Class ConfigServiceSecurityTests

tests/test_admin_security.py:160–221

class ConfigServiceSecurityTests(SettingsOverrideMixin, unittest.TestCase):
    def test_admin_password_update_rotates_jwt_secret(self):
        old_secret = "j" * 48
        settings.user_config = {
            **copy.deepcopy(DEFAULT_CONFIG),
            "admin_token": hash_password("old-admin-password"),
            "jwt_secret": old_secret,
        }
        original_key_value = admin_services.KeyValue
        original_refresh_settings = admin_services.refresh_settings
        admin_services.KeyValue = FakeKeyValue
        admin_services.refresh_settings = fake_refresh_settings
        FakeKeyValue.saved_value = None
        try:
            asyncio.run(ConfigService().update_config({"admin_token": "new-admin-password"}))
        finally:
            admin_services.KeyValue = original_key_value
            admin_services.refresh_settings = original_refresh_settings

        self.assertIsNotNone(FakeKeyValue.saved_value)
        self.assertTrue(verify_password("new-admin-password", FakeKeyValue.saved_value["admin_token"]))
        self.assertNotEqual(FakeKeyValue.saved_value["jwt_secret"], old_secret)
        self.assertGreaterEqual(len(FakeKeyValue.saved_value["jwt_secret"]), 32)

    def test_initialize_system_sets_admin_password_and_jwt_secret(self):
        original_key_value = core_config.KeyValue
        original_refresh_settings = core_config.refresh_settings
        FakeConfigKeyValue.record = FakeConfigRecord(
            {
                **copy.deepcopy(DEFAULT_CONFIG),
                "admin_token": "",
                "jwt_secret": "",
            }
        )
        FakeConfigKeyValue.saved_value = None
        core_config.KeyValue = FakeConfigKeyValue
        core_config.refresh_settings = fake_refresh_settings
        try:
            asyncio.run(
                core_config.initialize_system(
                    admin_password="new-admin-password",
                    site_name="我的文件快递柜",
                    setup_options={
                        "uploadSize": 50 * 1024 * 1024,
                        "errorCount": 6,
                        "expireStyle": ["day", "count"],
                    },
                )
            )
        finally:
            core_config.KeyValue = original_key_value
            core_config.refresh_settings = original_refresh_settings

        self.assertIsNotNone(FakeConfigKeyValue.saved_value)
        self.assertTrue(
            verify_password("new-admin-password", FakeConfigKeyValue.saved_value["admin_token"])
        )
        self.assertGreaterEqual(len(FakeConfigKeyValue.saved_value["jwt_secret"]), 32)