Identity and users#

from wreath import Request, Wreath
from wreath.auth import BearerTokenBackend, Identity, authenticated, public


identities = {
    "dev-alice": Identity("alice", roles=frozenset({"member"})),
    "dev-operator": Identity("operator", roles=frozenset({"operator"})),
}


def verify_token(token: str) -> Identity | None:
    return identities.get(token)


app = Wreath(require_access_declarations=True)
app.configure_auth(BearerTokenBackend(verify_token))


@app.get("/health")
@public()
async def health(request: Request) -> dict:
    return {"status": "ok"}


@app.get("/me")
@authenticated()
async def me(request: Request) -> dict:
    return {
        "id": request.identity.id,
        "roles": sorted(request.identity.roles),
    }

from wreath.testing import TestClient

from app import app


async def test_public_work_does_not_need_credentials() -> None:
    async with TestClient(app) as client:
        response = await client.get("/health")
    assert response.status == 200


async def test_private_work_challenges_then_publishes_identity() -> None:
    async with TestClient(app) as client:
        missing = await client.get("/me")
        invalid = await client.get(
            "/me",
            headers={"authorization": "Bearer unknown"},
        )
        allowed = await client.get(
            "/me",
            headers={"authorization": "Bearer dev-operator"},
        )

    assert missing.status == invalid.status == 401
    assert allowed.json() == {"id": "operator", "roles": ["operator"]}