From 8a5c6197b1177a396e6a255f1fe1b934b0a163a0 Mon Sep 17 00:00:00 2001 From: SlavaKuntsov Date: Tue, 29 Sep 2026 20:46:42 +0300 Subject: [PATCH] fix(auth): require type=access in /me --- services/auth/src/routers/auth.py | 3 +++ services/auth/tests/test_auth.py | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/services/auth/src/routers/auth.py b/services/auth/src/routers/auth.py index a9905c5..7faffa2 100644 --- a/services/auth/src/routers/auth.py +++ b/services/auth/src/routers/auth.py @@ -109,6 +109,9 @@ async def me(token: str = Depends(_get_token), db: AsyncSession = Depends(get_db payload = decode_token(token) except ValueError: raise HTTPException(401, "invalid token") + if payload.get("type") != "access": + # issue #76: refresh-токен — не identity, как в Go-мидлварях (#53) + raise HTTPException(401, "not an access token") user_id = payload["sub"] # user_id is str from JWT; compare as UUID import uuid diff --git a/services/auth/tests/test_auth.py b/services/auth/tests/test_auth.py index 34858b5..1b99b20 100644 --- a/services/auth/tests/test_auth.py +++ b/services/auth/tests/test_auth.py @@ -199,6 +199,18 @@ def test_me_oversized_token_rejected(): assert r.status_code == 401 +def test_me_with_refresh_token_rejected(): + # issue #76: refresh-токен — не identity для /me + mock_db = AsyncMock() + mock_db.execute = AsyncMock(return_value=FakeResult(None)) + token = create_refresh_token(str(uuid.uuid4())) + c = client_with_mock(mock_db) + r = c.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {token}"}) + clear_overrides() + assert r.status_code == 401 + mock_db.execute.assert_not_awaited() + + def test_refresh_token_without_exp_rejected(): # issue #53: token without exp must not validate import jwt as pyjwt