BTHLABS-58: Share Extension in Apple Apps

services/backend/tests/ui/views/rpc/accounts/access_tokens/test_create.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import http
-import uuid
 
 from django.test import Client
 from django.urls import reverse
@@ -15,34 +14,23 @@ from hotpocket_backend_testing.services.accounts import (
 
 
 @pytest.fixture
-def auth_key():
-    return str(uuid.uuid4())
-
-
-@pytest.fixture
-def call(rpc_call_factory, auth_key, safari_extension_meta):
+def call(rpc_call_factory, auth_key_out, safari_extension_meta):
     return rpc_call_factory(
         'accounts.access_tokens.create',
-        [auth_key, safari_extension_meta],
+        [auth_key_out.key, safari_extension_meta],
     )
 
 
 @pytest.mark.django_db
-def test_ok(authenticated_client: Client,
-            auth_key,
+def test_ok(client: Client,
             call,
             safari_extension_origin,
             account,
             safari_extension_meta,
             ):
-    # Given
-    session = authenticated_client.session
-    session['extension_auth_key'] = auth_key
-    session.save()
-
     # When
-    result = authenticated_client.post(
-        reverse('ui.rpc'),
+    result = client.post(
+        reverse('ui.accounts.rpc'),
         data=call,
         content_type='application/json',
         headers={
@@ -63,17 +51,20 @@ def test_ok(authenticated_client: Client,
         meta=safari_extension_meta,
     )
 
-    assert 'extension_auth_key' not in authenticated_client.session
-
 
 @pytest.mark.django_db
-def test_auth_key_missing(authenticated_client: Client,
-                          call,
-                          safari_extension_origin,
-                          ):
+def test_auth_key_not_found(null_uuid,
+                            call,
+                            client: Client,
+                            safari_extension_origin,
+                            ):
+    # Given
+    call_auth_key = str(null_uuid)
+    call['params'][0] = call_auth_key
+
     # When
-    result = authenticated_client.post(
-        reverse('ui.rpc'),
+    result = client.post(
+        reverse('ui.accounts.rpc'),
         data=call,
         content_type='application/json',
         headers={
@@ -86,22 +77,87 @@ def test_auth_key_missing(authenticated_client: Client,
 
     call_result = result.json()
     assert 'error' in call_result
-    assert call_result['error']['data'] == 'Auth key missing'
+    assert call_result['error']['data'].startswith(
+        'Auth Key not found',
+    )
+    assert call_auth_key in call_result['error']['data']
 
 
 @pytest.mark.django_db
-def test_auth_key_mismatch(authenticated_client: Client,
+def test_deleted_auth_key(deleted_auth_key_out,
+                          call,
+                          client: Client,
+                          safari_extension_origin,
+                          ):
+    # Given
+    call_auth_key = deleted_auth_key_out.key
+    call['params'][0] = call_auth_key
+
+    # When
+    result = client.post(
+        reverse('ui.accounts.rpc'),
+        data=call,
+        content_type='application/json',
+        headers={
+            'Origin': safari_extension_origin,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' in call_result
+    assert call_result['error']['data'].startswith(
+        'Auth Key not found',
+    )
+    assert call_auth_key in call_result['error']['data']
+
+
+@pytest.mark.django_db
+def test_expired_auth_key(expired_auth_key_out,
+                          call,
+                          client: Client,
+                          safari_extension_origin,
+                          ):
+    # Given
+    call_auth_key = expired_auth_key_out.key
+    call['params'][0] = call_auth_key
+
+    # When
+    result = client.post(
+        reverse('ui.accounts.rpc'),
+        data=call,
+        content_type='application/json',
+        headers={
+            'Origin': safari_extension_origin,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' in call_result
+    assert call_result['error']['data'].startswith(
+        'Auth Key expired',
+    )
+    assert call_auth_key in call_result['error']['data']
+
+
+@pytest.mark.django_db
+def test_consumed_auth_key(consumed_auth_key,
                            call,
+                           client: Client,
                            safari_extension_origin,
                            ):
     # Given
-    session = authenticated_client.session
-    session['extension_auth_key'] = 'thisisntright'
-    session.save()
+    call_auth_key = consumed_auth_key.key
+    call['params'][0] = call_auth_key
 
     # When
-    result = authenticated_client.post(
-        reverse('ui.rpc'),
+    result = client.post(
+        reverse('ui.accounts.rpc'),
         data=call,
         content_type='application/json',
         headers={
@@ -114,28 +170,35 @@ def test_auth_key_mismatch(authenticated_client: Client,
 
     call_result = result.json()
     assert 'error' in call_result
-    assert call_result['error']['data'] == 'Auth key mismatch'
-
-
-@pytest.mark.django_db
-def test_inactive_account(inactive_account_client: Client, call):
-    # When
-    result = inactive_account_client.post(
-        reverse('ui.rpc'),
-        data=call,
+    assert call_result['error']['data'].startswith(
+        'Auth Key already consumed',
     )
-
-    # Then
-    assert result.status_code == http.HTTPStatus.FORBIDDEN
+    assert call_auth_key in call_result['error']['data']
 
 
 @pytest.mark.django_db
-def test_anonymous(client: Client, call):
+def test_inactive_account(inactive_account_auth_key,
+                          call,
+                          client: Client,
+                          safari_extension_origin,
+                          inactive_account,
+                          ):
+    # Given
+    call['params'][0] = inactive_account_auth_key.key
+
     # When
     result = client.post(
-        reverse('ui.rpc'),
+        reverse('ui.accounts.rpc'),
         data=call,
+        content_type='application/json',
+        headers={
+            'Origin': safari_extension_origin,
+        },
     )
 
     # Then
-    assert result.status_code == http.HTTPStatus.FORBIDDEN
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' in call_result
+    assert str(inactive_account.pk) in call_result['error']['data']