Initial commit
This commit is contained in:
Dom
397
tests/test_access_control.py
Normal file
397
tests/test_access_control.py
Normal file
@@ -0,0 +1,397 @@
|
||||
"""
|
||||
Tests unitaires pour le système de contrôle d'accès.
|
||||
|
||||
Ces tests vérifient l'authentification, l'autorisation RBAC,
|
||||
et la gestion des sessions.
|
||||
"""
|
||||
|
||||
import time
|
||||
from datetime import datetime, timedelta
|
||||
|
||||
import pytest
|
||||
|
||||
from pipeline_mco_pmsi.security import AccessControl, Role, Permission
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def access_control():
|
||||
"""Crée une instance d'AccessControl pour les tests."""
|
||||
return AccessControl(session_duration_hours=1)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def sample_users(access_control):
|
||||
"""Crée des utilisateurs de test."""
|
||||
tim = access_control.create_user(
|
||||
username="tim_user",
|
||||
password="password123",
|
||||
role=Role.TIM,
|
||||
email="tim@example.com",
|
||||
full_name="TIM User"
|
||||
)
|
||||
|
||||
responsable = access_control.create_user(
|
||||
username="responsable_user",
|
||||
password="password456",
|
||||
role=Role.RESPONSABLE_DIM,
|
||||
email="responsable@example.com",
|
||||
full_name="Responsable DIM"
|
||||
)
|
||||
|
||||
admin = access_control.create_user(
|
||||
username="admin_user",
|
||||
password="password789",
|
||||
role=Role.ADMINISTRATEUR,
|
||||
email="admin@example.com",
|
||||
full_name="Admin User"
|
||||
)
|
||||
|
||||
return {"tim": tim, "responsable": responsable, "admin": admin}
|
||||
|
||||
|
||||
class TestAccessControlInit:
|
||||
"""Tests d'initialisation du système de contrôle d'accès."""
|
||||
|
||||
def test_init_with_defaults(self):
|
||||
"""Test l'initialisation avec valeurs par défaut."""
|
||||
ac = AccessControl()
|
||||
|
||||
assert ac.session_duration_hours == 8
|
||||
|
||||
def test_init_with_custom_duration(self):
|
||||
"""Test l'initialisation avec durée personnalisée."""
|
||||
ac = AccessControl(session_duration_hours=12)
|
||||
|
||||
assert ac.session_duration_hours == 12
|
||||
|
||||
|
||||
class TestCreateUser:
|
||||
"""Tests de création d'utilisateurs."""
|
||||
|
||||
def test_create_user_success(self, access_control):
|
||||
"""Test la création réussie d'un utilisateur."""
|
||||
user = access_control.create_user(
|
||||
username="test_user",
|
||||
password="test_password",
|
||||
role=Role.TIM,
|
||||
email="test@example.com",
|
||||
full_name="Test User"
|
||||
)
|
||||
|
||||
assert user.username == "test_user"
|
||||
assert user.role == Role.TIM
|
||||
assert user.email == "test@example.com"
|
||||
assert user.full_name == "Test User"
|
||||
assert user.is_active is True
|
||||
assert user.password_hash != "test_password" # Le mot de passe doit être hashé
|
||||
assert ":" in user.password_hash # Format salt:hash
|
||||
|
||||
def test_create_user_duplicate_username(self, access_control):
|
||||
"""Test que la création échoue si l'utilisateur existe déjà."""
|
||||
access_control.create_user(
|
||||
username="duplicate_user",
|
||||
password="password",
|
||||
role=Role.TIM
|
||||
)
|
||||
|
||||
with pytest.raises(ValueError, match="existe déjà"):
|
||||
access_control.create_user(
|
||||
username="duplicate_user",
|
||||
password="password2",
|
||||
role=Role.RESPONSABLE_DIM
|
||||
)
|
||||
|
||||
def test_create_user_different_roles(self, access_control):
|
||||
"""Test la création d'utilisateurs avec différents rôles."""
