390 lines
23 KiB
Python
390 lines
23 KiB
Python
"""Patient reauthentication/keepalive use only synthetic HTTP and memory settings."""
|
|
import copy
|
|
import io
|
|
import json
|
|
import unittest
|
|
import urllib.error
|
|
from unittest import mock
|
|
|
|
import backend_client as client
|
|
|
|
|
|
class PatientHttpErrors(unittest.TestCase):
|
|
def request_error(self, status, body, path=None):
|
|
error = urllib.error.HTTPError('https://synthetic.invalid/path', status, 'synthetic', {},
|
|
io.BytesIO(json.dumps(body, ensure_ascii=False).encode('utf-8')))
|
|
with mock.patch.object(client.urllib.request, 'urlopen', side_effect=error):
|
|
try:
|
|
client._request('GET', 'https://synthetic.invalid', path or client.DESKTOP_PATIENT_SEARCH_PATH)
|
|
except client.BackendError as exc:
|
|
return exc
|
|
self.fail('expected synthetic HTTP error')
|
|
|
|
def test_structured_patient_expiry_preserves_type_code_and_message(self):
|
|
error = self.request_error(409, {'detail': {'code': 'zyt_session_expired', 'message': 'synthetic expired'}})
|
|
self.assertIsInstance(error, client.PatientSessionExpired)
|
|
self.assertNotIsInstance(error, client.AuthenticationError)
|
|
self.assertEqual(error.status, 409)
|
|
self.assertEqual(error.code, 'zyt_session_expired')
|
|
self.assertEqual(str(error), 'synthetic expired')
|
|
|
|
def test_exact_legacy_expiry_only_on_patient_routes(self):
|
|
for path in (client.DESKTOP_PATIENT_CONTEXT_PATH, client.DESKTOP_PATIENT_SEARCH_PATH + '?keyword=synthetic',
|
|
client.DESKTOP_PATIENT_BINDING_PATH):
|
|
with self.subTest(path=path):
|
|
self.assertIsInstance(self.request_error(502, {'detail': '登录超时，请重新登录'}, path),
|
|
client.PatientSessionExpired)
|
|
for path in (client.DESKTOP_ME_PATH, '/api/v2/model/calls'):
|
|
self.assertNotIsInstance(self.request_error(502, {'detail': '登录超时，请重新登录'}, path),
|
|
client.PatientSessionExpired)
|
|
|
|
def test_network_timeout_or_different_http_failure_is_not_patient_expiry(self):
|
|
for status, text in ((502, '网络请求超时'), (400, '登录超时，请重新登录'), (502, 'patient permission denied')):
|
|
error = self.request_error(status, {'detail': text})
|
|
self.assertNotIsInstance(error, client.PatientSessionExpired)
|
|
self.assertNotIsInstance(error, client.AuthenticationError)
|
|
|
|
def test_patient_permission_denied_is_not_desktop_revocation(self):
|
|
error = self.request_error(403, {'detail': {'code': 'permission_denied', 'message': 'synthetic denied'}})
|
|
self.assertEqual(error.status, 403)
|
|
self.assertEqual(error.code, 'permission_denied')
|
|
self.assertNotIsInstance(error, client.AuthenticationError)
|
|
self.assertNotIsInstance(error, client.PatientSessionExpired)
|
|
|
|
def test_desktop_revocation_stays_authentication_error(self):
|
|
error = self.request_error(401, {'detail': 'synthetic revoked'})
|
|
self.assertIsInstance(error, client.AuthenticationError)
|
|
self.assertNotIsInstance(error, client.PatientSessionExpired)
|
|
|
|
def test_structured_generic_error_is_readable(self):
|
|
error = self.request_error(409, {'detail': {'code': 'other_conflict', 'message': 'synthetic conflict'}})
|
|
self.assertEqual(str(error), 'synthetic conflict')
|
|
self.assertEqual(error.code, 'other_conflict')
|
|
|
|
|
|
class PatientSessionClientTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.store = {
|
|
'server_url': 'https://synthetic.invalid', 'zyt_api_url': 'https://identity.invalid',
|
|
'zyt_account': 'synthetic-admin', 'desktop_token_protected': 'sealed:desktop-original',
|
|
'zyt_token_protected': 'sealed:zyt-old', 'desktop_expires_at': 5000,
|
|
'desktop_account': {'id': 7}, 'remember_login': True,
|
|
'remembered_password_protected': 'sealed:remembered-original',
|
|
'model_plan': {'roles': {'judge_mode': 'shadow'}}, 'gateway': {'enabled': True},
|
|
'last_error': '',
|
|
}
|
|
self.saved = []
|
|
def save(settings):
|
|
self.store = copy.deepcopy(settings)
|
|
self.saved.append(copy.deepcopy(settings))
|
|
self.enterContext(mock.patch.object(client, 'load_settings', side_effect=lambda: copy.deepcopy(self.store)))
|
|
self.enterContext(mock.patch.object(client, 'save_settings', side_effect=save))
|
|
self.enterContext(mock.patch.object(client, '_protect_secret', side_effect=lambda value: 'sealed:' + value))
