52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
"""Gate 1 contract tests for canonical tenant-context signatures."""
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime, timezone
|
|
import unittest
|
|
|
|
from aios_v2r1.tenant_context import TenantContext, ValidationError
|
|
|
|
|
|
class TenantContextSignatureContractTests(unittest.TestCase):
|
|
key = b"k" * 32
|
|
now = datetime(2026, 7, 13, tzinfo=timezone.utc)
|
|
|
|
def setUp(self) -> None:
|
|
self.context = TenantContext(
|
|
tenant_id="tenant-a",
|
|
cell_id="cell-a",
|
|
principal_id="user-a",
|
|
principal_type="user",
|
|
session_id="session-a",
|
|
task_id=None,
|
|
channel="hermes",
|
|
channel_account_id="account-a",
|
|
issued_at="2026-07-13T00:00:00+00:00",
|
|
expires_at="2026-07-13T00:05:00+00:00",
|
|
nonce="nonce-b",
|
|
)
|
|
self.token = self.context.sign(self.key)
|
|
|
|
def test_valid_canonical_token_verifies(self) -> None:
|
|
verified = TenantContext.verify(self.token, self.key, now=self.now)
|
|
|
|
self.assertEqual(verified, self.context)
|
|
|
|
def test_rejects_padded_signature_encoding(self) -> None:
|
|
with self.assertRaises(ValidationError):
|
|
TenantContext.verify(f"{self.token}=", self.key, now=self.now)
|
|
|
|
def test_rejects_standard_base64_signature_encoding(self) -> None:
|
|
payload, signature = self.token.rsplit(".", 1)
|
|
standard_signature = signature.replace("-", "+").replace("_", "/")
|
|
self.assertNotEqual(signature, standard_signature)
|
|
|
|
with self.assertRaises(ValidationError):
|
|
TenantContext.verify(
|
|
f"{payload}.{standard_signature}", self.key, now=self.now
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|