quorum_public/tests/robust/
auth_tests.rs

1use crate::startup;
2use crate::tests::RobustnessTestResult;
3use crate::tests::common::{cleanup_user, get_test_username, make_auth_request_raw};
4use serde_json::json;
5
6/// Test signup with very short username (1 character)
7pub async fn test_signup_short_username() -> Result<RobustnessTestResult, String> {
8    let timer = startup::create_timer();
9    make_auth_request_raw(
10        "/auth/signup",
11        &json!({
12            "username": "a",
13            "password": "TestPassword123!"
14        }),
15        500,
16    )
17    .await?;
18    let endpoint_time = timer.elapsed();
19
20    Ok(RobustnessTestResult { endpoint_time })
21}
22
23/// Test signup with very long username (256+ characters)
24pub async fn test_signup_long_username() -> Result<RobustnessTestResult, String> {
25    let timer = startup::create_timer();
26    make_auth_request_raw(
27        "/auth/signup",
28        &json!({
29            "username": "a".repeat(256),
30            "password": "TestPassword123!"
31        }),
32        500,
33    )
34    .await?;
35    let endpoint_time = timer.elapsed();
36
37    Ok(RobustnessTestResult { endpoint_time })
38}
39
40/// Test signup with empty password
41pub async fn test_signup_empty_password() -> Result<RobustnessTestResult, String> {
42    let timer = startup::create_timer();
43    make_auth_request_raw(
44        "/auth/signup",
45        &json!({
46            "username": get_test_username(),
47            "password": ""
48        }),
49        400,
50    )
51    .await?;
52    let endpoint_time = timer.elapsed();
53
54    Ok(RobustnessTestResult { endpoint_time })
55}
56
57/// Test signup with very short password (1 character)
58pub async fn test_signup_short_password() -> Result<RobustnessTestResult, String> {
59    let timer = startup::create_timer();
60    make_auth_request_raw(
61        "/auth/signup",
62        &json!({
63            "username": get_test_username(),
64            "password": "a"
65        }),
66        400,
67    )
68    .await?;
69    let endpoint_time = timer.elapsed();
70
71    Ok(RobustnessTestResult { endpoint_time })
72}
73
74/// Test signup with very long password (1000+ characters)
75pub async fn test_signup_long_password() -> Result<RobustnessTestResult, String> {
76    let timer = startup::create_timer();
77    make_auth_request_raw(
78        "/auth/signup",
79        &json!({
80            "username": get_test_username(),
81            "password": "a".repeat(1000)
82        }),
83        400,
84    )
85    .await?;
86    let endpoint_time = timer.elapsed();
87
88    Ok(RobustnessTestResult { endpoint_time })
89}
90
91/// Test signup with invalid email format
92pub async fn test_signup_invalid_email() -> Result<RobustnessTestResult, String> {
93    let timer = startup::create_timer();
94    make_auth_request_raw(
95        "/auth/signup",
96        &json!({
97            "username": get_test_username(),
98            "email": "not-an-email",
99            "password": "TestPassword123!"
100        }),
101        500,
102    )
103    .await?;
104    let endpoint_time = timer.elapsed();
105
106    Ok(RobustnessTestResult { endpoint_time })
107}
108
109/// Test signup with duplicate username
110pub async fn test_signup_duplicate_username() -> Result<RobustnessTestResult, String> {
111    let username = get_test_username();
112
113    let login_body = make_auth_request_raw(
114        "/auth/signup",
115        &json!({
116            "username": username,
117            "password": "TestPassword123!"
118        }),
119        201,
120    )
121    .await?;
122    let user_id = login_body["user"]["id"]
123        .as_str()
124        .ok_or("Failed to get user ID")?
125        .to_string();
126
127    let timer = startup::create_timer();
128    make_auth_request_raw(
129        "/auth/signup",
130        &json!({
131            "username": username,
132            "password": "DifferentPassword123!"
133        }),
134        400,
135    )
136    .await?;
137    let endpoint_time = timer.elapsed();
138
139    let _ = cleanup_user(&username, "TestPassword123!", &user_id).await;
140    Ok(RobustnessTestResult { endpoint_time })
141}
142/// Test login with wrong password
143pub async fn test_login_wrong_password() -> Result<RobustnessTestResult, String> {
144    let username = get_test_username();
145
146    make_auth_request_raw(
147        "/auth/signup",
148        &json!({
149            "username": username,
150            "password": "CorrectPassword123!"
