test/test_public_verify_routes.py

import base64
import json
import unittest

from fastapi import FastAPI
from fastapi.testclient import TestClient

import szl_public_verify


class PublicVerifyRouteTests(unittest.TestCase):
    def setUp(self):
        self.app = FastAPI()

        @self.app.api_route("/api/a11oy/{path:path}", methods=["GET", "POST"])
        async def proxy_catch_all(path: str):
            return {"caught_by": "proxy", "path": path}

        szl_public_verify.register(self.app, ns="a11oy")
        self.client = TestClient(self.app)

    def test_exact_routes_are_before_proxy(self):
        paths = [getattr(route, "path", None) for route in self.app.router.routes]
        self.assertLess(paths.index("/api/a11oy/v1/verify/receipt"),
                        paths.index("/api/a11oy/{path:path}"))

    def test_get_exact_path_returns_manifest(self):
        response = self.client.get("/api/a11oy/v1/verify/receipt")
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.json()["schema"],
                         "szl.public-receipt-verifier/manifest/v1")

    def test_post_exact_path_reaches_verifier(self):
        response = self.client.post("/api/a11oy/v1/verify/receipt", json={})
        self.assertEqual(response.status_code, 400)
        self.assertNotIn("caught_by", response.json())

    def test_in_image_receipt_uses_runtime_verifier(self):
        self.app.state.szl_verify_receipt = lambda envelope: {
            "signature_valid": True, "detail": "verified by test runtime key"}
        payload = base64.b64encode(json.dumps({"decision": "proposal"}).encode()).decode()
        envelope = {
            "payloadType": "application/vnd.szl.receipt+json",
            "payload": payload,
            "signatures": [{"keyid": "a11oy-inimage-ecdsa-p256", "sig": "test"}],
        }
        response = self.client.post("/api/a11oy/v1/verify/receipt",
                                    json={"envelope": envelope})
        self.assertEqual(response.status_code, 200)
        signature = response.json()["checks"][0]
        self.assertEqual(signature["status"], "VERIFIED")
        self.assertEqual(signature["verify_key_url"], "/cosign.pub")


if __name__ == "__main__":
    unittest.main()