Authorization Feature

tests/unit/test_authentication.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import base64
+import hashlib
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from agent_framework.security.authentication import ApiKeyAuthenticationProvider, BasicAuthenticationProvider
+from agent_framework.security.middleware import AuthenticationMiddleware
+
+
+def _basic(value: str) -> str:
+    return "Basic " + base64.b64encode(value.encode()).decode()
+
+
+def test_basic_authentication_protects_endpoint_and_keeps_health_public():
+    app = FastAPI()
+    app.add_middleware(
+        AuthenticationMiddleware,
+        provider=BasicAuthenticationProvider("tia", "sha256:" + hashlib.sha256(b"secret").hexdigest()),
+        public_paths=["/health"],
+    )
+
+    @app.get("/health")
+    async def health():
+        return {"status": "ok"}
+
+    @app.get("/protected")
+    async def protected():
+        return {"status": "protected"}
+
+    client = TestClient(app)
+    assert client.get("/health").status_code == 200
+    assert client.get("/protected").status_code == 401
+    assert client.get("/protected", headers={"Authorization": _basic("tia:wrong")}).status_code == 401
+    assert client.get("/protected", headers={"Authorization": _basic("tia:secret")}).status_code == 200
+
+
+def test_api_key_authentication():
+    app = FastAPI()
+    app.add_middleware(AuthenticationMiddleware, provider=ApiKeyAuthenticationProvider("plain:key-123"))
+
+    @app.get("/protected")
+    async def protected():
+        return {"status": "ok"}
+
+    client = TestClient(app)
+    assert client.get("/protected").status_code == 401
+    assert client.get("/protected", headers={"x-api-key": "key-123"}).status_code == 200