src/auth/routes.py : routes de réinitialisation du mot de passe (#73)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 22:50:20 +02:00
parent ff9b3a6092
commit 6b78abb7fd
2 changed files with 137 additions and 0 deletions
@@ -0,0 +1,84 @@
+from werkzeug.security import check_password_hash, generate_password_hash
+
+from src.auth import db, tokens
+
+
+def _make_user():
+    db.init_schema()
+    uid = db.create_user("a@b.c", generate_password_hash("old-password12"))
+    db.set_email_verified(uid)
+    return uid
+
+
+def test_request_reset_sends_email_for_existing_user(
+    client, mail_outbox, users_db_path
+):
+    _make_user()
+    resp = client.post("/auth/request-password-reset", data={"email": "a@b.c"})
+    assert resp.status_code == 302
+    assert "pending=1" in resp.headers["Location"]
+    assert len(mail_outbox) == 1
+
+
+def test_request_reset_same_response_for_unknown_email(
+    client, mail_outbox, users_db_path
+):
+    db.init_schema()
+    resp = client.post("/auth/request-password-reset", data={"email": "absent@b.c"})
+    assert "pending=1" in resp.headers["Location"]
+    assert len(mail_outbox) == 0
+
+
+def test_perform_reset_with_valid_token(client, users_db_path):
+    uid = _make_user()
+    token = tokens.create_password_reset_token(uid)
+    resp = client.post(
+        "/auth/reset-password",
+        data={
+            "token": token,
+            "password": "new-password12",
+            "password_confirm": "new-password12",
+        },
+    )
+    assert resp.status_code == 302
+    assert "password_changed=1" in resp.headers["Location"]
+    row = db.get_user_by_id(uid)
+    assert check_password_hash(row["password_hash"], "new-password12")
+
+
+def test_perform_reset_rejects_expired_token(client, users_db_path):
+    uid = _make_user()
+    token = tokens.create_password_reset_token(uid, expires_in_hours=-1)
+    resp = client.post(
+        "/auth/reset-password",
+        data={
+            "token": token,
+            "password": "new-password12",
+            "password_confirm": "new-password12",
+        },
+    )
+    assert "error=invalid_token" in resp.headers["Location"]
+
+
+def test_perform_reset_rejects_short_password(client, users_db_path):
+    uid = _make_user()
+    token = tokens.create_password_reset_token(uid)
+    resp = client.post(
+        "/auth/reset-password",
+        data={"token": token, "password": "short", "password_confirm": "short"},
+    )
+    assert "error=password_too_short" in resp.headers["Location"]
+
+
+def test_perform_reset_rejects_mismatched(client, users_db_path):
+    uid = _make_user()
+    token = tokens.create_password_reset_token(uid)
+    resp = client.post(
+        "/auth/reset-password",
+        data={
+            "token": token,
+            "password": "new-password12",
+            "password_confirm": "other-password99",
+        },
+    )
+    assert "error=password_mismatch" in resp.headers["Location"]