HAL9000
e5c818292d
CI / benchmark-publish (pull_request) Has been skipped
CI / build (pull_request) Successful in 1m45s
CI / lint (pull_request) Failing after 1m56s
CI / quality (pull_request) Successful in 2m0s
CI / typecheck (pull_request) Successful in 2m15s
CI / security (pull_request) Successful in 2m25s
CI / push-validation (pull_request) Successful in 23s
CI / helm (pull_request) Successful in 25s
CI / integration_tests (pull_request) Successful in 4m17s
CI / e2e_tests (pull_request) Successful in 5m28s
CI / unit_tests (pull_request) Failing after 5m35s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / status-check (pull_request) Failing after 3s
- Strip 11+ unrelated features bundled in original PR (scope violation) - Remove # type: ignore[arg-type] from jwt_service.py (zero-tolerance policy) - Replace hardcoded JWT_SECRET_KEY default with mandatory env var validation - Fix HS256 docstring: "asymmetric" -> "symmetric (HMAC-SHA256)" - Add 1 MiB body size limit in _read_body() to prevent OOM DoS - Fix 405 Allow header: POST paths now advertise POST, not GET - Fix Scenario Outline -> Scenario in auth_refresh.feature (no Examples table) - Remove duplicate step definitions conflicting with asgi_app_steps.py - Add auth/refresh ASGI-level scenarios to asgi_app.feature - Remove duplicate langchain-anthropic dependency from pyproject.toml - Set JWT_SECRET_KEY test secret in environment.py before_all hook
85 lines
3.4 KiB
Gherkin
85 lines
3.4 KiB
Gherkin
Feature: JWT Token Refresh
|
|
As a client of the CleverAgents API
|
|
I want to be able to refresh my access token using a valid refresh token
|
|
So that I can continue making authenticated requests without requiring re-login
|
|
|
|
Scenario: Refresh endpoint rejects requests without refresh token
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with JSON body:
|
|
"""
|
|
{
|
|
"token": "some_token"
|
|
}
|
|
"""
|
|
Then the response status code should be 400
|
|
And the response should contain "refresh_token is required"
|
|
|
|
Scenario: Refresh endpoint rejects invalid JSON body
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with JSON body:
|
|
"""
|
|
{ invalid json }
|
|
"""
|
|
Then the response status code should be 400
|
|
And the response should contain "Invalid JSON body"
|
|
|
|
Scenario: Refresh endpoint rejects wrong content type
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with content type "text/plain" and body:
|
|
"""
|
|
{"refresh_token": "test"}
|
|
"""
|
|
Then the response status code should be 400
|
|
And the response should contain "Content-Type must be application/json"
|
|
|
|
Scenario: Refresh endpoint rejects empty refresh token
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with JSON body:
|
|
"""
|
|
{
|
|
"refresh_token": ""
|
|
}
|
|
"""
|
|
Then the response status code should be 400
|
|
And the response should contain "refresh_token is required"
|
|
|
|
Scenario: Refresh endpoint rejects non-string refresh token
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with JSON body:
|
|
"""
|
|
{
|
|
"refresh_token": 12345
|
|
}
|
|
"""
|
|
Then the response status code should be 400
|
|
And the response should contain "refresh_token is required"
|
|
|
|
Scenario: Refresh endpoint rejects non-refresh tokens
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with JSON body containing a non-refresh token
|
|
Then the response status code should be 401
|
|
And the response should contain "Invalid or expired refresh token"
|
|
|
|
Scenario: Refresh endpoint rejects malformed tokens
|
|
Given the application is running
|
|
When I send a POST request to "/auth/refresh" with JSON body:
|
|
"""
|
|
{
|
|
"refresh_token": "not.a.valid.jwt.token"
|
|
}
|
|
"""
|
|
Then the response status code should be 401
|
|
And the response should contain "Invalid or expired refresh token"
|
|
|
|
Scenario: Refresh endpoint returns new tokens for valid refresh token
|
|
Given the application is running
|
|
And I have a valid refresh token
|
|
When I send a POST request to "/auth/refresh" with the stored refresh token
|
|
Then the response status code should be 200
|
|
And the response should contain "access_token"
|
|
And the response should contain "refresh_token"
|
|
And the response should contain "token_type"
|
|
And the response should contain "bearer"
|
|
And the new access token should be a valid JWT
|
|
And the new refresh token should be a valid refresh token
|