Add unit tests (#32)

* Add password validation tests and update devcontainer to run tests on start

* Add test to ensure tampered password fails verification

* Nest unit tests and rename `utility.py` -> `utils.py`

* Add initial routes module for organizing route handlers

* Add GitHub Actions workflow for testing across multiple Python versions and OS

* Refactor GitHub Actions workflow to combine dependency installation and testing steps

* Remove redundant test command from GitHub Actions workflow

* Update GitHub Actions workflow to run tests on multiple OS environments

* Refactor GitHub Actions workflow to consolidate OS matrix for testing

* Refactor GitHub Actions workflow to specify branch for push events and streamline test job configuration

* Rename workflow from "Python package" to "Pytest CI" and remove branch specification for push events

* Add Python 3.x to the testing matrix in GitHub Actions workflow

* Simplify Python version specification in GitHub Actions workflow to use "3.x"

* Update Python version specification to use a list format in GitHub Actions workflow

* Add descriptive comment for OS and Python versions in GitHub Actions workflow

* Revert "Add descriptive comment for OS and Python versions in GitHub Actions workflow"

This reverts commit 4eb0780.

* Add branch filter for main in GitHub Actions workflow

* Refactor imports in person.py and define __all__ in utils.py for better module management

* Add branch filter for main in Pytest CI workflow

* Add RunOnSave extension and configure pytest command for test files

* Update RunOnSave configuration to improve test file matching and output handling

* Add file exclusion settings for __pycache__ and .pytest_cache in VSCode

* Refactor utility imports and reorganize test structure

* Remove obsolete test for index route in test_home.py

* Refactor index route test to use a pytest fixture for the test client

* Add tests for email encryption and hashing utilities; refactor password hashing tests

* Refactor decrypt_email tests to separate type and value assertions

* Remove unused import of register_routes in test_routes initialization

* Refactor index route test to separate status code and JSON response assertions

* Update image upload folder path and ensure directory creation for new location

* Update picture route to use Config.IMAGES_FOLDER for file handling

* Rename upload folder from 'images' to 'pictures' in .gitignore

* Add tests for user registration with missing fields

* Update postStartCommand in devcontainer.json for verbose pytest output

* Add email validation to registration and update utility functions

* Add tests for user registration and login with missing fields

* Fix email validation regex and add comprehensive tests for valid and invalid email formats

* Add additional tests for email validation to cover edge cases

* Add docstring to extract_error_message for clarity on functionality

* Update email validation regex and add git fetch command in VSCode settings

* Add email masking functionality and corresponding tests

* Refactor authentication tests to use fixtures for sample data and improve test clarity

* Remove git fetch command from VSCode settings to streamline run-on-save functionality

* Remove verbosity from postStartCommand in devcontainer configuration

* Refactor JWT helper functions and add comprehensive tests for refresh token functionality

* Update GitHub Actions workflow to define permissions for test job

* Run Prettier

* Add utility tests for email and password handling, including hashing and masking