|
|
self.enterContext(mock.patch.object(client, '_unprotect_secret', side_effect=lambda value: str(value or '').removeprefix('sealed:')))
|
|
self.enterContext(mock.patch.object(client.time, 'time', return_value=1000))
|
|
self.enterContext(mock.patch.object(client, 'is_frozen', return_value=False))
|
|
self.enterContext(mock.patch.object(client.urllib.request, 'urlopen', side_effect=AssertionError('real network forbidden')))
|
|
self.request = self.enterContext(mock.patch.object(client, '_request', side_effect=self.response))
|
|
self.login = self.enterContext(mock.patch.object(client, '_zyt_login', return_value=('zyt-new', {'id': 7})))
|
|
self.exchange = self.enterContext(mock.patch.object(client, '_exchange_desktop_token', side_effect=AssertionError('desktop exchange forbidden')))
|
|
self.logout = self.enterContext(mock.patch.object(client, 'desktop_logout', side_effect=AssertionError('logout forbidden')))
|
|
self.keepalive_original = dict(client._PATIENT_KEEPALIVE_LAST)
|
|
client._PATIENT_KEEPALIVE_LAST.clear()
|
|
self.addCleanup(self.restore_keepalive)
|
|
self.identity_result = {'code': 1, 'data': {'status': 'active'}}
|
|
|
|
def restore_keepalive(self):
|
|
client._PATIENT_KEEPALIVE_LAST.clear()
|
|
client._PATIENT_KEEPALIVE_LAST.update(self.keepalive_original)
|
|
|
|
def response(self, method, server, path, **kwargs):
|
|
if path == client.DESKTOP_ME_PATH:
|
|
return 200, {'id': 7, 'expires_at': 9000}
|
|
if path == client.DESKTOP_AUTH_CONFIG_PATH:
|
|
return 200, {'zyt_api_url': 'https://identity.invalid', 'terminal': 7}
|
|
if path == client.DESKTOP_ZYT_SESSION_PATH:
|
|
return 200, {'ok': True}
|
|
if path == '/adminapi/desktop/session':
|
|
return 200, copy.deepcopy(self.identity_result)
|
|
raise AssertionError('unexpected synthetic route: ' + path)
|
|
|
|
def test_explicit_reauthentication_updates_only_upstream_token_after_server_ack(self):
|
|
result = client.reauthenticate_patient_session('typed-once')
|
|
self.assertEqual(result, {'ok': True})
|
|
self.login.assert_called_once_with('https://identity.invalid', 'synthetic-admin', 'typed-once')
|
|
route_call = next(call for call in self.request.call_args_list if call.args[2] == client.DESKTOP_ZYT_SESSION_PATH)
|
|
self.assertEqual(route_call.kwargs['token'], 'desktop-original')
|
|
self.assertEqual(route_call.kwargs['payload'], {'zyt_token': 'zyt-new'})
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-new')
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:desktop-original')
|
|
self.assertEqual(self.store['remembered_password_protected'], 'sealed:remembered-original')
|
|
self.assertNotIn('typed-once', repr(self.saved))
|
|
self.exchange.assert_not_called()
|
|
self.logout.assert_not_called()
|
|
|
|
def test_no_password_does_not_use_remembered_password_or_network(self):
|
|
with self.assertRaises(ValueError):
|
|
client.reauthenticate_patient_session('')
|
|
self.request.assert_not_called()
|
|
self.login.assert_not_called()
|
|
|
|
def test_desktop_revoked_prevents_upstream_login_and_any_exchange(self):
|
|
self.request.side_effect = client.AuthenticationError('synthetic revoked', status=401)
|
|
with self.assertRaises(client.AuthenticationError):
|
|
client.reauthenticate_patient_session('typed-once')
|
|
self.login.assert_not_called()
|
|
self.exchange.assert_not_called()
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-old')
|
|
|
|
def test_upstream_password_failure_does_not_logout_or_save_password(self):
|
|
self.login.side_effect = client.AuthenticationError('synthetic invalid password')
|
|
with self.assertRaises(client.AuthenticationError):
|
|
client.reauthenticate_patient_session('wrong')
|
|
self.assertFalse(any(call.args[2] == client.DESKTOP_ZYT_SESSION_PATH for call in self.request.call_args_list))
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-old')
|
|
self.logout.assert_not_called()
|
|
|
|
def test_server_rejects_new_credential_no_local_update(self):
|
|
def response(method, server, path, **kwargs):
|
|
if path == client.DESKTOP_ZYT_SESSION_PATH:
|
|
raise client.BackendError('synthetic account mismatch', status=403)
|
|
return self.response(method, server, path, **kwargs)
|
|
self.request.side_effect = response
|
|
with self.assertRaises(client.BackendError):
