Authorization Feature

tests/unit/test_authentication.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import base64
+import hashlib
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from agent_framework.security.authentication import ApiKeyAuthenticationProvider, BasicAuthenticationProvider
+from agent_framework.security.middleware import AuthenticationMiddleware
+
+
+def _basic(value: str) -> str:
+    return "Basic " + base64.b64encode(value.encode()).decode()
+
+
+def test_basic_authentication_protects_endpoint_and_keeps_health_public():
+    app = FastAPI()
+    app.add_middleware(
+        AuthenticationMiddleware,
+        provider=BasicAuthenticationProvider("tia", "sha256:" + hashlib.sha256(b"secret").hexdigest()),
+        public_paths=["/health"],
+    )
+
+    @app.get("/health")
+    async def health():
+        return {"status": "ok"}
+
+    @app.get("/protected")
+    async def protected():
+        return {"status": "protected"}
+
+    client = TestClient(app)
+    assert client.get("/health").status_code == 200
+    assert client.get("/protected").status_code == 401
+    assert client.get("/protected", headers={"Authorization": _basic("tia:wrong")}).status_code == 401
+    assert client.get("/protected", headers={"Authorization": _basic("tia:secret")}).status_code == 200
+
+
+def test_api_key_authentication():
+    app = FastAPI()
+    app.add_middleware(AuthenticationMiddleware, provider=ApiKeyAuthenticationProvider("plain:key-123"))
+
+    @app.get("/protected")
+    async def protected():
+        return {"status": "ok"}
+
+    client = TestClient(app)
+    assert client.get("/protected").status_code == 401
+    assert client.get("/protected", headers={"x-api-key": "key-123"}).status_code == 200

tests/unit/test_authentication_policies.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+import base64
+
+from fastapi import FastAPI, Request
+from fastapi.testclient import TestClient
+
+from agent_framework.security import (
+    AuthenticationPolicy,
+    BasicAuthenticationProvider,
+    NoAuthenticationProvider,
+    PolicyAuthenticationMiddleware,
+)
+
+
+def _basic(client_id: str, secret: str) -> str:
+    value = base64.b64encode(f"{client_id}:{secret}".encode()).decode()
+    return f"Basic {value}"
+
+
+def test_policy_middleware_public_protected_and_default_deny():
+    app = FastAPI()
+    policies = [
+        AuthenticationPolicy("public", NoAuthenticationProvider(), paths=("/health",)),
+        AuthenticationPolicy(
+            "messages",
+            BasicAuthenticationProvider("tia", "plain:secret"),
+            paths=("/gateway/*",),
+        ),
+    ]
+    app.add_middleware(PolicyAuthenticationMiddleware, policies=policies)
+
+    @app.get("/health")
+    async def health():
+        return {"ok": True}
+
+    @app.get("/gateway/message")
+    async def message(request: Request):
+        return {"subject": request.state.auth_principal.subject}
+
+    @app.get("/unknown")
+    async def unknown():
+        return {"unexpected": True}
+
+    client = TestClient(app)
+    assert client.get("/health").status_code == 200
+    assert client.get("/gateway/message").status_code == 401
+    authenticated = client.get("/gateway/message", headers={"Authorization": _basic("tia", "secret")})
+    assert authenticated.status_code == 200
+    assert authenticated.json()["subject"] == "tia"
+    assert client.get("/unknown").status_code == 401
+
+
+def test_policy_method_filter():
+    app = FastAPI()
+    policies = [AuthenticationPolicy("post-only", NoAuthenticationProvider(), paths=("/resource",), methods=frozenset({"POST"}))]
+    app.add_middleware(PolicyAuthenticationMiddleware, policies=policies)
+
+    @app.get("/resource")
+    async def get_resource():
+        return {"method": "GET"}
+
+    @app.post("/resource")
+    async def post_resource():
+        return {"method": "POST"}
+
+    client = TestClient(app)
+    assert client.post("/resource").status_code == 200
+    assert client.get("/resource").status_code == 401