forked from cleveragents/cleveragents-core
CoreRasurae
97c1007bb5
Add TokenAuthMiddleware to emit AUTH_SUCCESS/AUTH_FAILURE with spec-aligned audit details and wire it through the DI container using server.token resolution. Add Behave and Robot coverage for auth event emission and end-to-end audit persistence, and update audit subscriber producer notes and changelog. ISSUES CLOSED: #714
64 lines
3.9 KiB
Gherkin
64 lines
3.9 KiB
Gherkin
Feature: Auth middleware emits security events
|
|
As a platform operator
|
|
I want authentication outcomes emitted as domain events
|
|
So the audit pipeline captures auth success and failure details
|
|
|
|
Scenario: Successful authentication emits AUTH_SUCCESS
|
|
Given an auth middleware with expected token "tok_secret_123"
|
|
And an auth recording event bus
|
|
When I authenticate with token "tok_secret_123" identity "alice@example.com" and ip "10.0.0.5"
|
|
Then the auth result should be true
|
|
And the auth event bus should have exactly 1 event
|
|
And the latest auth event type should be AUTH_SUCCESS
|
|
And the latest auth event should contain detail "user_identity" with value "alice@example.com"
|
|
And the latest auth event should contain detail "ip_address" with value "10.0.0.5"
|
|
And the latest auth event should contain detail "token_prefix" with value "tok_se..."
|
|
|
|
Scenario: Short token success masks token_prefix
|
|
Given an auth middleware with expected token "short"
|
|
And an auth recording event bus
|
|
When I authenticate with token "short" identity "alice@example.com" and ip "10.0.0.5"
|
|
Then the auth result should be true
|
|
And the latest auth event type should be AUTH_SUCCESS
|
|
And the latest auth event should contain detail "token_prefix" with value "***..."
|
|
|
|
Scenario: Failed authentication emits AUTH_FAILURE
|
|
Given an auth middleware with expected token "tok_secret_123"
|
|
And an auth recording event bus
|
|
When I authenticate with token "tok_wrong_999" identity "alice@example.com" and ip "10.0.0.5"
|
|
Then the auth result should be false
|
|
And the auth event bus should have exactly 1 event
|
|
And the latest auth event type should be AUTH_FAILURE
|
|
And the latest auth event should contain detail "attempted_identity" with value "alice@example.com"
|
|
And the latest auth event should contain detail "failure_reason" with value "invalid_token"
|
|
And the latest auth event should contain detail "token_prefix" with value "tok_wr..."
|
|
|
|
Scenario: Missing configured token emits AUTH_FAILURE
|
|
Given an auth middleware with no configured token
|
|
And an auth recording event bus
|
|
When I authenticate with token "tok_any_111" identity "bob@example.com" and ip "10.0.0.9"
|
|
Then the auth result should be false
|
|
And the latest auth event type should be AUTH_FAILURE
|
|
And the latest auth event should contain detail "failure_reason" with value "token_not_configured"
|
|
|
|
Scenario: Empty authentication token is rejected before emission
|
|
Given an auth middleware with expected token "tok_secret_123"
|
|
And an auth recording event bus
|
|
When I try to authenticate with an empty token
|
|
Then an auth ValueError should be raised
|
|
And the auth event bus should have exactly 0 event
|
|
|
|
Scenario: Auth middleware events persist through AuditEventSubscriber
|
|
Given auth middleware is wired to AuditEventSubscriber with expected token "tok_secret_123"
|
|
When I authenticate with token "tok_secret_123" identity "carol@example.com" and ip "10.1.2.3"
|
|
And I authenticate with token "tok_bad_123" identity "dave@example.com" and ip "10.1.2.4"
|
|
Then the auth result history should be "true,false"
|
|
And the audit log should contain 1 auth_success entry from middleware
|
|
And the latest auth_success audit entry should contain detail "ip_address" with value "10.1.2.3"
|
|
And the latest auth_success audit entry should contain detail "token_prefix" with value "tok_se..."
|
|
And the audit log should contain 1 auth_failure entry from middleware
|
|
And the latest auth_failure audit entry should contain detail "ip_address" with value "10.1.2.4"
|
|
And the latest auth_failure audit entry should contain detail "attempted_identity" with value "dave@example.com"
|
|
And the latest auth_failure audit entry should contain detail "failure_reason" with value "invalid_token"
|
|
And the latest auth_failure audit entry should contain detail "token_prefix" with value "tok_ba..."
|