|
| 1 | +from __future__ import annotations |
| 2 | + |
| 3 | +import pytest |
| 4 | +import requests |
| 5 | +from simple_logger.logger import get_logger |
| 6 | + |
| 7 | +from tests.model_serving.maas_billing.maas_subscription.utils import ( |
| 8 | + create_api_key, |
| 9 | + get_api_key, |
| 10 | + list_api_keys, |
| 11 | +) |
| 12 | +from utilities.general import generate_random_name |
| 13 | + |
| 14 | +LOGGER = get_logger(name=__name__) |
| 15 | + |
| 16 | + |
| 17 | +@pytest.mark.usefixtures( |
| 18 | + "maas_subscription_controller_enabled_latest", |
| 19 | + "maas_gateway_api", |
| 20 | + "maas_api_gateway_reachable", |
| 21 | +) |
| 22 | +class TestAPIKeyCRUD: |
| 23 | + """Tests for MaaS API key lifecycle: create, list, and revoke.""" |
| 24 | + |
| 25 | + @pytest.mark.tier1 |
| 26 | + @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "admin"}], indirect=True) |
| 27 | + def test_create_api_key( |
| 28 | + self, |
| 29 | + request_session_http: requests.Session, |
| 30 | + base_url: str, |
| 31 | + ocp_token_for_actor: str, |
| 32 | + ) -> None: |
| 33 | + """Verify API key creation and show-once behavior.""" |
| 34 | + |
| 35 | + key_name = f"e2e-crud-create-{generate_random_name()}" |
| 36 | + |
| 37 | + _, body = create_api_key( |
| 38 | + base_url=base_url, |
| 39 | + ocp_user_token=ocp_token_for_actor, |
| 40 | + request_session_http=request_session_http, |
| 41 | + api_key_name=key_name, |
| 42 | + ) |
| 43 | + |
| 44 | + for field in ("id", "key", "name"): |
| 45 | + assert field in body, f"Expected '{field}' field in create response" |
| 46 | + |
| 47 | + key = body["key"] |
| 48 | + assert key.startswith("sk-oai-"), "Expected key to start with 'sk-oai-' prefix" |
| 49 | + assert len(key) > len("sk-oai-"), "Key body after prefix must not be empty" |
| 50 | + |
| 51 | + LOGGER.info(f"[create] Created key id={body['id']}, key_prefix=sk-oai-***") |
| 52 | + |
| 53 | + get_resp, get_body = get_api_key( |
| 54 | + request_session_http=request_session_http, |
| 55 | + base_url=base_url, |
| 56 | + key_id=body["id"], |
| 57 | + ocp_user_token=ocp_token_for_actor, |
| 58 | + ) |
| 59 | + assert get_resp.status_code == 200, ( |
| 60 | + f"Expected 200 on GET /v1/api-keys/{body['id']}, got {get_resp.status_code}: {get_resp.text[:200]}" |
| 61 | + ) |
| 62 | + assert "key" not in get_body, "Plaintext key must not be returned by GET after creation (show-once pattern)" |
| 63 | + |
| 64 | + @pytest.mark.tier1 |
| 65 | + @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "admin"}], indirect=True) |
| 66 | + def test_list_api_keys( |
| 67 | + self, |
| 68 | + request_session_http: requests.Session, |
| 69 | + base_url: str, |
| 70 | + ocp_token_for_actor: str, |
| 71 | + two_active_api_key_ids: list[str], |
| 72 | + ) -> None: |
| 73 | + """Verify active API keys are listed and no plaintext key is exposed.""" |
| 74 | + |
| 75 | + list_resp, list_body = list_api_keys( |
| 76 | + request_session_http=request_session_http, |
| 77 | + base_url=base_url, |
| 78 | + ocp_user_token=ocp_token_for_actor, |
| 79 | + filters={"status": ["active"]}, |
| 80 | + sort={"by": "created_at", "order": "desc"}, |