151        }),
152        201,
153    )
154    .await?;
155
156    let login_body = make_auth_request_raw(
157        "/auth/login",
158        &json!({
159            "username_or_email": username,
160            "password": "CorrectPassword123!"
161        }),
162        200,
163    )
164    .await?;
165    let user_id = login_body["user"]["id"]
166        .as_str()
167        .ok_or("Failed to get user ID")?
168        .to_string();
169
170    let timer = startup::create_timer();
171    make_auth_request_raw(
172        "/auth/login",
173        &json!({
174            "username_or_email": username,
175            "password": "WrongPassword123!"
176        }),
177        401,
178    )
179    .await?;
180    let endpoint_time = timer.elapsed();
181
182    let _ = cleanup_user(&username, "CorrectPassword123!", &user_id).await;
183    Ok(RobustnessTestResult { endpoint_time })
184}
185
186/// Test login with nonexistent user
187pub async fn test_login_nonexistent_user() -> Result<RobustnessTestResult, String> {
188    let timer = startup::create_timer();
189    make_auth_request_raw(
190        "/auth/login",
191        &json!({
192            "username_or_email": "nonexistent_user_12345",
193            "password": "TestPassword123!"
194        }),
195        401,
196    )
197    .await?;
198    let endpoint_time = timer.elapsed();
199
200    Ok(RobustnessTestResult { endpoint_time })
201}
202
203/// Test login with empty username
204pub async fn test_login_empty_username() -> Result<RobustnessTestResult, String> {
205    let timer = startup::create_timer();
206    make_auth_request_raw(
207        "/auth/login",
208        &json!({
209            "username_or_email": "",
210            "password": "TestPassword123!"
211        }),
212        401,
213    )
214    .await?;
215    let endpoint_time = timer.elapsed();
216
217    Ok(RobustnessTestResult { endpoint_time })
218}
219
220/// Test refresh token with invalid token format
221pub async fn test_refresh_invalid_token() -> Result<RobustnessTestResult, String> {
222    let username = get_test_username();
223
224    make_auth_request_raw(
225        "/auth/signup",
226        &json!({
227            "username": username,
228            "password": "TestPassword123!"
229        }),
230        201,
231    )
232    .await?;
233
234    let login_body = make_auth_request_raw(
235        "/auth/login",
236        &json!({
237            "username_or_email": username,
238            "password": "TestPassword123!"
239        }),
240        200,
241    )
242    .await?;
243    let user_id = login_body["user"]["id"]
244        .as_str()
245        .ok_or("Failed to get user ID")?
246        .to_string();
247
248    let timer = startup::create_timer();
249    make_auth_request_raw(
250        "/auth/refresh",
251        &json!({
252            "user_id": user_id,
253            "refresh_token": "not-a-valid-jwt-token"
254        }),
255        401,
256    )
257    .await?;
258    let endpoint_time = timer.elapsed();
259
260    let _ = cleanup_user(&username, "TestPassword123!", &user_id).await;
261    Ok(RobustnessTestResult { endpoint_time })
262}
263
264/// Test refresh token with empty token
265pub async fn test_refresh_empty_token() -> Result<RobustnessTestResult, String> {
266    let username = get_test_username();
267
268    make_auth_request_raw(
269        "/auth/signup",
270        &json!({
271            "username": username,
272            "password": "TestPassword123!"
273        }),
274        201,
275    )
276    .await?;
277
278    let login_body = make_auth_request_raw(
279        "/auth/login",
280        &json!({
281            "username_or_email": username,
282            "password": "TestPassword123!"
283        }),
284        200,
285    )
286    .await?;
287    let user_id = login_body["user"]["id"]
288        .as_str()
289        .ok_or("Failed to get user ID")?
290        .to_string();
291
292    let timer = startup::create_timer();
293    make_auth_request_raw(
294        "/auth/refresh",
295        &json!({
296            "user_id": user_id,
297            "refresh_token": ""
298        }),
299        401,
300    )
301    .await?;
302    let endpoint_time = timer.elapsed();
303
304    let _ = cleanup_user(&username, "TestPassword123!", &user_id).await;
305    Ok(RobustnessTestResult { endpoint_time })
306}
307
308/// Test delete with wrong password
309pub async fn test_delete_wrong_password() -> Result<RobustnessTestResult, String> {
310    let username = get_test_username();
311
312    make_auth_request_raw(
313        "/auth/signup",
314        &json!({
315            "username": username,
316            "password": "CorrectPassword123!"