|
|
client.reauthenticate_patient_session('typed-once')
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-old')
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:desktop-original')
|
|
|
|
def test_session_switch_during_upstream_login_aborts_before_server_update(self):
|
|
def login(*args):
|
|
self.store.update(zyt_account='second-admin', desktop_token_protected='sealed:second-desktop',
|
|
zyt_token_protected='sealed:second-zyt', server_url='https://second.invalid')
|
|
return 'zyt-new', {}
|
|
self.login.side_effect = login
|
|
with self.assertRaises(client.BackendError) as caught:
|
|
client.reauthenticate_patient_session('typed-once')
|
|
self.assertEqual(caught.exception.code, 'session_changed')
|
|
self.assertFalse(any(call.args[2] == client.DESKTOP_ZYT_SESSION_PATH for call in self.request.call_args_list))
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:second-zyt')
|
|
|
|
def test_logout_during_server_update_cannot_restore_patient_token(self):
|
|
def response(method, server, path, **kwargs):
|
|
if path == client.DESKTOP_ZYT_SESSION_PATH:
|
|
self.store.update(desktop_token_protected='', zyt_token_protected='', desktop_account={})
|
|
return 200, {'ok': True}
|
|
return self.response(method, server, path, **kwargs)
|
|
self.request.side_effect = response
|
|
with self.assertRaises(client.BackendError):
|
|
client.reauthenticate_patient_session('typed-once')
|
|
self.assertEqual(self.store['zyt_token_protected'], '')
|
|
self.assertEqual(self.store['desktop_token_protected'], '')
|
|
|
|
def test_fetch_auth_config_without_persist_does_not_change_session(self):
|
|
previous = copy.deepcopy(self.store)
|
|
result = client.fetch_desktop_auth_config(self.store['server_url'], persist=False)
|
|
self.assertEqual(result['terminal'], 7)
|
|
self.assertEqual(self.store, previous)
|
|
self.assertFalse(self.saved)
|
|
|
|
def test_old_heartbeat_success_merges_without_overwriting_new_patient_token(self):
|
|
def response(*args, **kwargs):
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-concurrently-new'
|
|
self.store['gateway'] = {'enabled': True, 'url': 'https://newgateway.invalid'}
|
|
return 200, {'id': 7, 'expires_at': 9500}
|
|
self.request.side_effect = response
|
|
client.validate_desktop_session()
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-concurrently-new')
|
|
self.assertEqual(self.store['gateway']['url'], 'https://newgateway.invalid')
|
|
self.assertEqual(self.store['desktop_expires_at'], 9500)
|
|
|
|
def test_old_heartbeat_network_error_preserves_new_patient_token(self):
|
|
def response(*args, **kwargs):
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-concurrently-new'
|
|
raise client.BackendError('synthetic network timeout')
|
|
self.request.side_effect = response
|
|
with self.assertRaises(client.BackendError):
|
|
client.validate_desktop_session()
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-concurrently-new')
|
|
|
|
def test_old_heartbeat_after_logout_or_new_login_cannot_revive_old_session(self):
|
|
for error in (None, client.AuthenticationError('synthetic old revoked', status=401)):
|
|
with self.subTest(error=error is not None):
|
|
self.store['desktop_token_protected'] = 'sealed:desktop-before'
|
|
def response(*args, **kwargs):
|
|
self.store.update(desktop_token_protected='sealed:desktop-after', desktop_account={'id': 88})
|
|
if error:
|
|
raise error
|
|
return 200, {'id': 7, 'expires_at': 9500}
|
|
self.request.side_effect = response
|
|
with self.assertRaises(client.BackendError) as caught:
|
|
client.validate_desktop_session()
|
|
self.assertNotIsInstance(caught.exception, client.AuthenticationError)
|
|
self.assertEqual(caught.exception.code, 'session_changed')
|
|
self.assertEqual(self.store['desktop_account']['id'], 88)
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:desktop-after')
|
|
|
|
def test_patient_search_and_bind_preserve_expiry_type(self):
|
|
self.request.side_effect = client.PatientSessionExpired(status=409)
|
|
for operation in (lambda: client.search_desktop_patients('synthetic'),
|
|
lambda: client.bind_desktop_patient('account', 'conv', 1)):
|
|
with self.assertRaises(client.PatientSessionExpired):
|
|
operation()
|
|
self.login.assert_not_called()
