datadog-api-client-python/tests/test_pat_auth.py at 3c7c23c8e461dbfeca5f116fc6356c37eee57c89 · DataDog/datadog-api-client-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
"""Tests for Personal Access Token (PAT) authentication support."""

from unittest.mock import patch

from datadog_api_client.api_client import ApiClient, Endpoint as _Endpoint
from datadog_api_client.configuration import Configuration


class TestBearerTokenConfiguration:
    """Test access_token field on Configuration for bearer auth."""

    def test_bearer_token_stored(self):
        config = Configuration(access_token="ddpat_test123")
        assert config.access_token == "ddpat_test123"

    def test_bearer_token_default_none(self):
        config = Configuration()
        assert config.access_token is None

    @patch.dict("os.environ", {"DD_BEARER_TOKEN": "ddpat_from_env"})
    def test_bearer_token_env_var(self):
        config = Configuration()
        assert config.access_token == "ddpat_from_env"

    @patch.dict("os.environ", {"DD_BEARER_TOKEN": "ddpat_from_env"})
    def test_bearer_token_env_var_no_override(self):
        config = Configuration(access_token="ddpat_explicit")
        assert config.access_token == "ddpat_explicit"


class TestAuthSettingsWithBearerToken:
    """Test auth_settings() with access_token configured."""

    def test_auth_settings_includes_bearer(self):
        config = Configuration(access_token="ddpat_test123")
        auth = config.auth_settings()
        assert "bearerAuth" in auth
        assert auth["bearerAuth"]["type"] == "bearer"
        assert auth["bearerAuth"]["in"] == "header"
        assert auth["bearerAuth"]["key"] == "Authorization"
        assert auth["bearerAuth"]["value"] == "Bearer ddpat_test123"

    def test_auth_settings_without_bearer(self):
        config = Configuration()
        auth = config.auth_settings()
        assert "bearerAuth" not in auth


class TestUpdateParamsForAuthWithBearerToken:
    """Test that update_params_for_auth sends all configured auth headers."""

    def _make_endpoint(self, config, auth_schemes):
        """Helper to create an Endpoint with given auth schemes."""
        api_client = ApiClient(config)
        return _Endpoint(
            settings={
                "response_type": None,
                "auth": auth_schemes,
                "endpoint_path": "/api/v2/test",
                "operation_id": "test_op",
                "http_method": "GET",
                "version": "v2",
            },
            params_map={},
            headers_map={"accept": ["application/json"]},
            api_client=api_client,
        )

    def test_all_auth_headers_sent_when_all_configured(self):
        """When all credentials are set, all auth headers are sent."""
        config = Configuration(
            api_key={"apiKeyAuth": "test-api-key", "appKeyAuth": "test-app-key"},
            access_token="ddpat_test_pat",
        )
        endpoint = self._make_endpoint(config, ["apiKeyAuth", "appKeyAuth", "bearerAuth"])
        headers = {}
        queries = []
        endpoint.update_params_for_auth(headers, queries)

        assert headers["Authorization"] == "Bearer ddpat_test_pat"
        assert headers["DD-API-KEY"] == "test-api-key"
        assert headers["DD-APPLICATION-KEY"] == "test-app-key"

    def test_bearer_only(self):
        """Bearer token works without any API keys configured."""
        config = Configuration(access_token="ddpat_test_pat")
        endpoint = self._make_endpoint(config, ["apiKeyAuth", "appKeyAuth", "bearerAuth"])
        headers = {}
        queries = []
        endpoint.update_params_for_auth(headers, queries)

        assert headers["Authorization"] == "Bearer ddpat_test_pat"
        assert "DD-API-KEY" not in headers
        assert "DD-APPLICATION-KEY" not in headers

    def test_api_keys_only(self):
        """Regular auth works without bearer token."""
        config = Configuration(
            api_key={"apiKeyAuth": "test-api-key", "appKeyAuth": "test-app-key"},
        )
        endpoint = self._make_endpoint(config, ["apiKeyAuth", "appKeyAuth", "bearerAuth"])
        headers = {}
        queries = []
        endpoint.update_params_for_auth(headers, queries)

        assert headers["DD-API-KEY"] == "test-api-key"
        assert headers["DD-APPLICATION-KEY"] == "test-app-key"
        assert "Authorization" not in headers

    def test_bearer_not_sent_when_not_in_endpoint_auth(self):
        """access_token set but endpoint doesn't declare bearerAuth."""
        config = Configuration(
            api_key={"apiKeyAuth": "test-api-key", "appKeyAuth": "test-app-key"},
            access_token="ddpat_test_pat",
        )
        endpoint = self._make_endpoint(config, ["apiKeyAuth", "appKeyAuth"])
        headers = {}
        queries = []
        endpoint.update_params_for_auth(headers, queries)

        assert headers["DD-API-KEY"] == "test-api-key"
        assert headers["DD-APPLICATION-KEY"] == "test-app-key"
        assert "Authorization" not in headers