CoreRasurae
97c1007bb5
CI / push-validation (pull_request) Successful in 48s
CI / build (pull_request) Successful in 1m17s
CI / helm (pull_request) Successful in 1m0s
CI / lint (pull_request) Successful in 1m54s
CI / quality (pull_request) Successful in 1m55s
CI / security (pull_request) Successful in 2m5s
CI / typecheck (pull_request) Successful in 2m4s
CI / integration_tests (pull_request) Successful in 5m1s
CI / unit_tests (pull_request) Successful in 5m10s
CI / docker (pull_request) Successful in 1m51s
CI / coverage (pull_request) Successful in 12m47s
CI / status-check (pull_request) Successful in 8s
CI / benchmark-publish (push) Has started running
CI / benchmark-regression (push) Failing after 1m15s
CI / typecheck (push) Has started running
CI / security (push) Has started running
CI / quality (push) Has started running
CI / integration_tests (push) Has started running
CI / unit_tests (push) Has started running
CI / e2e_tests (push) Has started running
CI / lint (push) Successful in 56s
CI / helm (push) Successful in 53s
CI / push-validation (push) Successful in 54s
CI / build (push) Successful in 1m24s
CI / coverage (push) Blocked by required conditions
CI / docker (push) Blocked by required conditions
CI / status-check (push) Blocked by required conditions
Add TokenAuthMiddleware to emit AUTH_SUCCESS/AUTH_FAILURE with spec-aligned audit details and wire it through the DI container using server.token resolution. Add Behave and Robot coverage for auth event emission and end-to-end audit persistence, and update audit subscriber producer notes and changelog. ISSUES CLOSED: #714
64 lines
3.9 KiB
Gherkin
64 lines
3.9 KiB
Gherkin
Feature: Auth middleware emits security events
|
|
As a platform operator
|
|
I want authentication outcomes emitted as domain events
|
|
So the audit pipeline captures auth success and failure details
|
|
|
|
Scenario: Successful authentication emits AUTH_SUCCESS
|
|
Given an auth middleware with expected token "tok_secret_123"
|
|
And an auth recording event bus
|
|
When I authenticate with token "tok_secret_123" identity "alice@example.com" and ip "10.0.0.5"
|
|
Then the auth result should be true
|
|
And the auth event bus should have exactly 1 event
|
|
And the latest auth event type should be AUTH_SUCCESS
|
|
And the latest auth event should contain detail "user_identity" with value "alice@example.com"
|
|
And the latest auth event should contain detail "ip_address" with value "10.0.0.5"
|
|
And the latest auth event should contain detail "token_prefix" with value "tok_se..."
|
|
|
|
Scenario: Short token success masks token_prefix
|
|
Given an auth middleware with expected token "short"
|
|
And an auth recording event bus
|
|
When I authenticate with token "short" identity "alice@example.com" and ip "10.0.0.5"
|
|
Then the auth result should be true
|
|
And the latest auth event type should be AUTH_SUCCESS
|
|
And the latest auth event should contain detail "token_prefix" with value "***..."
|
|
|
|
Scenario: Failed authentication emits AUTH_FAILURE
|
|
Given an auth middleware with expected token "tok_secret_123"
|
|
And an auth recording event bus
|
|
When I authenticate with token "tok_wrong_999" identity "alice@example.com" and ip "10.0.0.5"
|
|
Then the auth result should be false
|
|
And the auth event bus should have exactly 1 event
|
|
And the latest auth event type should be AUTH_FAILURE
|
|
And the latest auth event should contain detail "attempted_identity" with value "alice@example.com"
|
|
And the latest auth event should contain detail "failure_reason" with value "invalid_token"
|
|
And the latest auth event should contain detail "token_prefix" with value "tok_wr..."
|
|
|
|
Scenario: Missing configured token emits AUTH_FAILURE
|
|
Given an auth middleware with no configured token
|
|
And an auth recording event bus
|
|
When I authenticate with token "tok_any_111" identity "bob@example.com" and ip "10.0.0.9"
|
|
Then the auth result should be false
|
|
And the latest auth event type should be AUTH_FAILURE
|
|
And the latest auth event should contain detail "failure_reason" with value "token_not_configured"
|
|
|
|
Scenario: Empty authentication token is rejected before emission
|
|
Given an auth middleware with expected token "tok_secret_123"
|
|
And an auth recording event bus
|
|
When I try to authenticate with an empty token
|
|
Then an auth ValueError should be raised
|
|
And the auth event bus should have exactly 0 event
|
|
|
|
Scenario: Auth middleware events persist through AuditEventSubscriber
|
|
Given auth middleware is wired to AuditEventSubscriber with expected token "tok_secret_123"
|
|
When I authenticate with token "tok_secret_123" identity "carol@example.com" and ip "10.1.2.3"
|
|
And I authenticate with token "tok_bad_123" identity "dave@example.com" and ip "10.1.2.4"
|
|
Then the auth result history should be "true,false"
|
|
And the audit log should contain 1 auth_success entry from middleware
|
|
And the latest auth_success audit entry should contain detail "ip_address" with value "10.1.2.3"
|
|
And the latest auth_success audit entry should contain detail "token_prefix" with value "tok_se..."
|
|
And the audit log should contain 1 auth_failure entry from middleware
|
|
And the latest auth_failure audit entry should contain detail "ip_address" with value "10.1.2.4"
|
|
And the latest auth_failure audit entry should contain detail "attempted_identity" with value "dave@example.com"
|
|
And the latest auth_failure audit entry should contain detail "failure_reason" with value "invalid_token"
|
|
And the latest auth_failure audit entry should contain detail "token_prefix" with value "tok_ba..."
|