|
|
self.logout.assert_not_called()
|
|
|
|
def test_keepalive_uses_original_custom_token_without_login_or_exchange(self):
|
|
result = client.keepalive_zyt_session()
|
|
self.assertEqual(result, {'status': 'active'})
|
|
call = next(call for call in self.request.call_args_list if call.args[2] == '/adminapi/desktop/session')
|
|
self.assertEqual(call.args[:2], ('GET', 'https://identity.invalid'))
|
|
self.assertTrue(call.kwargs['identity_service'])
|
|
self.assertEqual(call.kwargs['extra_headers'], {'token': 'zyt-old'})
|
|
self.assertNotIn('token', call.kwargs)
|
|
self.login.assert_not_called()
|
|
self.exchange.assert_not_called()
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-old')
|
|
|
|
def test_keepalive_expiry_is_local_status_not_forced_logout(self):
|
|
self.identity_result = {'code': -1, 'msg': '登录超时，请重新登录'}
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'expired')
|
|
self.logout.assert_not_called()
|
|
self.login.assert_not_called()
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:desktop-original')
|
|
|
|
def test_keepalive_permission_network_and_missing_route_are_distinct(self):
|
|
cases = [(client.AuthenticationError('synthetic denied', status=403), 'forbidden'),
|
|
(client.AuthenticationError('synthetic expired', status=401), 'expired'),
|
|
(client.BackendError('synthetic offline'), 'unreachable'),
|
|
(client.BackendError('synthetic not deployed', status=404), 'unsupported')]
|
|
for failure, expected in cases:
|
|
with self.subTest(expected=expected):
|
|
client._PATIENT_KEEPALIVE_LAST.clear()
|
|
def response(method, server, path, **kwargs):
|
|
if path == '/adminapi/desktop/session':
|
|
raise failure
|
|
return self.response(method, server, path, **kwargs)
|
|
self.request.side_effect = response
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], expected)
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-old')
|
|
self.logout.assert_not_called()
|
|
|
|
def test_keepalive_requires_valid_desktop_before_upstream_request(self):
|
|
self.request.side_effect = client.AuthenticationError('synthetic desktop revoked', status=401)
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'desktop_invalid')
|
|
self.assertEqual(len(self.request.call_args_list), 1)
|
|
self.assertEqual(self.request.call_args.args[2], client.DESKTOP_ME_PATH)
|
|
self.login.assert_not_called()
|
|
|
|
def test_keepalive_throttles_same_credentials_for_thirty_minutes(self):
|
|
with mock.patch.object(client.time, 'monotonic', side_effect=[100, 101, 1900]):
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'active')
|
|
self.assertEqual(client.keepalive_zyt_session()['reason'], 'throttled')
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'active')
|
|
self.assertEqual(sum(call.args[2] == '/adminapi/desktop/session' for call in self.request.call_args_list), 2)
|
|
|
|
def test_keepalive_in_progress_does_not_start_another_request(self):
|
|
client._PATIENT_KEEPALIVE_LOCK.acquire()
|
|
try:
|
|
self.assertEqual(client.keepalive_zyt_session()['reason'], 'in_progress')
|
|
self.request.assert_not_called()
|
|
finally:
|
|
client._PATIENT_KEEPALIVE_LOCK.release()
|
|
|
|
def test_old_keepalive_cannot_report_new_credential_expired(self):
|
|
def response(method, server, path, **kwargs):
|
|
if path == '/adminapi/desktop/session':
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-concurrently-new'
|
|
return 200, {'code': -1, 'msg': '登录超时，请重新登录'}
|
|
return self.response(method, server, path, **kwargs)
|
|
self.request.side_effect = response
|
|
self.assertEqual(client.keepalive_zyt_session(), {'status': 'skipped', 'reason': 'session_changed'})
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-concurrently-new')
|
|
|
|
def test_new_patient_token_is_not_throttled_by_old_expired_token(self):
|
|
self.identity_result = {'code': -1, 'msg': '登录超时，请重新登录'}
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'expired')
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-new'
|
|
self.identity_result = {'code': 1}
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'active')
|
|
|
|
|
|
def test_keepalive_exact_deployed_expiry_message(self):
|
|
self.identity_result = {'code': 0, 'msg': '登录已失效，请重新登录'}
|
|
self.assertEqual(client.keepalive_zyt_session()['status'], 'expired')
