Aug 26 - Enhance security 2

tests/conftest.py

@@ -0,0 +1,75 @@
+"""
+Shared pytest fixtures.
+
+Runs the real app factory against in-memory SQLite. The server treats all
+client-side crypto as opaque strings (auth_hash, enc_data, iv, enc_name), so
+these tests can pass arbitrary values for them — no Web Crypto needed. The one
+place real crypto matters is the recovery proof, which is plain HMAC-SHA256 and
+is computed here exactly as recover.js does.
+"""
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from app import create_app, db as _db  # noqa: E402
+
+
+@pytest.fixture
+def app():
+    application = create_app('testing')
+    with application.app_context():
+        _db.create_all()
+        yield application
+        _db.session.remove()
+        _db.drop_all()
+
+
+@pytest.fixture
+def client(app):
+    return app.test_client()
+
+
+@pytest.fixture
+def db(app):
+    return _db
+
+
+# ── Helpers ──────────────────────────────────────────────────────────────────
+
+def register(client, email='user@example.com', auth_hash='AUTH-HASH-V1',
+             enc_key_salt='SALT-V1'):
+    return client.post('/api/auth/register', json={
+        'email': email, 'auth_hash': auth_hash, 'enc_key_salt': enc_key_salt,
+    })
+
+
+def login(client, email='user@example.com', auth_hash='AUTH-HASH-V1'):
+    return client.post('/api/auth/login', json={'email': email, 'auth_hash': auth_hash})
+
+
+def auth_headers(token):
+    return {'Authorization': f'Bearer {token}'}
+
+
+def make_user(client, email='user@example.com', auth_hash='AUTH-HASH-V1',
+              enc_key_salt='SALT-V1'):
+    """Register + log in. Returns (access_token, refresh_token)."""
+    assert register(client, email, auth_hash, enc_key_salt).status_code == 201
+    res = login(client, email, auth_hash)
+    assert res.status_code == 200, res.get_json()
+    body = res.get_json()
+    return body['access_token'], body['refresh_token']
+
+
+def add_item(client, token, name='password', enc_data='CT', iv='IV'):
+    """Create a vault item. `name` is the server-side type label."""
+    res = client.post('/api/vault', headers=auth_headers(token), json={
+        'name': name, 'item_type': 'password',
+        'enc_data': enc_data, 'iv': iv,
+        'enc_name': 'ENCNAME', 'iv_name': 'IVNAME',
+    })
+    assert res.status_code == 201, res.get_json()
+    return res.get_json()['id']