317        }),
318        201,
319    )
320    .await?;
321
322    let login_body = make_auth_request_raw(
323        "/auth/login",
324        &json!({
325            "username_or_email": username,
326            "password": "CorrectPassword123!"
327        }),
328        200,
329    )
330    .await?;
331    let user_id = login_body["user"]["id"]
332        .as_str()
333        .ok_or("Failed to get user ID")?
334        .to_string();
335
336    let timer = startup::create_timer();
337    make_auth_request_raw(
338        "/auth/delete",
339        &json!({
340            "username_or_email": username,
341            "password": "WrongPassword123!",
342            "user_id": user_id
343        }),
344        401,
345    )
346    .await?;
347    let endpoint_time = timer.elapsed();
348
349    let _ = cleanup_user(&username, "CorrectPassword123!", &user_id).await;
350    Ok(RobustnessTestResult { endpoint_time })
351}
352
353/// Test get user data with wrong password
354pub async fn test_get_user_data_wrong_password() -> Result<RobustnessTestResult, String> {
355    let username = get_test_username();
356
357    make_auth_request_raw(
358        "/auth/signup",
359        &json!({
360            "username": username,
361            "password": "CorrectPassword123!"
362        }),
363        201,
364    )
365    .await?;
366
367    let login_body = make_auth_request_raw(
368        "/auth/login",
369        &json!({
370            "username_or_email": username,
371            "password": "CorrectPassword123!"
372        }),
373        200,
374    )
375    .await?;
376    let user_id = login_body["user"]["id"]
377        .as_str()
378        .ok_or("Failed to get user ID")?
379        .to_string();
380
381    let timer = startup::create_timer();
382    make_auth_request_raw(
383        "/auth/me",
384        &json!({
385            "username_or_email": username,
386            "password": "WrongPassword123!",
387            "user_id": user_id,
388            "fields": ["username"]
389        }),
390        401,
391    )
392    .await?;
393    let endpoint_time = timer.elapsed();
394
395    let _ = cleanup_user(&username, "CorrectPassword123!", &user_id).await;
396    Ok(RobustnessTestResult { endpoint_time })
397}
398
399/// Test logout with invalid refresh token
400pub async fn test_logout_invalid_token() -> Result<RobustnessTestResult, String> {
401    let username = get_test_username();
402
403    make_auth_request_raw(
404        "/auth/signup",
405        &json!({
406            "username": username,
407            "password": "TestPassword123!"
408        }),
409        201,
410    )
411    .await?;
412
413    let login_body = make_auth_request_raw(
414        "/auth/login",
415        &json!({
416            "username_or_email": username,
417            "password": "TestPassword123!"
418        }),
419        200,
420    )
421    .await?;
422    let user_id = login_body["user"]["id"]
423        .as_str()
424        .ok_or("Failed to get user ID")?
425        .to_string();
426
427    let timer = startup::create_timer();
428    make_auth_request_raw(
429        "/auth/logout",
430        &json!({
431            "user_id": user_id,
432            "refresh_token": "not-a-valid-token"
433        }),
434        401,
435    )
436    .await?;
437    let endpoint_time = timer.elapsed();
438
439    let _ = cleanup_user(&username, "TestPassword123!", &user_id).await;
440    Ok(RobustnessTestResult { endpoint_time })
441}
442
443//Test updating profile username with an empty field
444pub async fn test_update_profile_empty_username() -> Result<RobustnessTestResult, String> {
445    let username = get_test_username();
446
447    make_auth_request_raw(
448        "/auth/signup",
449        &json!({
450            "username": username,
451            "password": "TestPassword123!"
452        }),
453        201,
454    )
455    .await?;
456
457    let login_body = make_auth_request_raw(
458        "/auth/login",
459        &json!({
460            "username_or_email": username,
461            "password": "TestPassword123!"
462        }),
463        200,
464    )
465    .await?;
466    let user_id = login_body["user"]["id"]
467        .as_str()
468        .ok_or("Failed to get user ID")?
469        .to_string();
470
471    let timer = startup::create_timer();
472    make_auth_request_raw(
473        "/auth/updateuserprofile",
474        &json!({
475            "user_id": user_id,
476            "username": ""
477        }),
478        400,
479    )
480    .await?;
481    let endpoint_time = timer.elapsed();
482
483    let _ = cleanup_user(&username, "TestPassword123!", &user_id).await;
484    Ok(RobustnessTestResult { endpoint_time })
485}
quorum_public/tests/robust/auth_tests.rs

quorum_public/tests/robust/
auth_tests.rs