* Remove unused imports in refresh token test file

* Start adding tests for access token generation and create test fixtures

* Add tests for access token decoding and expiration validation

* Add tests for extracting and generating JWT refresh tokens

* Add fixtures and tests for access and refresh token handling

* Remove redundant tests for token extraction and validation

* Remove unused access token generation imports from test files

* Refactor imports in test_verify_token.py to remove unused functions

* Update routes/picture.py

Co-authored-by: Copilot <[email protected]>

* Fix test for missing username in registration by updating test data

* Enhance GitHub Actions workflow by adding descriptive job name for Pytest

* Fix test comment

* Update tests/test_jwt/test_refresh_access_token.py

Co-authored-by: Copilot <[email protected]>

* Improve JWT token tests

* Update tests/test_routes/test_authentication/test_login.py

Co-authored-by: Copilot <[email protected]>

* Fix test for missing password by changing username to email in test_login.py

* Refactor refresh token tests: consolidate and enhance test coverage

---------

Co-authored-by: Copilot <[email protected]>

Author: Vianpyro

.devcontainer/devcontainer.json

@@ -9,10 +9,11 @@
             "extensions": [
                 "ms-python.black-formatter",
                 "ms-python.python",
-                "ms-python.isort"
+                "ms-python.isort",
+                "emeraldwalk.RunOnSave"
             ]
         }
     },
-    "postStartCommand": "pip3 --disable-pip-version-check --no-cache-dir install -r requirements.txt --break-system-packages",
+    "postStartCommand": "pip3 --disable-pip-version-check --no-cache-dir install -r requirements.txt --break-system-packages && python3 -m pytest tests",
     "remoteUser": "vscode"
 }

.github/workflows/pytest.yml

@@ -0,0 +1,47 @@
+name: Pytest CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions: {}
+
+jobs:
+  test:
+    name: Pytest on ${{ matrix.os }} with Python ${{ matrix.python-version }}
+    runs-on: ${{ matrix.os }}
+
+    permissions:
+      contents: read
+      packages: read
+      statuses: write
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.x"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt
+          pip install pytest pytest-cov
+
+      - name: Run Pytest (Linux/macOS)
+        if: runner.os != 'Windows'
+        run: python -m pytest --doctest-modules --junitxml=junit/test-results.xml --cov=com --cov-report=xml --cov-report=html
+
+      - name: Run Pytest (Windows)
+        if: runner.os == 'Windows'
+        run: python -m pytest --doctest-modules --junitxml=junit/test-results.xml --cov=com --cov-report=xml --cov-report=html

.gitignore

@@ -2,7 +2,7 @@
 *.pem
 
 # Upload folder
-images/
+pictures/
 
 # Environment variables file
 .env

.vscode/settings.json

@@ -5,6 +5,10 @@
     "files.insertFinalNewline": true,
     "files.trimFinalNewlines": true,
     "files.trimTrailingWhitespace": true,
+    "files.exclude": {
+        "**/__pycache__": true,
+        "**/.pytest_cache": true
+    },
     "[python]": {
         "editor.rulers": [
             88
@@ -18,5 +22,14 @@
     "isort.args": [
         "--profile",
         "black"
-    ]
+    ],
+    "emeraldwalk.runonsave": {
+        "commands": [
+            {
+                "match": "tests[/\\\\](.*[/\\\\])?test_.*\\.py$",
+                "cmd": "python3 -m pytest '${relativeFile}' -v",
+                "autoShowOutputPanel": "error"
+            }
+        ]
+    }
 }

config.py

@@ -23,22 +23,16 @@ class Config:
     JWT_REFRESH_TOKEN_EXPIRY = timedelta(days=30)
 
     # Image upload folder
-    IMAGES_FOLDER = os.path.join(os.getcwd(), "images")
+    IMAGES_FOLDER = os.path.join(os.getcwd(), "pictures")
     MAX_CONTENT_LENGTH = 1024 * 1024  # 1 MB
 
 
-# Image upload folder
-PICTURE_FOLDER = os.path.join(os.getcwd(), "picture")
-
-if not os.path.exists(PICTURE_FOLDER):
-    os.makedirs(PICTURE_FOLDER)
+if not os.path.exists(Config.IMAGES_FOLDER):
+    os.makedirs(Config.IMAGES_FOLDER)
 
 # Pagination configuration
 DEFAULT_PAGE_SIZE = 10
 
-if not os.path.exists(Config.IMAGES_FOLDER):
-    os.makedirs(Config.IMAGES_FOLDER)
-
 limiter = Limiter(
     key_func=get_remote_address,
     default_limits=["1000 per day", "200 per hour", "30 per minute", "3 per second"],

jwt_helper.py

@@ -11,9 +11,7 @@
 
 
 class TokenError(Exception):
-    """
-    Custom exception for token-related errors.
-    """
+    """Custom exception for token-related errors."""
 
