src/auth/tokens.py : génération et validation des tokens (#73)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/auth/test_tokens.py

@@ -0,0 +1,68 @@
+from src.auth import db
+from src.auth.tokens import (
+    consume_password_reset_token,
+    consume_verification_token,
+    create_password_reset_token,
+    create_verification_token,
+    hash_token,
+)
+
+
+def test_hash_token_is_stable():
+    t = "abc123"
+    assert hash_token(t) == hash_token(t)
+    assert hash_token(t) != hash_token("abc124")
+    assert len(hash_token(t)) == 64  # sha256 hex
+
+
+def test_create_verification_token_returns_plain_token(users_db_path):
+    db.init_schema()
+    uid = db.create_user("a@b.c", "h")
+    plain = create_verification_token(uid)
+    assert isinstance(plain, str)
+    assert len(plain) >= 32
+    # stocké en DB sous forme hashée
+    row = db.find_email_verification_token(hash_token(plain))
+    assert row is not None
+    assert row["user_id"] == uid
+
+
+def test_consume_verification_token_succeeds_once(users_db_path):
+    db.init_schema()
+    uid = db.create_user("a@b.c", "h")
+    plain = create_verification_token(uid)
+    user_id = consume_verification_token(plain)
+    assert user_id == uid
+    # usage unique : les tokens de cet user sont supprimés
+    assert consume_verification_token(plain) is None
+
+
+def test_consume_invalid_verification_token(users_db_path):
+    db.init_schema()
+    assert consume_verification_token("n-existe-pas") is None
+
+
+def test_verification_token_expires(users_db_path, monkeypatch):
+    db.init_schema()
+    uid = db.create_user("a@b.c", "h")
+    plain = create_verification_token(uid, expires_in_hours=-1)
+    assert consume_verification_token(plain) is None
+
+
+def test_create_password_reset_token_deletes_previous(users_db_path):
+    db.init_schema()
+    uid = db.create_user("a@b.c", "h")
+    old = create_password_reset_token(uid)
+    new = create_password_reset_token(uid)
+    # l'ancien a été supprimé
+    assert consume_password_reset_token(old) is None
+    # le nouveau fonctionne
+    assert consume_password_reset_token(new) == uid
+
+
+def test_consume_password_reset_token_is_single_use(users_db_path):
+    db.init_schema()
+    uid = db.create_user("a@b.c", "h")
+    plain = create_password_reset_token(uid)
+    assert consume_password_reset_token(plain) == uid
+    assert consume_password_reset_token(plain) is None