11 lines
397 B
Python
11 lines
397 B
Python
from app.config import settings
|
|
from app.utils.security import create_access_token, decode_token
|
|
|
|
|
|
def test_jwt_round_trip_and_tamper_rejection(monkeypatch):
|
|
monkeypatch.setattr(settings, "SECRET_KEY", "x" * 32)
|
|
token = create_access_token({"user_id": "user-1", "role": "manager"})
|
|
|
|
assert decode_token(token)["user_id"] == "user-1"
|
|
assert decode_token(f"{token}tampered") is None
|