fix(deps): upgrade OpenAI stack and resolve dependency vulnerabilities

tests/unit/test_backend_manager_jwt.py

@@ -0,0 +1,75 @@
+"""Regression coverage for the prototype's python-jose to PyJWT migration."""
+
+from datetime import UTC, datetime, timedelta
+import importlib.util
+from pathlib import Path
+import sys
+from types import ModuleType, SimpleNamespace
+
+from fastapi import HTTPException
+from fastapi.security import HTTPAuthorizationCredentials
+import jwt
+import pytest
+
+
+@pytest.fixture
+def auth(monkeypatch):
+    # Load only the authentication module, without Docker, GCP or real settings.
+    config = ModuleType("app.config")
+    config.settings = SimpleNamespace(
+        JWT_SECRET_KEY="test-only-signing-key-with-at-least-32-bytes",
+        JWT_ALGORITHM="HS256",
+        JWT_ACCESS_TOKEN_EXPIRE_MINUTES=60,
+    )
+    monkeypatch.setitem(sys.modules, "app.config", config)
+    path = (
+        Path(__file__).resolve().parents[2] / "playground/backend_manager/app/auth/jwt_handler.py"
+    )
+    spec = importlib.util.spec_from_file_location("backend_manager_jwt_test", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+@pytest.mark.asyncio
+async def test_signed_token_preserves_claims_and_authenticated_user(auth):
+    token = auth.create_access_token("user@example.com", {"role": "tester"})
+    claims = auth.decode_access_token(token)
+    assert claims["sub"] == "user@example.com"
+    assert claims["role"] == "tester"
+    assert claims["iss"] == "artemis-backend-manager"
+    assert claims["exp"] > claims["iat"]
+    credentials = HTTPAuthorizationCredentials(scheme="Bearer", credentials=token)
+    assert await auth.get_current_user(credentials) == "user@example.com"
+
+
+@pytest.mark.parametrize("invalid", ["expired", "signature", "algorithm", "unsigned", "malformed"])
+def test_invalid_tokens_remain_unauthorized(auth, invalid):
+    claims = {"sub": "user", "exp": datetime.now(UTC) + timedelta(minutes=5)}
+    key = auth.settings.JWT_SECRET_KEY
+    algorithm = "HS256"
+    if invalid == "expired":
+        claims["exp"] = datetime.now(UTC) - timedelta(minutes=5)
+    elif invalid == "signature":
+        key = "different-test-only-signing-key-with-32-bytes"
+    elif invalid == "algorithm":
+        algorithm = "HS384"
+        key = "another-test-only-key-long-enough-for-hs384-signatures"
+    elif invalid == "unsigned":
+        algorithm, key = "none", None
+    token = jwt.encode(claims, key, algorithm=algorithm)
+    if invalid == "malformed":
+        token = "not-a-jwt"
+    with pytest.raises(HTTPException) as error:
+        auth.decode_access_token(token)
+    assert error.value.status_code == 401
+    assert error.value.headers == {"WWW-Authenticate": "Bearer"}
+
+
+@pytest.mark.asyncio
+async def test_missing_subject_is_rejected(auth):
+    token = jwt.encode({}, auth.settings.JWT_SECRET_KEY, algorithm="HS256")
+    credentials = HTTPAuthorizationCredentials(scheme="Bearer", credentials=token)
+    with pytest.raises(HTTPException) as error:
+        await auth.get_current_user(credentials)
+    assert error.value.status_code == 401