| 81 | + pagination={"limit": 50, "offset": 0}, |
| 82 | + ) |
| 83 | + assert list_resp.status_code == 200, ( |
| 84 | + f"Expected 200 on POST /v1/api-keys/search, got {list_resp.status_code}: {list_resp.text[:200]}" |
| 85 | + ) |
| 86 | + |
| 87 | + items: list[dict] = list_body.get("items") or list_body.get("data") or [] |
| 88 | + assert len(items) >= 2, f"Expected at least 2 active keys, got {len(items)}" |
| 89 | + |
| 90 | + key_ids = [item["id"] for item in items] |
| 91 | + for created_id in two_active_api_key_ids: |
| 92 | + assert created_id in key_ids, f"Created key id={created_id} not found in listed keys" |
| 93 | + |
| 94 | + for item in items: |
| 95 | + assert "key" not in item, f"Plaintext key must not appear in any list item: {item}" |
| 96 | + |
| 97 | + LOGGER.info(f"[list] Found {len(items)} active keys") |
| 98 | + |
| 99 | + @pytest.mark.tier1 |
| 100 | + @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "admin"}], indirect=True) |
| 101 | + def test_list_api_keys_pagination( |
| 102 | + self, |
| 103 | + request_session_http: requests.Session, |
| 104 | + base_url: str, |
| 105 | + ocp_token_for_actor: str, |
| 106 | + ) -> None: |
| 107 | + """Verify that the search endpoint respects the pagination limit.""" |
| 108 | + |
| 109 | + page_resp, page_body = list_api_keys( |
| 110 | + request_session_http=request_session_http, |
| 111 | + base_url=base_url, |
| 112 | + ocp_user_token=ocp_token_for_actor, |
| 113 | + filters={"status": ["active"]}, |
| 114 | + sort={"by": "created_at", "order": "desc"}, |
| 115 | + pagination={"limit": 1, "offset": 0}, |
| 116 | + ) |
| 117 | + assert page_resp.status_code == 200, ( |
| 118 | + f"Expected 200 on paginated search, got {page_resp.status_code}: {page_resp.text[:200]}" |
| 119 | + ) |
| 120 | + paged_items: list[dict] = page_body.get("items") or page_body.get("data") or [] |
| 121 | + assert len(paged_items) <= 1, f"Expected at most 1 item with limit=1, got {len(paged_items)}" |
| 122 | + LOGGER.info(f"[list] Pagination limit=1 returned {len(paged_items)} item(s)") |
| 123 | + |
| 124 | + @pytest.mark.tier1 |
| 125 | + @pytest.mark.parametrize("ocp_token_for_actor", [{"type": "admin"}], indirect=True) |
| 126 | + def test_revoke_api_key( |
| 127 | + self, |
| 128 | + request_session_http: requests.Session, |
| 129 | + base_url: str, |
| 130 | + ocp_token_for_actor: str, |
| 131 | + revoked_api_key_id: str, |
| 132 | + ) -> None: |
| 133 | + """Verify a revoked API key shows status='revoked' on subsequent GET.""" |
| 134 | + |
| 135 | + get_resp, get_body = get_api_key( |
| 136 | + request_session_http=request_session_http, |
| 137 | + base_url=base_url, |
| 138 | + key_id=revoked_api_key_id, |
| 139 | + ocp_user_token=ocp_token_for_actor, |
| 140 | + ) |
| 141 | + assert get_resp.status_code == 200, ( |
| 142 | + f"Expected 200 on GET after revoke, got {get_resp.status_code}: {get_resp.text[:200]}" |
| 143 | + ) |
| 144 | + assert get_body.get("status") == "revoked", f"Expected status='revoked' on GET after revoke, got: {get_body}" |
| 145 | + LOGGER.info(f"[revoke] Key {revoked_api_key_id} confirmed revoked") |
0 commit comments