|
||||
tim = access_control.create_user("tim", "pass", Role.TIM)
|
||||
responsable = access_control.create_user("resp", "pass", Role.RESPONSABLE_DIM)
|
||||
admin = access_control.create_user("admin", "pass", Role.ADMINISTRATEUR)
|
||||
|
||||
assert tim.role == Role.TIM
|
||||
assert responsable.role == Role.RESPONSABLE_DIM
|
||||
assert admin.role == Role.ADMINISTRATEUR
|
||||
|
||||
|
||||
class TestAuthenticate:
|
||||
"""Tests d'authentification."""
|
||||
|
||||
def test_authenticate_success(self, access_control, sample_users):
|
||||
"""Test l'authentification réussie."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
assert session is not None
|
||||
assert session.user_id == sample_users["tim"].user_id
|
||||
assert session.session_id is not None
|
||||
assert len(session.session_id) > 0
|
||||
assert session.expires_at > datetime.now()
|
||||
|
||||
def test_authenticate_wrong_password(self, access_control, sample_users):
|
||||
"""Test l'authentification avec mauvais mot de passe."""
|
||||
session = access_control.authenticate("tim_user", "wrong_password")
|
||||
|
||||
assert session is None
|
||||
|
||||
def test_authenticate_unknown_user(self, access_control):
|
||||
"""Test l'authentification avec utilisateur inconnu."""
|
||||
session = access_control.authenticate("unknown_user", "password")
|
||||
|
||||
assert session is None
|
||||
|
||||
def test_authenticate_inactive_user(self, access_control, sample_users):
|
||||
"""Test l'authentification avec compte inactif."""
|
||||
# Désactiver l'utilisateur
|
||||
access_control.deactivate_user(sample_users["tim"].user_id)
|
||||
|
||||
# Tenter de se connecter
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
assert session is None
|
||||
|
||||
def test_authenticate_with_ip_address(self, access_control, sample_users):
|
||||
"""Test l'authentification avec adresse IP."""
|
||||
session = access_control.authenticate(
|
||||
"tim_user",
|
||||
"password123",
|
||||
ip_address="192.168.1.1"
|
||||
)
|
||||
|
||||
assert session is not None
|
||||
assert session.ip_address == "192.168.1.1"
|
||||
|
||||
|
||||
class TestGetUserFromSession:
|
||||
"""Tests de récupération d'utilisateur depuis une session."""
|
||||
|
||||
def test_get_user_from_valid_session(self, access_control, sample_users):
|
||||
"""Test la récupération avec session valide."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
user = access_control.get_user_from_session(session.session_id)
|
||||
|
||||
assert user is not None
|
||||
assert user.username == "tim_user"
|
||||
assert user.role == Role.TIM
|
||||
|
||||
def test_get_user_from_invalid_session(self, access_control):
|
||||
"""Test la récupération avec session invalide."""
|
||||
user = access_control.get_user_from_session("invalid_session_id")
|
||||
|
||||
assert user is None
|
||||
|
||||
def test_get_user_from_expired_session(self, access_control, sample_users):
|
||||
"""Test la récupération avec session expirée."""
|
||||
# Créer un AccessControl avec durée très courte
|
||||
ac = AccessControl(session_duration_hours=0)
|
||||
ac.create_user("test", "pass", Role.TIM)
|
||||
|
||||
# Créer une session qui expire immédiatement
|
||||
session = ac.authenticate("test", "pass")
|
||||
|
||||
# Attendre que la session expire
|
||||
time.sleep(0.1)
|
||||
|
||||
# Modifier manuellement l'expiration pour simuler une session expirée
|
||||
ac._sessions[session.session_id] = type(session)(
|
||||
session_id=session.session_id,
|
||||
user_id=session.user_id,
|
||||
created_at=session.created_at,
|
||||
expires_at=datetime.now() - timedelta(seconds=1),
|
||||
ip_address=session.ip_address
|
||||
)
|
||||
|
||||
user = ac.get_user_from_session(session.session_id)
|
||||
|
||||
assert user is None
|
||||
# La session expirée devrait être supprimée
|
||||
assert session.session_id not in ac._sessions
|
||||
|
||||
|
||||
class TestHasPermission:
|
||||
"""Tests de vérification des permissions."""
