meal-order-manager/tests/test_terraform_cognito_auth.py

"""Structural checks for portal Cognito ID-token configuration."""

from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
TERRAFORM = ROOT / "terraform"


def _read(name: str) -> str:
    return (TERRAFORM / name).read_text()


def test_portal_cognito_parameters_are_managed():
    locals_tf = _read("locals.tf")
    ssm_tf = _read("ssm.tf")
    variables_tf = _read("variables.tf")

    assert (
        'portal_cognito_issuer_param   = "${local.ssm_prefix}/portal-cognito-issuer"'
        in locals_tf
    )
    assert (
        'portal_cognito_audience_param = "${local.ssm_prefix}/portal-cognito-audience"'
        in locals_tf
    )
    assert (
        'portal_cognito_trust_param    = "${local.ssm_prefix}/portal-cognito-trust"'
        in locals_tf
    )
    assert 'resource "aws_ssm_parameter" "portal_cognito_issuer"' in ssm_tf
    assert 'resource "aws_ssm_parameter" "portal_cognito_audience"' in ssm_tf
    assert 'resource "aws_ssm_parameter" "portal_cognito_trust"' in ssm_tf
    assert 'variable "portal_cognito_issuer"' in variables_tf
    assert 'variable "portal_cognito_audience"' in variables_tf
    assert 'variable "portal_cognito_extra_trust"' in variables_tf


def test_both_api_lambdas_receive_parameter_names():
    lambda_tf = _read("lambda.tf")

    assert lambda_tf.count("PORTAL_COGNITO_ISSUER_PARAM") == 2
    assert lambda_tf.count("PORTAL_COGNITO_AUDIENCE_PARAM") == 2
    assert lambda_tf.count("PORTAL_COGNITO_TRUST_PARAM") == 2
    assert lambda_tf.count("aws_ssm_parameter.portal_cognito_issuer.name") == 2
    assert lambda_tf.count("aws_ssm_parameter.portal_cognito_audience.name") == 2
    assert lambda_tf.count("aws_ssm_parameter.portal_cognito_trust.name") == 2


def test_submit_route_remains_public_for_google_compatibility():
    locals_tf = _read("locals.tf")
    submit_route = locals_tf.split("submit_order = {", 1)[1].split("}", 1)[0]

    assert 'route_key         = "POST /api/submit-order"' in submit_route
    assert 'authorizer        = "NONE"' in submit_route
    assert 'authorizer_type                   = "JWT"' not in _read("apigateway.tf")