search

France-ioi / AlgoreaBackend

Backend for the new Algorea platform
MIT License
1 stars 2 forks source link

Allow not providing the access token when the task token is provided #1082

Closed GeoffreyHuck closed 2 months ago

GeoffreyHuck commented 2 months ago

fixes #1057

Update itemGetAnswerToken and itemGetHintToken services to be called without an access token.

Those services were removed from the auth middleware.

Tests to check we don't accept falsified tokens

To simulate the falsification of a token, a single byte was changed in its payload. This way, the signature of the token isn't valid anymore. Details are in the specific commit.

Tests for teams

Two tests were added for a team but I'm not really sure how teams are working. When a hint is asked, it's asked for the team? If so, the test is probably correct.

Do we need more robustness tests for the teams?

There are no tests that specifically check that:

I'm not sure whether this should be added. Should we consider that since the token has been generated by the backend, we can trust everything in it? And what if some permissions changed since?

Review

Easier to review commit by commit with the details in commit messages.

codecov[bot] commented 2 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 100.00%. Comparing base (79d18de) to head (a7a0d07).

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #1082 +/- ## ========================================= Coverage 100.00% 100.00% ========================================= Files 236 236 Lines 14326 14321 -5 ========================================= - Hits 14326 14321 -5 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.