feat: #13 impl the JWT validation + some fixes

tests/bash/curling.bash

@@ -6,7 +6,11 @@
 #
 #######################################
 
-URL="http://localhost:9001"
+if [ -z ${SIMPLE_AUTH_URL} ]
+then
+	echo "[WARN]: SIMPLE_AUTH_URL is empty, set to http://localhost:9001"
+	URL="http://localhost:9001"
+fi
 
 for i in {0..10}
 do

tests/python/requirements.txt

@@ -1,8 +1,10 @@
 attrs==22.1.0
 black==22.8.0
 certifi==2022.9.14
+cffi==1.15.1
 charset-normalizer==2.1.1
 click==8.1.3
+cryptography==38.0.1
 idna==3.4
 iniconfig==1.1.1
 mypy-extensions==0.4.3
@@ -11,7 +13,10 @@ pathspec==0.10.1
 platformdirs==2.5.2
 pluggy==1.0.0
 py==1.11.0
+pycparser==2.21
+PyJWT==2.5.0
 pyparsing==3.0.9
 requests==2.28.1
 tomli==2.0.1
+types-cryptography==3.3.23
 urllib3==1.26.12

tests/python/test_requests.py

@@ -1,14 +1,19 @@
 import jwt
+import os
 import requests
 
 from datetime import datetime
-
 from unittest import TestCase
 
-URL = "http://127.0.0.1:9001"
+URL = os.getenv("SIMPLE_AUTH_URL", "http://127.0.0.1:9001")
+PUB_KEY_PATH = os.getenv("SIMPLE_AUTH_PUB_KEY", "")
 
 
 class TestResponse(TestCase):
+    def setUp(self):
+        with open(PUB_KEY_PATH, "r") as f:
+            self.pub_key = f.read()
+
     def test_get_target(self):
         resp = requests.post(
             URL + "/get/", json={"username": "toto", "password": "tata"}
@@ -17,25 +22,52 @@ class TestResponse(TestCase):
         self.assertIsNotNone(resp.json(), "response data can't be empty")
 
         token = resp.json()["token"]
-        jwt_decoded = jwt.decode(token, options={"verify_signature": False})
+        jwt_decoded = jwt.decode(
+            token,
+            self.pub_key,
+            algorithms=["RS384"],
+            options={
+                "verify_signature": True,
+                "verify_claims": True,
+                "verify_iss": True,
+            },
+        )
         self.assertEqual("thegux.fr", jwt_decoded["iss"])
 
         jwt_exp = datetime.fromtimestamp(jwt_decoded["exp"])
         jwt_iat = datetime.fromtimestamp(jwt_decoded["iat"])
         date_exp = datetime.strptime(str(jwt_exp - jwt_iat), "%H:%M:%S")
         self.assertEqual(2, date_exp.hour)
+        return token
 
-    def test_validate_target(self):
+    def test_validate_target_no_token(self):
         resp = requests.post(
             URL + "/validate/", json={"username": "toto", "password": "tata"}
         )
         self.assertEqual(resp.status_code, 200, "bad status code returned")
         self.assertIsNotNone(resp.json(), "response data can't be empty")
+        self.assertEqual(resp.json()["valid"], "false", "bad status returned")
+        self.assertEqual(resp.json()["reason"], "no token provided in the request body")
+
+    def test_validate_target_empty_token(self):
+        resp = requests.post(URL + "/validate/", json={"tutu": "tutu", "token": ""})
+        self.assertEqual(resp.status_code, 200, "bad status code returned")
+        self.assertIsNotNone(resp.json(), "response data can't be empty")
+        self.assertEqual(resp.json()["valid"], "false", "bad status returned")
         self.assertEqual(
-            resp.json()["token"], "header.payload.signature", "bad status returned"
+            resp.json()["reason"],
+            "token validation failed err=JWT compact encoding error",
         )
 
-    # TODO: must be updated after implmenting `/refresh/` url handler
+    def test_validate_target(self):
+        token = self.test_get_target()
+
+        resp = requests.post(URL + "/validate/", json={"token": token})
+        self.assertEqual(resp.status_code, 200, "bad status code returned")
+        self.assertIsNotNone(resp.json(), "response data can't be empty")
+        self.assertEqual(resp.json()["valid"], "true", "bad status returned")
+
+    # TODO: must be updated after implementing `/refresh/` url handler
     def test_refresh_target(self):
         resp = requests.post(
             URL + "/refresh/", json={"username": "toto", "password": "tata"}