|
|
self.logout.assert_not_called()
|
|
self.login.assert_not_called()
|
|
|
|
def test_periodic_config_success_does_not_restore_stale_patient_credentials(self):
|
|
snapshot = copy.deepcopy(self.store)
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-concurrently-new'
|
|
self.store['remembered_password_protected'] = 'sealed:new-remembered'
|
|
with mock.patch('ai_config.apply_settings', return_value={}):
|
|
client._apply_config_response({'version': 4, 'config': {},
|
|
'gateway': {'url': 'https://gateway.invalid'}, 'roles': {}, 'models': []}, snapshot)
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-concurrently-new')
|
|
self.assertEqual(self.store['remembered_password_protected'], 'sealed:new-remembered')
|
|
self.assertEqual(self.store['last_version'], 4)
|
|
self.assertEqual(self.store['gateway']['url'], 'https://gateway.invalid')
|
|
|
|
def test_periodic_config_for_old_session_is_not_applied_after_account_change(self):
|
|
snapshot = copy.deepcopy(self.store)
|
|
self.store['desktop_token_protected'] = 'sealed:new-desktop'
|
|
with mock.patch('ai_config.apply_settings') as apply:
|
|
with self.assertRaises(client.BackendError):
|
|
client._apply_config_response({'version': 4, 'config': {}}, snapshot)
|
|
apply.assert_not_called()
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:new-desktop')
|
|
|
|
def test_periodic_config_failure_merges_only_error_without_old_token(self):
|
|
def fetch(*args):
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-concurrently-new'
|
|
raise client.BackendError('synthetic config timeout')
|
|
with mock.patch.object(client, '_fetch_desktop_config', side_effect=fetch):
|
|
with self.assertRaises(client.BackendError):
|
|
client.sync_cloud_config()
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-concurrently-new')
|
|
self.assertEqual(self.store['last_error'], 'synthetic config timeout')
|
|
|
|
def test_old_exchange_after_logout_cannot_revive_desktop_or_return_old_token(self):
|
|
self.store['desktop_expires_at'] = 0
|
|
def exchange(*args, **kwargs):
|
|
self.store.update(desktop_token_protected='', zyt_token_protected='', desktop_account={})
|
|
return {'access_token': 'stale-response', 'account': {'id': 7}, 'expires_in': 5000}
|
|
self.exchange.side_effect = exchange
|
|
self.assertEqual(client.desktop_access_token(), '')
|
|
self.assertEqual(self.store['desktop_token_protected'], '')
|
|
self.assertEqual(self.store['zyt_token_protected'], '')
|
|
|
|
def test_refreshing_desktop_token_preserves_concurrent_new_zyt_token(self):
|
|
self.store['desktop_expires_at'] = 0
|
|
def exchange(*args, **kwargs):
|
|
self.store['zyt_token_protected'] = 'sealed:zyt-concurrently-new'
|
|
return {'access_token': 'new-desktop', 'account': {'id': 7}, 'expires_in': 5000}
|
|
self.exchange.side_effect = exchange
|
|
self.assertEqual(client.desktop_access_token(), 'new-desktop')
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:zyt-concurrently-new')
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:new-desktop')
|
|
|
|
def test_restore_ignores_late_revocation_from_previous_session(self):
|
|
def validate(**kwargs):
|
|
self.store.update(desktop_token_protected='sealed:second-desktop', zyt_token_protected='sealed:second-zyt')
|
|
raise client.AuthenticationError('synthetic previous session revoked', status=401)
|
|
with mock.patch.object(client, 'validate_desktop_session', side_effect=validate):
|
|
self.assertIsNone(client.restore_desktop_session())
|
|
self.assertEqual(self.store['desktop_token_protected'], 'sealed:second-desktop')
|
|
self.assertEqual(self.store['zyt_token_protected'], 'sealed:second-zyt')
|
|
|
|
def test_patient_request_never_pairs_old_token_with_new_server(self):
|
|
def get_token():
|
|
self.store.update(server_url='https://second.invalid', desktop_token_protected='sealed:second-desktop')
|
|
return 'desktop-original'
|
|
with mock.patch.object(client, 'desktop_access_token', side_effect=get_token):
|
|
with self.assertRaises(client.BackendError) as caught:
|
|
client.search_desktop_patients('synthetic')
|
|
self.assertEqual(caught.exception.code, 'session_changed')
|
|
self.request.assert_not_called()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|