[str, str]
 ) -> None:
     data = {"title": "Updated title", "description": "Updated description"}
     response = client.put(
         f"{settings.API_V1_STR}/items/{uuid.uuid4()}",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
         json=data,
     )
     assert response.status_code == 404
@@ -112,13 +112,13 @@ def test_update_item_not_found(
 
 
 def test_update_item_not_enough_permissions(
-    client: TestClient, normal_user_token_headers: dict[str, str], db: Session
+    client: TestClient, normal_user_auth_cookies: dict[str, str], db: Session
 ) -> None:
     item = create_random_item(db)
     data = {"title": "Updated title", "description": "Updated description"}
     response = client.put(
         f"{settings.API_V1_STR}/items/{item.id}",
-        headers=normal_user_token_headers,
+        cookies=normal_user_auth_cookies,
         json=data,
     )
     assert response.status_code == 400
@@ -127,37 +127,37 @@ def test_update_item_not_enough_permissions(
 
 
 def test_delete_item(
-    client: TestClient, superuser_token_headers: dict[str, str], db: Session
+    client: TestClient, superuser_auth_cookies: dict[str, str], db: Session
 ) -> None:
     item = create_random_item(db)
     response = client.delete(
         f"{settings.API_V1_STR}/items/{item.id}",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
     )
     assert response.status_code == 200
     content = response.json()
     assert content["message"] == "Item deleted successfully"
 
 
 def test_delete_item_not_found(
-    client: TestClient, superuser_token_headers: dict[str, str]
+    client: TestClient, superuser_auth_cookies: dict[str, str]
 ) -> None:
     response = client.delete(
         f"{settings.API_V1_STR}/items/{uuid.uuid4()}",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
     )
     assert response.status_code == 404
     content = response.json()
     assert content["detail"] == "Item not found"
 
 
 def test_delete_item_not_enough_permissions(
-    client: TestClient, normal_user_token_headers: dict[str, str], db: Session
+    client: TestClient, normal_user_auth_cookies: dict[str, str], db: Session
 ) -> None:
     item = create_random_item(db)
     response = client.delete(
         f"{settings.API_V1_STR}/items/{item.id}",
-        headers=normal_user_token_headers,
+        cookies=normal_user_auth_cookies,
     )
     assert response.status_code == 400
     content = response.json()

backend/app/tests/api/routes/test_login.py

@@ -12,19 +12,25 @@
 from app.utils import generate_password_reset_token
 
 
-def test_get_access_token(client: TestClient) -> None:
+def test_get_auth_cookie(client: TestClient) -> None:
     login_data = {
         "username": settings.FIRST_SUPERUSER,
         "password": settings.FIRST_SUPERUSER_PASSWORD,
     }
+
     r = client.post(f"{settings.API_V1_STR}/login/access-token", data=login_data)
-    tokens = r.json()
+
     assert r.status_code == 200
-    assert "access_token" in tokens
-    assert tokens["access_token"]
+    assert r.json()["message"] == "Login successful"
+
+    cookie_header = r.headers.get("Set-Cookie")
+    assert "http_only_auth_cookie=" in cookie_header
+
+    cookie_value = cookie_header.split("http_only_auth_cookie=")[1].split(";")[0]
+    assert cookie_value
 
 
-def test_get_access_token_incorrect_password(client: TestClient) -> None:
+def test_get_auth_cookie_incorrect_password(client: TestClient) -> None:
     login_data = {
         "username": settings.FIRST_SUPERUSER,
         "password": "incorrect",
@@ -33,20 +39,20 @@ def test_get_access_token_incorrect_password(client: TestClient) -> None:
     assert r.status_code == 400
 
 
-def test_use_access_token(
-    client: TestClient, superuser_token_headers: dict[str, str]
+def test_use_auth_cookie(
+    client: TestClient, superuser_auth_cookies: dict[str, str]
 ) -> None:
     r = client.post(
         f"{settings.API_V1_STR}/login/test-token",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
     )
     result = r.json()
     assert r.status_code == 200
     assert "email" in result
 
 
 def test_recovery_password(
-    client: TestClient, normal_user_token_headers: dict[str, str]
+    client: TestClient, normal_user_auth_cookies: dict[str, str]
 ) -> None:
     with (
         patch("app.core.config.settings.SMTP_HOST", "smtp.example.com"),
@@ -55,23 +61,24 @@ def test_recovery_password(
         email = "[email protected]"
         r = client.post(
             f"{settings.API_V1_STR}/password-recovery/{email}",
-            headers=normal_user_token_headers,
+            cookies=normal_user_auth_cookies,
         )
         assert r.status_code == 200
         assert r.json() == {"message": "Password recovery email sent"}
 
 
 def test_recovery_password_user_not_exits(
-    client: TestClient, normal_user_token_headers: dict[str, str]
+    client: TestClient, normal_user_auth_cookies: dict[str, str]
 ) -> None:
     email = "[email protected]"
     r = client.post(
         f"{settings.API_V1_STR}/password-recovery/{email}",
-        headers=normal_user_token_headers,
+        cookies=normal_user_auth_cookies,
     )
     assert r.status_code == 404
 
 
+# TODO
 def test_reset_password(client: TestClient, db: Session) -> None:
     email = random_email()
     password = random_lower_string()
@@ -91,7 +98,7 @@ def test_reset_password(client: TestClient, db: Session) -> None:
 
     r = client.post(
         f"{settings.API_V1_STR}/reset-password/",
-        headers=headers,
+        cookies=headers,
         json=data,
     )
 
@@ -103,12 +110,12 @@ def test_reset_password(client: TestClient, db: Session) -> None:
 
 
 def test_reset_password_invalid_token(
-    client: TestClient, superuser_token_headers: dict[str, str]
+    client: TestClient, superuser_auth_cookies: dict[str, str]
 ) -> None:
     data = {"new_password": "changethis", "token": "invalid"}
     r = client.post(
         f"{settings.API_V1_STR}/reset-password/",
-        headers=superuser_token_headers,
+        cookies=superuser_auth_cookies,
         json=data,
     )
     response = r.json()