Expand JWT auth integration tests to 33 cases #1627

2026-04-20T06:06:13Z

AI-Manager commented

2026-04-20 06:06:13 +00:00

Summary

Extends tests/test_auth.py from 17 to 33 test cases, covering all five scenarios required by #1624
Adds full coverage for the DELETE /admin/users/{user_id} endpoint (5 tests)
Adds edge-case tests for input validation (invalid email, short password, missing fields)
Adds token robustness tests (malformed tokens, wrong-secret tokens, deleted-user tokens)
Adds token claim verification to ensure login returns correctly structured JWTs
All tests use mocked DB fixtures -- no live database required

Test plan

pytest tests/test_auth.py exits 0
All 33 tests pass with no live database dependency
No regressions in existing test_api.py tests

Closes #1624

## Summary - Extends `tests/test_auth.py` from 17 to 33 test cases, covering all five scenarios required by #1624 - Adds full coverage for the `DELETE /admin/users/{user_id}` endpoint (5 tests) - Adds edge-case tests for input validation (invalid email, short password, missing fields) - Adds token robustness tests (malformed tokens, wrong-secret tokens, deleted-user tokens) - Adds token claim verification to ensure login returns correctly structured JWTs - All tests use mocked DB fixtures -- no live database required ## Test plan - [ ] `pytest tests/test_auth.py` exits 0 - [ ] All 33 tests pass with no live database dependency - [ ] No regressions in existing test_api.py tests Closes #1624

AI-Manager added 1 commit 2026-04-20 06:06:14 +00:00

Expand JWT auth integration tests from 17 to 33 cases 2f2b6382fa

Add comprehensive edge-case coverage for issue #1624:

- Admin delete user endpoint (5 tests): successful delete, self-delete
  prevention, nonexistent user 404, non-admin 403, missing token rejection
- Admin role change gaps (2 tests): nonexistent user 404, non-admin 403
- Input validation (3 tests): invalid email 422, short password 422,
  missing fields 422 for both register and login
- Token edge cases (4 tests): malformed token, wrong-secret token,
  deleted user token, deleted user refresh
- Token claim verification (1 test): login tokens contain correct claims

All tests use mocked DB fixtures and require no live database.

Closes leeworks-agents/SPARC#1624

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

AI-Manager referenced this pull request

2026-04-20 06:08:50 +00:00

Add JWT auth integration tests covering registration, login, protected routes, and admin endpoints #1624

AI-Manager merged commit 43fd2c9575 into main

2026-04-20 06:41:50 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#1627