|
||||
|
||||
def test_tim_has_view_codes_permission(self, access_control, sample_users):
|
||||
"""Test que TIM a la permission VIEW_CODES."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
assert access_control.has_permission(session.session_id, Permission.VIEW_CODES) is True
|
||||
|
||||
def test_tim_has_correct_code_permission(self, access_control, sample_users):
|
||||
"""Test que TIM a la permission CORRECT_CODE."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
assert access_control.has_permission(session.session_id, Permission.CORRECT_CODE) is True
|
||||
|
||||
def test_tim_no_manage_users_permission(self, access_control, sample_users):
|
||||
"""Test que TIM n'a pas la permission MANAGE_USERS."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
assert access_control.has_permission(session.session_id, Permission.MANAGE_USERS) is False
|
||||
|
||||
def test_responsable_has_export_audit_permission(self, access_control, sample_users):
|
||||
"""Test que Responsable DIM a la permission EXPORT_AUDIT."""
|
||||
session = access_control.authenticate("responsable_user", "password456")
|
||||
|
||||
assert access_control.has_permission(session.session_id, Permission.EXPORT_AUDIT) is True
|
||||
|
||||
def test_responsable_no_manage_users_permission(self, access_control, sample_users):
|
||||
"""Test que Responsable DIM n'a pas la permission MANAGE_USERS."""
|
||||
session = access_control.authenticate("responsable_user", "password456")
|
||||
|
||||
assert access_control.has_permission(session.session_id, Permission.MANAGE_USERS) is False
|
||||
|
||||
def test_admin_has_all_permissions(self, access_control, sample_users):
|
||||
"""Test que Admin a toutes les permissions."""
|
||||
session = access_control.authenticate("admin_user", "password789")
|
||||
|
||||
# Tester quelques permissions
|
||||
assert access_control.has_permission(session.session_id, Permission.VIEW_CODES) is True
|
||||
assert access_control.has_permission(session.session_id, Permission.MANAGE_USERS) is True
|
||||
assert access_control.has_permission(session.session_id, Permission.EXPORT_AUDIT) is True
|
||||
assert access_control.has_permission(session.session_id, Permission.MANAGE_REFERENTIELS) is True
|
||||
|
||||
def test_has_permission_invalid_session(self, access_control):
|
||||
"""Test la vérification avec session invalide."""
|
||||
assert access_control.has_permission("invalid_session", Permission.VIEW_CODES) is False
|
||||
|
||||
|
||||
class TestRequirePermission:
|
||||
"""Tests de vérification stricte des permissions."""
|
||||
|
||||
def test_require_permission_success(self, access_control, sample_users):
|
||||
"""Test la vérification réussie d'une permission."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
user = access_control.require_permission(session.session_id, Permission.VIEW_CODES)
|
||||
|
||||
assert user is not None
|
||||
assert user.username == "tim_user"
|
||||
|
||||
def test_require_permission_denied(self, access_control, sample_users):
|
||||
"""Test la vérification échouée d'une permission."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
with pytest.raises(PermissionError, match="Permission refusée"):
|
||||
access_control.require_permission(session.session_id, Permission.MANAGE_USERS)
|
||||
|
||||
def test_require_permission_invalid_session(self, access_control):
|
||||
"""Test la vérification avec session invalide."""
|
||||
with pytest.raises(PermissionError, match="Session invalide"):
|
||||
access_control.require_permission("invalid_session", Permission.VIEW_CODES)
|
||||
|
||||
|
||||
class TestLogout:
|
||||
"""Tests de déconnexion."""
|
||||
|
||||
def test_logout_success(self, access_control, sample_users):
|
||||
"""Test la déconnexion réussie."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
result = access_control.logout(session.session_id)
|
||||
|
||||
assert result is True
|
||||
# La session ne devrait plus exister
|
||||
user = access_control.get_user_from_session(session.session_id)
|
||||
assert user is None
|
||||
|
||||
def test_logout_invalid_session(self, access_control):
|
||||
"""Test la déconnexion avec session invalide."""
|
||||
result = access_control.logout("invalid_session")
|
||||
|
||||
assert result is False
|
||||
|
||||
|
||||
class TestDeactivateUser:
|
||||
"""Tests de désactivation d'utilisateurs."""
|
||||
|
||||
def test_deactivate_user_success(self, access_control, sample_users):
|
||||
"""Test la désactivation réussie d'un utilisateur."""
