forked from cartsnitch/cartsnitch
Coupon Carl
62 lines
2.1 KiB
Python
62 lines
2.1 KiB
Python
"""Tests for session encryption/decryption."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
import pytest
|
|
from cryptography.fernet import Fernet, InvalidToken
|
|
|
|
from receiptwitness.session.encryption import decrypt_session_data, encrypt_session_data
|
|
|
|
TEST_KEY = Fernet.generate_key().decode()
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _mock_encryption_key():
|
|
with patch("receiptwitness.session.encryption.settings") as mock_settings:
|
|
mock_settings.session_encryption_key = TEST_KEY
|
|
yield
|
|
|
|
|
|
class TestEncryptDecrypt:
|
|
def test_roundtrip(self):
|
|
data = {
|
|
"cookies": [{"name": "session", "value": "abc123", "domain": ".meijer.com"}],
|
|
"user_agent": "Mozilla/5.0",
|
|
}
|
|
encrypted = encrypt_session_data(data)
|
|
assert isinstance(encrypted, str)
|
|
assert encrypted != str(data)
|
|
|
|
decrypted = decrypt_session_data(encrypted)
|
|
assert decrypted == data
|
|
|
|
def test_different_data_different_ciphertext(self):
|
|
data1 = {"key": "value1"}
|
|
data2 = {"key": "value2"}
|
|
enc1 = encrypt_session_data(data1)
|
|
enc2 = encrypt_session_data(data2)
|
|
assert enc1 != enc2
|
|
|
|
def test_decrypt_with_wrong_key_fails(self):
|
|
data = {"cookies": []}
|
|
encrypted = encrypt_session_data(data)
|
|
|
|
wrong_key = Fernet.generate_key().decode()
|
|
with patch("receiptwitness.session.encryption.settings") as mock_settings:
|
|
mock_settings.session_encryption_key = wrong_key
|
|
with pytest.raises(InvalidToken):
|
|
decrypt_session_data(encrypted)
|
|
|
|
def test_decrypt_tampered_data_fails(self):
|
|
data = {"cookies": []}
|
|
encrypted = encrypt_session_data(data)
|
|
tampered = encrypted[:-5] + "XXXXX"
|
|
with pytest.raises(Exception):
|
|
decrypt_session_data(tampered)
|
|
|
|
def test_no_key_raises_error(self):
|
|
with patch("receiptwitness.session.encryption.settings") as mock_settings:
|
|
mock_settings.session_encryption_key = ""
|
|
with pytest.raises(ValueError, match="RW_SESSION_ENCRYPTION_KEY"):
|
|
encrypt_session_data({"test": True})
|