     def __init__(self, message, status_code):
         super().__init__(message)
@@ -22,9 +20,7 @@ def __init__(self, message, status_code):
 
 
 def generate_access_token(person_id: int) -> str:
-    """
-    Generate a short-lived JWT access token for a user.
-    """
+    """Generate a short-lived JWT access token for a user."""
     payload = {
         "person_id": person_id,
         "exp": datetime.now(timezone.utc) + JWT_ACCESS_TOKEN_EXPIRY,  # Expiration
@@ -35,9 +31,7 @@ def generate_access_token(person_id: int) -> str:
 
 
 def generate_refresh_token(person_id: int) -> str:
-    """
-    Generate a long-lived refresh token for a user.
-    """
+    """Generate a long-lived refresh token for a user."""
     payload = {
         "person_id": person_id,
         "exp": datetime.now(timezone.utc) + JWT_REFRESH_TOKEN_EXPIRY,
@@ -48,19 +42,15 @@ def generate_refresh_token(person_id: int) -> str:
 
 
 def extract_token_from_header() -> str:
-    """
-    Extract the Bearer token from the Authorization header.
-    """
+    """Extract the Bearer token from the Authorization header."""
     auth_header = request.headers.get("Authorization")
     if not auth_header or not auth_header.startswith("Bearer "):
         raise TokenError("Token is missing or improperly formatted", 401)
     return auth_header.split("Bearer ")[1]
 
 
 def verify_token(token: str, required_type: str) -> dict:
-    """
-    Verify and decode a JWT token.
-    """
+    """Verify and decode a JWT token."""
     try:
         decoded = jwt.decode(token, JWT_SECRET_KEY, algorithms=["HS256"])
         if decoded.get("token_type") != required_type:
@@ -73,9 +63,7 @@ def verify_token(token: str, required_type: str) -> dict:
 
 
 def token_required(f):
-    """
-    Decorator to protect routes by requiring a valid token.
-    """
+    """Decorator to protect routes by requiring a valid token."""
 
     @wraps(f)
     def decorated(*args, **kwargs):

requirements.txt

@@ -7,4 +7,5 @@ flask-cors>=4.0.1
 PyMySQL>=1.1.1
 requests>=2.32.3
 waitress>=3.0.0
+pytest>=8.3.5
 python-dotenv>=1.0.1

routes/authentication.py

@@ -15,6 +15,7 @@
     encrypt_email,
     hash_email,
     hash_password,
+    validate_email,
     validate_password,
     verify_password,
 )
@@ -47,6 +48,9 @@ def register():
     if not name or not email or not password:
         return jsonify(message="Username, email, and password are required"), 400
 
+    if not validate_email(email):
+        return jsonify(message="Invalid email address"), 400
+
     if not validate_password(password):
         return jsonify(message="Password does not meet security requirements"), 400
 

routes/picture.py

@@ -2,7 +2,7 @@
 
 from flask import Blueprint, jsonify, request, send_from_directory
 
-from config import PICTURE_FOLDER
+from config import Config
 from jwt_helper import token_required
 from utility import database_cursor
 
@@ -50,7 +50,7 @@ def get_pictures_by_author(author_id):
 
 @picture_blueprint.route("/<path:filename>", methods=["GET"])
 def get_picture(filename):
-    return send_from_directory(PICTURE_FOLDER, filename)
+    return send_from_directory(Config.IMAGES_FOLDER, filename)
 
 
 @picture_blueprint.route("", methods=["POST"])
@@ -80,8 +80,8 @@ def upload_picture():
     with database_cursor() as cursor:
         cursor.callproc(procedure, (hexname, request.person_id))
 
-    fullpath = os.path.normpath(os.path.join(PICTURE_FOLDER, hexname))
-    if not fullpath.startswith(PICTURE_FOLDER):
+    fullpath = os.path.abspath(os.path.join(Config.IMAGES_FOLDER, hexname))
+    if os.path.commonpath([fullpath, Config.IMAGES_FOLDER]) != Config.IMAGES_FOLDER:
         return jsonify({"error": "Invalid file path"}), 400
     file.save(fullpath)