|
||||
# Créer une session
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
|
||||
# Désactiver l'utilisateur
|
||||
result = access_control.deactivate_user(sample_users["tim"].user_id)
|
||||
|
||||
assert result is True
|
||||
|
||||
# La session devrait être supprimée
|
||||
user = access_control.get_user_from_session(session.session_id)
|
||||
assert user is None
|
||||
|
||||
# L'utilisateur ne devrait plus pouvoir se connecter
|
||||
new_session = access_control.authenticate("tim_user", "password123")
|
||||
assert new_session is None
|
||||
|
||||
def test_deactivate_user_invalid_id(self, access_control):
|
||||
"""Test la désactivation avec ID invalide."""
|
||||
result = access_control.deactivate_user("invalid_user_id")
|
||||
|
||||
assert result is False
|
||||
|
||||
|
||||
class TestGetUserPermissions:
|
||||
"""Tests de récupération des permissions."""
|
||||
|
||||
def test_get_tim_permissions(self, access_control, sample_users):
|
||||
"""Test la récupération des permissions TIM."""
|
||||
session = access_control.authenticate("tim_user", "password123")
|
||||
permissions = access_control.get_user_permissions(session.session_id)
|
||||
|
||||
assert Permission.VIEW_CODES in permissions
|
||||
assert Permission.CORRECT_CODE in permissions
|
||||
assert Permission.VALIDATE_STAY in permissions
|
||||
assert Permission.MANAGE_USERS not in permissions
|
||||
|
||||
def test_get_responsable_permissions(self, access_control, sample_users):
|
||||
"""Test la récupération des permissions Responsable DIM."""
|
||||
session = access_control.authenticate("responsable_user", "password456")
|
||||
permissions = access_control.get_user_permissions(session.session_id)
|
||||
|
||||
assert Permission.VIEW_CODES in permissions
|
||||
assert Permission.EXPORT_AUDIT in permissions
|
||||
assert Permission.MANAGE_RULES in permissions
|
||||
assert Permission.MANAGE_USERS not in permissions
|
||||
|
||||
def test_get_admin_permissions(self, access_control, sample_users):
|
||||
"""Test la récupération des permissions Admin."""
|
||||
session = access_control.authenticate("admin_user", "password789")
|
||||
permissions = access_control.get_user_permissions(session.session_id)
|
||||
|
||||
# Admin devrait avoir toutes les permissions
|
||||
assert len(permissions) == len(Permission)
|
||||
assert Permission.MANAGE_USERS in permissions
|
||||
|
||||
def test_get_permissions_invalid_session(self, access_control):
|
||||
"""Test la récupération avec session invalide."""
|
||||
permissions = access_control.get_user_permissions("invalid_session")
|
||||
|
||||
assert len(permissions) == 0
|
||||
|
||||
|
||||
class TestPasswordHashing:
|
||||
"""Tests de hachage des mots de passe."""
|
||||
|
||||
def test_password_is_hashed(self, access_control):
|
||||
"""Test que le mot de passe est hashé."""
|
||||
user = access_control.create_user("test", "password123", Role.TIM)
|
||||
|
||||
# Le hash ne devrait pas être le mot de passe en clair
|
||||
assert user.password_hash != "password123"
|
||||
# Le hash devrait contenir un salt
|
||||
assert ":" in user.password_hash
|
||||
|
||||
def test_same_password_different_hashes(self, access_control):
|
||||
"""Test que le même mot de passe produit des hashes différents (salt aléatoire)."""
|
||||
user1 = access_control.create_user("user1", "password", Role.TIM)
|
||||
user2 = access_control.create_user("user2", "password", Role.TIM)
|
||||
|
||||
# Les hashes devraient être différents (salt différent)
|
||||
assert user1.password_hash != user2.password_hash
|
||||
|
||||
def test_password_verification(self, access_control):
|
||||
"""Test la vérification du mot de passe."""
|
||||
user = access_control.create_user("test", "password123", Role.TIM)
|
||||
|
||||
# Le bon mot de passe devrait fonctionner
|
||||
assert access_control._verify_password("password123", user.password_hash) is True
|
||||
|
||||
# Un mauvais mot de passe ne devrait pas fonctionner
|
||||
assert access_control._verify_password("wrong_password", user.password_hash) is False
|
||||
Reference in New Issue
Block a user